From fad0d25aec873392ee6d860d51990af5a5b7a6d1 Mon Sep 17 00:00:00 2001 From: Priya Wadhwa Date: Mon, 2 Apr 2018 11:05:23 -0700 Subject: [PATCH 1/5] Add README and update name to kaniko --- Makefile | 14 +++--- README.md | 37 ++++++++++++++- deploy/Dockerfile | 2 +- .../dockerfiles/config_test_copy.json | 4 +- .../dockerfiles/config_test_extract_fs.json | 4 +- .../dockerfiles/config_test_run.json | 4 +- .../dockerfiles/config_test_run_2.json | 4 +- integration_tests/integration_test_yaml.go | 46 +++++++++---------- {kbuild => kaniko}/cmd/root.go | 6 +-- {kbuild => kaniko}/main.go | 2 +- pkg/constants/constants.go | 2 +- pkg/snapshot/snapshot_test.go | 8 ++-- pkg/util/fs_util.go | 2 +- pkg/util/fs_util_test.go | 12 ++--- 14 files changed, 91 insertions(+), 56 deletions(-) rename {kbuild => kaniko}/cmd/root.go (86%) rename {kbuild => kaniko}/main.go (91%) diff --git a/Makefile b/Makefile index 1694112bf..24f5b5b79 100644 --- a/Makefile +++ b/Makefile @@ -23,7 +23,7 @@ GOOS ?= $(shell go env GOOS) GOARCH = amd64 ORG := github.com/GoogleCloudPlatform PROJECT := k8s-container-builder -REGISTRY?=gcr.io/kbuild-project +REGISTRY?=gcr.io/kaniko-project REPOPATH ?= $(ORG)/$(PROJECT) @@ -32,23 +32,23 @@ GO_LDFLAGS := '-extldflags "-static"' GO_BUILD_TAGS := "containers_image_ostree_stub containers_image_openpgp exclude_graphdriver_devicemapper exclude_graphdriver_btrfs exclude_graphdriver_overlay" EXECUTOR_PACKAGE = $(REPOPATH)/executor -KBUILD_PACKAGE = $(REPOPATH)/kbuild +KANIKO_PROJECT = $(REPOPATH)/kaniko out/executor: $(GO_FILES) GOOS=$* GOARCH=$(GOARCH) CGO_ENABLED=0 go build -ldflags $(GO_LDFLAGS) -tags $(GO_BUILD_TAGS) -o $@ $(EXECUTOR_PACKAGE) -out/kbuild: $(GO_FILES) - GOOS=$* GOARCH=$(GOARCH) CGO_ENABLED=0 go build -ldflags $(GO_LDFLAGS) -tags $(GO_BUILD_TAGS) -o $@ $(KBUILD_PACKAGE) +out/kaniko: $(GO_FILES) + GOOS=$* GOARCH=$(GOARCH) CGO_ENABLED=0 go build -ldflags $(GO_LDFLAGS) -tags $(GO_BUILD_TAGS) -o $@ $(KANIKO_PROJECT) .PHONY: test -test: out/executor out/kbuild +test: out/executor out/kaniko @ ./test.sh .PHONY: integration-test -integration-test: out/executor out/kbuild +integration-test: out/executor out/kaniko @ ./integration-test.sh .PHONY: images -images: out/executor out/kbuild +images: out/executor out/kaniko docker build -t $(REGISTRY)/executor:latest -f deploy/Dockerfile . diff --git a/README.md b/README.md index a0171eed9..93f4a9d57 100644 --- a/README.md +++ b/README.md @@ -1 +1,36 @@ -kbuild is a tool to build container images from a Dockerfile in a Kubernetes cluster. \ No newline at end of file +# kaniko + +kaniko is a tool to build container images from a Dockerfile without a Docker daemon. This enables building container images in unpriviliged environments, which can't easily or securely run a Docker daemon, such as a standard Kubernetes cluster. + +The majority of Dockerfile commands can be executed with kaniko, but we're still working on supporting the following commands: + * ADD + * SHELL + * HEALTHCHECK + * STOPSIGNAL + * ONBUILD + * ARG + * VOLUME + +We're currently in the process of building kaniko, so as of now it isn't production ready. Please let us know if you have any feature requests or find any bugs! + +## Running kaniko in a Kubernetes cluster + +kaniko runs as an image, which is responsible for building the final image from a Dockerfile and pushing it to a GCR registry. + +`make images` + +The image takes in three arguments: a path to a Dockerfile, a path to a build context, and the GCR registry the final image should be pushed to (in the form gcr.io/$PROJECT/$IMAGE:$TAG) + + +## Comparison with Other Tools + +Similar tools include: + * [img](https://github.com/genuinetools/img) + * [orca-build](https://github.com/cyphar/orca-build) + * [buildah](https://github.com/projectatomic/buildah) + +All of these tools build container images; however, the way in which they accomplish this differs from kaniko. Both