Source2Image Deep Dive
summary
Compares concrete on-cluster build options and tradeoffs: running a privileged pod that mounts the docker daemon is simple but opens host compromise; s2i + the OpenShift Build API gives buildconfig objects, image-change and Git webhooks, and controlled privileged pods so builds can reuse host layer cache; the container builder interface (CBI) and tools like Kaniko aim for daemonless, pluggable builders; several teams use VM sandboxes or gVisor-like sandboxes today to regain isolation while they work toward unprivileged, cache-friendly on-cluster builds.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:42Agenda
- 1:15Image Builds on Cluster
- 3:26Open Ship Build API
- 5:41Build API Overview
- 7:56Build API Example
- 9:22Container Builder Interface
- 10:35AgroProj
- 11:51Google Container Builder
- 14:22Volumes
- 15:39What are your experiences
- 16:45Questions
- 20:45Exclude VMs
- 21:49Singleuse VMs
- 22:44Docker Diamond
- 23:21Unprivileged Docker
- 24:16Openshift Internal Registry
- 25:48Source Input
- 26:56Summary
- 27:25dockerfile syntax
- 29:13docker daemon
- 31:13Kubernetes running containers
- 33:18Dockerfile support
related talks
01h 15mEvaluation of OSS Options to Build Container Images
30mRootless, Reproducible, and Hermetic: Secure Container Build Showdown
58mOptions Galore to Get from Source Code to Container
14mBuild It Your Way: Modular Pipelines for Bootable Containers
54mHowto: Options Galore to Get from Source Code to Container
40mBuilding Better Containers: A Survey of Container Build Tools [I]
50mHowto: Options Galore to Get from Source Code to Container
34mDeep Dive: Cloud Native Buildpacks