A container per job, without a daemon
Some workloads want an image each. A build that needs a specific toolchain, a test that needs a specific database client, a task whose dependencies are described by something other than a human. The instinct is a Dockerfile and a builder. That means a daemon or a rootless equivalent, a build job in the path of every request, a registry filling with near-identical layers, and, the part that turned…
Some workloads require an individual image for each task. Building an image with a specific toolchain, test database client, or task with dependencies other than human-defined can be achieved without using Docker or a build daemon. This approach involves providing a package list to tools like apko, which resolves the packages, lays them out, and writes the manifest.
This eliminates the need for a build step, intermediate containers, and execution at build time on input created by someone else. The result is a reproducible image digest, with no build-time entropy.
The key benefit of this method is that it removes the need for a build step and eliminates the potential for malicious input to harm the builder. With a Dockerfile, the input is a program, and the build is an execution of that program on the builder, which can lead to security risks. However, when the environment description comes from your own team or is reviewed, a Dockerfile is acceptable.
The tradeoff is only worthwhile when the input is not created by a person and can be more efficient, as swapping a base image underneath layers becomes a metadata operation rather than a build process.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