kaniko and img build unprivileged images, but they interpret “unprivileged” differently. img builds as a non root user from within the container, while kaniko is run in an unprivileged environment with root access inside the container. + +Unlike orca-build, kaniko doesn't use runC to build images. Instead, it runs as a root user within the container. + +buildah requires the same root privilges as a Docker daemon does to run, while kaniko runs without any special privileges or permissions. diff --git a/deploy/Dockerfile b/deploy/Dockerfile index 7871d3cc9..ef43f79e1 100644 --- a/deploy/Dockerfile +++ b/deploy/Dockerfile @@ -15,7 +15,7 @@ # Builds the static Go image to execute in a Kubernetes job FROM scratch -ADD out/executor /kbuild/executor +ADD out/executor /kaniko/executor ADD files/ca-certificates.crt /etc/ssl/certs/ ADD files/docker-credential-gcr /usr/local/bin/ ADD files/config.json /root/.docker/ diff --git a/integration_tests/dockerfiles/config_test_copy.json b/integration_tests/dockerfiles/config_test_copy.json index 6d222de51..c2fcf57d6 100644 --- a/integration_tests/dockerfiles/config_test_copy.json +++ b/integration_tests/dockerfiles/config_test_copy.json @@ -1,7 +1,7 @@ [ { - "Image1": "gcr.io/kbuild-test/docker-test-copy:latest", - "Image2": "gcr.io/kbuild-test/kbuild-test-copy:latest", + "Image1": "gcr.io/kaniko-test/docker-test-copy:latest", + "Image2": "gcr.io/kaniko-test/kaniko-test-copy:latest", "DiffType": "File", "Diff": { "Adds": null, diff --git a/integration_tests/dockerfiles/config_test_extract_fs.json b/integration_tests/dockerfiles/config_test_extract_fs.json index a5b03a8e9..2143ed492 100644 --- a/integration_tests/dockerfiles/config_test_extract_fs.json +++ b/integration_tests/dockerfiles/config_test_extract_fs.json @@ -1,7 +1,7 @@ [ { - "Image1": "gcr.io/kbuild-test/docker-extract-filesystem:latest", - "Image2": "gcr.io/kbuild-test/kbuild-extract-filesystem:latest", + "Image1": "gcr.io/kaniko-test/docker-extract-filesystem:latest", + "Image2": "gcr.io/kaniko-test/kaniko-extract-filesystem:latest", "DiffType": "File", "Diff": { "Adds": null, diff --git a/integration_tests/dockerfiles/config_test_run.json b/integration_tests/dockerfiles/config_test_run.json index 19cab3219..4bd52a28a 100644 --- a/integration_tests/dockerfiles/config_test_run.json +++ b/integration_tests/dockerfiles/config_test_run.json @@ -1,7 +1,7 @@ [ { - "Image1": "gcr.io/kbuild-test/docker-test-run:latest", - "Image2": "gcr.io/kbuild-test/kbuild-test-run:latest", + "Image1": "gcr.io/kaniko-test/docker-test-run:latest", + "Image2": "gcr.io/kaniko-test/kaniko-test-run:latest", "DiffType": "File", "Diff": { "Adds": null, diff --git a/integration_tests/dockerfiles/config_test_run_2.json b/integration_tests/dockerfiles/config_test_run_2.json index 0301973df..11f48cbca 100644 --- a/integration_tests/dockerfiles/config_test_run_2.json +++ b/integration_tests/dockerfiles/config_test_run_2.json @@ -1,7 +1,7 @@ [ { - "Image1": "gcr.io/kbuild-test/docker-test-run-2:latest", - "Image2": "gcr.io/kbuild-test/kbuild-test-run-2:latest", + "Image1": "gcr.io/kaniko-test/docker-test-run-2:latest", + "Image2": "gcr.io/kaniko-test/kaniko-test-run-2:latest", "DiffType": "File", "Diff": { "Adds": null, diff --git a/integration_tests/integration_test_yaml.go b/integration_tests/integration_test_yaml.go index 3129456ff..f5857c228 100644 --- a/integration_tests/integration_test_yaml.go +++ b/integration_tests/integration_test_yaml.go @@ -93,12 +93,12 @@ type testyaml struct { } var executorImage = "executor-image" -var executorCommand = "/kbuild/executor" +var executorCommand = "/kaniko/executor" var dockerImage = "gcr.io/cloud-builders/docker" var ubuntuImage = "ubuntu" -var testRepo = "gcr.io/kbuild-test/" +var testRepo = "gcr.io/kaniko-test/" var dockerPrefix = "docker-" -var kbuildPrefix = "kbuild-" +var kanikoPrefix = "kaniko-" var daemonPrefix = "daemon://" var