Building Docker Images Without Docker
summary
Motivated by reproducible, minimal and unprivileged builds, the talk compares no daemon builds (BuildKit/Buildah), an on-cluster builder that creates images without nested containers (Kaniko runs on-cluster unprivileged), and Bazel/distroless approaches that produce deterministic tarballs and tiny runtimes (distroless: minimal but no shell). Go libraries like go-containerregistry enable programmatic layer edits, rebases and retags. Advice: separate build/push/pull, prefer runtime‑less builders for CI, and invest in language‑specific layering for faster, cacheable builds.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:41Why move away from Docker
- 4:05The container build landscape
- 5:37Image building approaches
- 8:26Using Kaniko and Buildah
- 10:05Distroless and reproduction
- 14:23Container image libraries
- 18:21Future trends and conclusions
related talks
34mDefence Against the Docker Arts
40mBuilding Better Containers: A Survey of Container Build Tools [I]
30mRootless, Reproducible, and Hermetic: Secure Container Build Showdown
58mOptions Galore to Get from Source Code to Container
30mLearning by Pulling Things Apart
51mProduction level Docker
01h 15mEvaluation of OSS Options to Build Container Images
27mDocker Image Journey - How to Shrink a Docker Image