OCI in CF: For Buildpacks, Security and Interoperability
summary
Proposal replaces Cloud Foundry droplets with images exported to the OCI image spec, so buildpacks produce layered container images (like Docker) that run via existing Docker/Diego runtimes and registries. Claims: staging sends only diffs, startup is faster, shared layers cut transfer and caching, and security patching becomes a rebase layers operation instead of full restage. Tools discussed: layered filesystem images, registries, Diego, optional BOSH/admin API; proof‑of‑concept and implementation notes exist, with rebase conflicts and registry auth as known caveats.
AI-written summary · about
chapters (9)
- 0:00Introduction to OCI in CF
- 4:14Problems with current buildpacks
- 8:54Layered file systems and OCI images
- 12:50Solving patching and immutability
- 17:55Benefits of OCI images in CF
- 22:14Rebasing and caching advantages
- 25:48Workflow changes with OCI
- 29:53Future possibilities and integration
- 32:29Q&A and closing remarks
related talks
18mHeterogeneous Hardware-Accelerated OCI Containers & Secure OCI Containers
31mBuildpacks: Pragmatic Solutions To Quick and Secure Image Builds
36mContainer Images & Security 101: 5 Need to Know Facts
34mUnprivileged Image Builds: What are the Challenges and Where are we Today?
05mGetting Started Getting Started with Containers
27mHigh-Security, Zero-Connectivity & Air-Gapped Clouds: Delivering Complex Software with the Open Component Model & Flux
22mUsing Buildpacks To Reduce Container Bloat and Attack Surface
26mThe State of Supply Chain Security in the Cloud Foundry Ecosystem