containerDiffOutputFile = "container-diff.json" @@ -137,23 +137,23 @@ func main() { Args: []string{"build", "-t", dockerImageTag, "-f", test.dockerfilePath, test.context}, } - // Then, buld the image with kbuild - kbuildImage := testRepo + kbuildPrefix + test.repo - kbuild := step{ + // Then, buld the image with kaniko + kanikoImage := testRepo + kanikoPrefix + test.repo + kaniko := step{ Name: executorImage, - Args: []string{executorCommand, "--destination", kbuildImage, "--dockerfile", test.dockerfilePath, "--context", test.context}, + Args: []string{executorCommand, "--destination", kanikoImage, "--dockerfile", test.dockerfilePath, "--context", test.context}, } - // Pull the kbuild image - pullKbuildImage := step{ + // Pull the kaniko image + pullKanikoImage := step{ Name: dockerImage, - Args: []string{"pull", kbuildImage}, + Args: []string{"pull", kanikoImage}, } daemonDockerImage := daemonPrefix + dockerImageTag - daemonKbuildImage := daemonPrefix + kbuildImage + daemonKanikoImage := daemonPrefix + kanikoImage // Run container diff on the images - args := "container-diff-linux-amd64 diff " + daemonDockerImage + " " + daemonKbuildImage + " --type=file -j >" + containerDiffOutputFile + args := "container-diff-linux-amd64 diff " + daemonDockerImage + " " + daemonKanikoImage + " --type=file -j >" + containerDiffOutputFile containerDiff := step{ Name: ubuntuImage, Args: []string{"sh", "-c", args}, @@ -169,7 +169,7 @@ func main() { Args: []string{"cmp", test.configPath, containerDiffOutputFile}, } - y.Steps = append(y.Steps, dockerBuild, kbuild, pullKbuildImage, containerDiff, catContainerDiffOutput, compareOutputs) + y.Steps = append(y.Steps, dockerBuild, kaniko, pullKanikoImage, containerDiff, catContainerDiffOutput, compareOutputs) } for _, test := range structureTests { @@ -181,19 +181,19 @@ func main() { Args: []string{"build", "-t", dockerImageTag, "-f", test.dockerfilePath, test.dockerBuildContext}, } - // Build the image with kbuild - kbuildImage := testRepo + kbuildPrefix + test.repo - kbuild := step{ + // Build the image with kaniko + kanikoImage := testRepo + kanikoPrefix + test.repo + kaniko := step{ Name: executorImage, - Args: []string{executorCommand, "--destination", kbuildImage, "--dockerfile", test.dockerfilePath}, + Args: []string{executorCommand, "--destination", kanikoImage, "--dockerfile", test.dockerfilePath}, } - // Pull the kbuild image - pullKbuildImage := step{ + // Pull the kaniko image + pullKanikoImage := step{ Name: dockerImage, - Args: []string{"pull", kbuildImage}, + Args: []string{"pull", kanikoImage}, } - // Run structure tests on the kbuild and docker image - args := "container-structure-test -image " + kbuildImage + " " + test.structureTestYamlPath + // Run structure tests on the kaniko and docker image + args := "container-structure-test -image " + kanikoImage + " " + test.structureTestYamlPath structureTest := step{ Name: ubuntuImage, Args: []string{"sh", "-c", args}, @@ -206,7 +206,7 @@ func main() { Env: []string{"PATH=/workspace:/bin"}, } - y.Steps = append(y.Steps, dockerBuild, kbuild, pullKbuildImage, structureTest, dockerStructureTest) + y.Steps = append(y.Steps, dockerBuild, kaniko, pullKanikoImage, structureTest, dockerStructureTest) } d, _ := yaml.Marshal(&y) diff --git a/kbuild/cmd/root.go b/kaniko/cmd/root.go similarity index 86% rename from kbuild/cmd/root.go rename to kaniko/cmd/root.go index 0d7b9c05d..dc81e1a6c 100644 --- a/kbuild/cmd/root.go +++ b/kaniko/cmd/root.go @@ -21,9 +21,9 @@ import ( ) var RootCmd = &cobra.Command{ - Use: "kbuild", - Short: "kbuild is a CLI tool for building container images with full Dockerfile support without the need for Docker", - Long: `kbuild is a CLI tool for building container images with full Dockerfile support. It doesn't require Docker, + Use: "kaniko", + Short: "kaniko is a CLI tool for building container images with full Dockerfile support without the need for Docker", + Long: `kaniko is a CLI tool for building container images with full Dockerfile support. It doesn't require Docker, and builds the images in a Kubernetes cluster before pushing the final image to a registry.`, Run: func(cmd *cobra.Command, args []string) { }, diff --git a/kbuild/main.go b/kaniko/main.go similarity index 91% rename from kbuild/main.go rename to kaniko/main.go index 54046e53a..ba8a61643 100644 --- a/kbuild/main.go +++ b/kaniko/main.go @@ -18,7 +18,7 @@ package main import ( "fmt" - "github.com/GoogleCloudPlatform/k8s-container-builder/kbuild/cmd" + "github.com/GoogleCloudPlatform/k8s-container-builder/kaniko/cmd" "os" ) diff --git a/pkg/constants/constants.go b/pkg/constants/constants.go index 5845194bd..22d356dec 100644 --- a/pkg/constants/constants.go +++ b/pkg/constants/constants.go @@ -28,5 +28,5 @@ const ( WhitelistPath = "/proc/self/mountinfo" - Author = "kbuild" + Author = "kaniko" ) diff --git a/pkg/snapshot/snapshot_test.go b/pkg/snapshot/snapshot_test.go index ef77e6f81..040669abe 100644 --- a/pkg/snapshot/snapshot_test.go +++ b/pkg/snapshot/snapshot_test.go @@ -39,7 +39,7 @@ func TestSnapshotFileChange(t *testing.T) { newFiles := map[string]string{ "foo": "newbaz1", "bar/bat": "baz", - "kbuild/bat": "bat", + "kaniko/bat": "bat", } if err := testutil.SetupFiles(testDir, newFiles); err != nil { t.Fatalf("Error setting up fs: %s", err) @@ -135,14 +135,14 @@ func TestSnapshotFiles(t *testing.T) { // Make some changes to the filesystem newFiles := map[string]string{ "foo": "newbaz1", - "kbuild/file": "bat", + "kaniko/file": "bat", } if err := testutil.SetupFiles(testDir, newFiles); err != nil { t.Fatalf("Error setting up fs: %s", err) } filesToSnapshot := []string{ filepath.Join(testDir, "foo"), - filepath.Join(testDir, "kbuild/file"), + filepath.Join(testDir, "kaniko/file"), } contents, err := snapshotter.TakeSnapshot(filesToSnapshot) if err != nil { @@ -199,7 +199,7 @@ func setUpTestDir() (string, *Snapshotter, error) { files := map[string]string{ "foo": "baz1", "bar/bat": "baz2", - "kbuild/file": "file", + "kaniko/file": "file", } // Set up initial files if err := testutil.SetupFiles(testDir, files); err != nil { diff --git a/pkg/util/fs_util.go b/pkg/util/fs_util.go index c0ba9008e..7b5462c49 100644 --- a/pkg/util/fs_util.go +++ b/pkg/util/fs_util.go @@ -28,7 +28,7 @@ import ( "strings" ) -var whitelist = []string{"/kbuild"} +var whitelist = []string{"/kaniko"} // ExtractFileSystemFromImage pulls an image and unpacks it to a file system at root func ExtractFileSystemFromImage(img string) error { diff --git a/pkg/util/fs_util_test.go b/pkg/util/fs_util_test.go index c8ebc88cf..19bef1d9b 100644 --- a/pkg/util/fs_util_test.go +++ b/pkg/util/fs_util_test.go @@ -46,7 +46,7 @@ func Test_fileSystemWhitelist(t *testing.T) { } actualWhitelist, err := fileSystemWhitelist(path) - expectedWhitelist := []string{"/kbuild", "/proc", "/dev", "/dev/pts", "/sys"} + expectedWhitelist := []string{"/kaniko", "/proc", "/dev", "/dev/pts", "/sys"} sort.Strings(actualWhitelist) sort.Strings(expectedWhitelist) testutil.CheckErrorAndDeepEqual(t, false, err, expectedWhitelist, actualWhitelist) @@ -61,7 +61,7 @@ var tests = []struct { files: map[string]string{ "/workspace/foo/a": "baz1", "/workspace/foo/b": "baz2", - "/kbuild/file": "file", + "/kaniko/file": "file", }, directory: "/workspace/foo/", expectedFiles: []string{ @@ -84,7 +84,7 @@ var tests = []struct { "/workspace/foo/a": "baz1", "/workspace/foo/b": "baz2", "/workspace/baz": "hey", - "/kbuild/file": "file", + "/kaniko/file": "file", }, directory: "/workspace", expectedFiles: []string{ @@ -99,16 +99,16 @@ var tests = []struct { files: map[string]string{ "/workspace/foo/a": "baz1", "/workspace/foo/b": "baz2", - "/kbuild/file": "file", + "/kaniko/file": "file", }, directory: "", expectedFiles: []string{ "workspace/foo/a", "workspace/foo/b", - "kbuild/file", + "kaniko/file", "workspace", "workspace/foo", - "kbuild", + "kaniko", ".", }, }, From c63a03d1238f4dc7f2d8b89eabcd8f8262d15d3a Mon Sep 17 00:00:00 2001 From: Priya Wadhwa Date: Wed, 4 Apr 2018 14:40:21 -0700 Subject: [PATCH 2/5] rename to kaniko --- README.md | 1 - integration_tests/dockerfiles/config_test_add.json | 4 ++-- .../dockerfiles/config_test_bucket_buildcontext.json | 4 ++-- pkg/constants/constants.go | 4 ++-- pkg/util/bucket_util.go | 6 +++--- 5 files changed, 9 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index a277608a3..d864403e9 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,6 @@ kaniko is a tool to build unpriviliged container images from a Dockerfile. It doesn't depend on a Docker daemon, which enables building container images in environments that can't easily or securely run a Docker daemon, such as a standard Kubernetes cluster. The majority of Dockerfile commands can be executed with kaniko, but we're still working on supporting the following commands: -* ADD * VOLUME * SHELL * HEALTHCHECK diff --git a/integration_tests/dockerfiles/config_test_add.json b/integration_tests/dockerfiles/config_test_add.json index b6d7a2020..135cd04a3 100644 --- a/integration_tests/dockerfiles/config_test_add.json +++ b/integration_tests/dockerfiles/config_test_add.json @@ -1,7 +1,7 @@ [ { - "Image1": "gcr.io/kbuild-test/docker-test-add:latest", - "Image2": "gcr.io/kbuild-test/kbuild-test-add:latest", + "Image1": "gcr.io/kaniko-test/docker-test-add:latest", + "Image2": "gcr.io/kaniko-test/kaniko-test-add:latest", "DiffType": "File", "Diff": { "Adds": null, diff --git a/integration_tests/dockerfiles/config_test_bucket_buildcontext.json b/integration_tests/dockerfiles/config_test_bucket_buildcontext.json index 690bbea5a..04c066831 100644 --- a/integration_tests/dockerfiles/config_test_bucket_buildcontext.json +++ b/integration_tests/dockerfiles/config_test_bucket_buildcontext.json @@ -1,7 +1,7 @@ [ { - "Image1": "gcr.io/kbuild-test/docker-test-bucket-buildcontext:latest", - "Image2": "gcr.io/kbuild-test/kbuild-test-bucket-buildcontext:latest", + "Image1": "gcr.io/kaniko-test/docker-test-bucket-buildcontext:latest", + "Image2": "gcr.io/kaniko-test/kaniko-test-bucket-buildcontext:latest", "DiffType": "File", "Diff": { "Adds": null, diff --git a/pkg/constants/constants.go b/pkg/constants/constants.go index 46b5a697c..004bb3c89 100644 --- a/pkg/constants/constants.go +++ b/pkg/constants/constants.go @@ -26,8 +26,8 @@ const ( // WorkspaceDir is the path to the workspace directory WorkspaceDir = "/workspace" - //KbuildDir is the path to the kbuild directory - KbuildDir = "/kbuild" + //KanikoDir is the path to the Kaniko directory + KanikoDir = "/kaniko" WhitelistPath = "/proc/self/mountinfo" diff --git a/pkg/util/bucket_util.go b/pkg/util/bucket_util.go index c96bb715c..043c2890f 100644 --- a/pkg/util/bucket_util.go +++ b/pkg/util/bucket_util.go @@ -25,7 +25,7 @@ import ( "path/filepath" ) -// UnpackTarFromGCSBucket unpacks the kbuild.tar file in the given bucket to the given directory +// UnpackTarFromGCSBucket unpacks the context.tar.gz file in the given bucket to the given directory func UnpackTarFromGCSBucket(bucketName, directory string) error { // Get the tar from the bucket tarPath, err := getTarFromBucket(bucketName, directory) @@ -41,7 +41,7 @@ func UnpackTarFromGCSBucket(bucketName, directory string) error { return os.Remove(tarPath) } -// getTarFromBucket gets kbuild.tar from the GCS bucket and saves it to the filesystem +// getTarFromBucket gets context.tar.gz from the GCS bucket and saves it to the filesystem // It returns the path to the tar file func getTarFromBucket(bucketName, directory string) (string, error) { ctx := context.Background() @@ -50,7 +50,7 @@ func getTarFromBucket(bucketName, directory string) (string, error) { return "", err } bucket := client.Bucket(bucketName) - // Get the tarfile kbuild.tar from the GCS bucket, and save it to a tar object + // Get the tarfile context.tar.gz from the GCS bucket, and save it to a tar object reader, err := bucket.Object(constants.ContextTar).NewReader(ctx) if err != nil { return "", err From 0342d64bd2b44f5ca907415cab912e0adcdad809 Mon Sep 17 00:00:00 2001 From: Priya Wadhwa Date: Thu, 5 Apr 2018 15:19:40 -0700 Subject: [PATCH 3/5] fixed readme --- README.md | 48 ++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 38 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index d864403e9..e8f9238dc 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,8 @@ # kaniko -kaniko is a tool to build unpriviliged container images from a Dockerfile. It doesn't depend on a Docker daemon, which enables building container images in environments that can't easily or securely run a Docker daemon, such as a standard Kubernetes cluster. +kaniko is a tool to build unpriviliged container images from a Dockerfile. +kaniko doesn't depend on a Docker daemon and executes each command within a Dockerfile completely in userspace. +This enables building container images in environments that can't easily or securely run a Docker daemon, such as a standard Kubernetes cluster. The majority of Dockerfile commands can be executed with kaniko, but we're still working on supporting the following commands: * VOLUME @@ -10,19 +12,27 @@ The majority of Dockerfile commands can be executed with kaniko, but we're still * ONBUILD * ARG -We're currently in the process of building kaniko, so as of now it isn't production ready. Please let us know if you have any feature requests or find any bugs! +We're currently in the process of building kaniko, so as of now it isn't production ready. +Please let us know if you have any feature requests or find any bugs! ## How does kaniko work? -The kaniko executor image is responsible for building an image from a Dockerfile and pushing it to a registry. Within the executor image, we extract the filesystem of the base image (the FROM image in the Dockerfile). We then execute the commands in the Dockerfile, snapshotting the filesystem in userspace after each one. After each command, we append a layer of changed files to the base image (if there are any) and update image metadata. +The kaniko executor image is responsible for building an image from a Dockerfile and pushing it to a registry. +Within the executor image, we extract the filesystem of the base image (the FROM image in the Dockerfile). +We then execute the commands in the Dockerfile, snapshotting the filesystem in userspace after each one. +After each command, we append a layer of changed files to the base image (if there are any) and update image metadata. ## kaniko Build Contexts -kaniko supports local directories and GCS buckets as build contexts. To specify a local directory, pass in the -`--context` flag as an argument to the executor image. To specify a GCS bucket, pass in the -`--bucket` flag. The GCS bucket should contain a compressed tar of the build context called `context.tar.gz`, which kaniko will unpack and use as the build context. +kaniko supports local directories and GCS buckets as build contexts. To specify a local directory, pass in the `--context` flag as an argument to the executor image. +To specify a GCS bucket, pass in the `--bucket` flag. +The GCS bucket should contain a compressed tar of the build context called `context.tar.gz`, which kaniko will unpack and use as the build context. -To easily create `context.tar.gz`, we can use [skaffold](https://github.com/GoogleCloudPlatform/skaffold). Running the following command within the build context will create `context.tar.gz`, which will contain the Dockerfile and any files it depends on. +To create `context.tar.gz`, run the following command: +```shell +tar -C -zcvf context.tar.gz . +``` +Or, you can use [skaffold](https://github.com/GoogleCloudPlatform/skaffold) to create `context.tar.gz` by running ``` skaffold docker context ``` @@ -59,7 +69,9 @@ Requirements: To run kaniko in a Kubernetes cluster, you will need a standard running Kubernetes cluster and a Kubernetes secret, which contains the auth required to push the final image. -To create the secret, first you will need to create a service account in the Pantheon project you want to push the final image to, with `Storage Admin` permissions. You can download a JSON key for this service account, and rename it `kaniko-secret.json`. To create the secret, run: +To create the secret, first you will need to create a service account in the Pantheon project you want to push the final image to, with `Storage Admin` permissions. +You can download a JSON key for this service account, and rename it `kaniko-secret.json`. +To create the secret, run: ```shell kubectl create secret generic kaniko-secret --from-file= @@ -78,7 +90,9 @@ spec: containers: - name: kaniko image: gcr.io/kaniko-project/executor:latest - args: ["--dockerfile=", "--bucket=", "--destination="] + args: ["--dockerfile=", + "--bucket=", + "--destination="] volumeMounts: - name: kaniko-secret mountPath: /secret @@ -94,6 +108,18 @@ spec: This example pulls the build context from a GCS bucket. To use a local directory build context, you could consider using configMaps to mount in small build contexts. +## Running kaniko in Google Container Builder +To run kaniko in GCB, add it to your build config as a build step: + +```yaml +steps: + - name: gcr.io/kaniko-project/executor:latest + args: ["--dockerfile=", + "--context=", + "--destination="] +``` +kaniko will build and push the final image in this build step. + ## Comparison with Other Tools Similar tools include: @@ -102,7 +128,9 @@ Similar tools include: * [buildah](https://github.com/projectatomic/buildah) * [FTL](https://github.com/GoogleCloudPlatform/runtimes-common/tree/master/ftl) -All of these tools build container images with different approaches. Both kaniko and img build unprivileged images, but they interpret “unprivileged” differently. img builds as a non root user from within the container, while kaniko is run in an unprivileged environment with root access inside the container. +All of these tools build container images with different approaches. +Both kaniko and img build unprivileged images, but they interpret “unprivileged” differently. +img builds as a non root user from within the container, while kaniko is run in an unprivileged environment with root access inside the container. orca-build depends on runC to build images from Dockerfiles; since kaniko doesn't use runC it doesn't require the use of kernel namespacing techniques. From ab76d0f541db0fb0a2b1bff7839d00964e587611 Mon Sep 17 00:00:00 2001 From: Priya Wadhwa Date: Fri, 6 Apr 2018 12:10:10 -0700 Subject: [PATCH 4/5] changed kbuild to kaniko --- README.md | 3 ++- integration_tests/dockerfiles/config_test_volume.json | 4 ++-- integration_tests/integration_test_yaml.go | 2 +- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index e8f9238dc..67c289453 100644 --- a/README.md +++ b/README.md @@ -136,4 +136,5 @@ orca-build depends on runC to build images from Dockerfiles; since kaniko doesn' buildah requires the same root privilges as a Docker daemon does to run, while kaniko runs without any special privileges or permissions. -FTL aims to achieve the fastest possible creation of Docker images for a subset of images. It can be thought of as a special-case "fast path" that can be used in conjunction with the support for general Dockerfiles kaniko provides. +FTL aims to achieve the fastest possible creation of Docker images for a subset of images. +It can be thought of as a special-case "fast path" that can be used in conjunction with the support for general Dockerfiles kaniko provides. diff --git a/integration_tests/dockerfiles/config_test_volume.json b/integration_tests/dockerfiles/config_test_volume.json index 72e958d85..c4ba05ffe 100644 --- a/integration_tests/dockerfiles/config_test_volume.json +++ b/integration_tests/dockerfiles/config_test_volume.json @@ -1,7 +1,7 @@ [ { - "Image1": "gcr.io/kbuild-test/docker-test-volume:latest", - "Image2": "gcr.io/kbuild-test/kbuild-test-volume:latest", + "Image1": "gcr.io/kaniko-test/docker-test-volume:latest", + "Image2": "gcr.io/kaniko-test/kaniko-test-volume:latest", "DiffType": "File", "Diff": { "Adds": null, diff --git a/integration_tests/integration_test_yaml.go b/integration_tests/integration_test_yaml.go index 49ed136c5..f08dab881 100644 --- a/integration_tests/integration_test_yaml.go +++ b/integration_tests/integration_test_yaml.go @@ -99,7 +99,7 @@ var fileTests = []struct { dockerfilePath: "/workspace/integration_tests/dockerfiles/Dockerfile_test_volume", configPath: "/workspace/integration_tests/dockerfiles/config_test_volume.json", dockerContext: buildcontextPath, - kbuildContext: buildcontextPath, + kanikoContext: buildcontextPath, repo: "test-volume", }, { From 885987076ee8b31acfa66f4f0754227d31cfb53d Mon Sep 17 00:00:00 2001 From: Priya Wadhwa Date: Tue, 10 Apr 2018 14:27:10 -0700 Subject: [PATCH 5/5] Change k8s Job to Pod --- README.md | 50 ++++++++++++++++++++++++++------------------------ 1 file changed, 26 insertions(+), 24 deletions(-) diff --git a/README.md b/README.md index 67c289453..b6184d978 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,6 @@ kaniko doesn't depend on a Docker daemon and executes each command within a Dock This enables building container images in environments that can't easily or securely run a Docker daemon, such as a standard Kubernetes cluster. The majority of Dockerfile commands can be executed with kaniko, but we're still working on supporting the following commands: -* VOLUME * SHELL * HEALTHCHECK * STOPSIGNAL @@ -77,36 +76,35 @@ To create the secret, run: kubectl create secret generic kaniko-secret --from-file= ``` -The Kubernetes job.yaml should look similar to this, with the args parameters filled in: +The Kubernetes Pod spec should look similar to this, with the args parameters filled in: ```yaml -apiVersion: batch/v1 -kind: Job +apiVersion: v1 +kind: Pod metadata: name: kaniko spec: - template: - spec: - containers: - - name: kaniko - image: gcr.io/kaniko-project/executor:latest - args: ["--dockerfile=", - "--bucket=", - "--destination="] - volumeMounts: - - name: kaniko-secret - mountPath: /secret - env: - - name: GOOGLE_APPLICATION_CREDENTIALS - value: /secret/kaniko-secret.json - restartPolicy: Never - volumes: - - name: kaniko-secret - secret: - secretName: kaniko-secret + containers: + - name: kaniko + image: gcr.io/kaniko-project/executor:latest + args: ["--dockerfile=", + "--bucket=", + "--destination="] + volumeMounts: + - name: kaniko-secret + mountPath: /secret + env: + - name: GOOGLE_APPLICATION_CREDENTIALS + value: /secret/kaniko-secret.json + restartPolicy: Never + volumes: + - name: kaniko-secret + secret: + secretName: kaniko-secret ``` -This example pulls the build context from a GCS bucket. To use a local directory build context, you could consider using configMaps to mount in small build contexts. +This example pulls the build context from a GCS bucket. +To use a local directory build context, you could consider using configMaps to mount in small build contexts. ## Running kaniko in Google Container Builder To run kaniko in GCB, add it to your build config as a build step: @@ -138,3 +136,7 @@ buildah requires the same root privilges as a Docker daemon does to run, while k FTL aims to achieve the fastest possible creation of Docker images for a subset of images. It can be thought of as a special-case "fast path" that can be used in conjunction with the support for general Dockerfiles kaniko provides. + +## Community + +[kaniko-users](https://groups.google.com/forum/#!forum/kaniko-users) Google group