{
  "id": 2124797,
  "title": "A container per job, without a daemon",
  "url": "https://urgent.news/2026/08/20/a-container-per-job-without-a-daemon",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-20T11:46:36.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/amartyadev/a-container-per-job-without-a-daemon-1l7c"
  },
  "original_language": "en",
  "account": "Some workloads require an individual image for each task. Building an image with a specific toolchain, test database client, or task with dependencies other than human-defined can be achieved without using Docker or a build daemon. This approach involves providing a package list to tools like apko, which resolves the packages, lays them out, and writes the manifest. This eliminates the need for a build step, intermediate containers, and execution at build time on input created by someone else. The result is a reproducible image digest, with no build-time entropy.\n\nThe key benefit of this method is that it removes the need for a build step and eliminates the potential for malicious input to harm the builder. With a Dockerfile, the input is a program, and the build is an execution of that program on the builder, which can lead to security risks. However, when the environment description comes from your own team or is reviewed, a Dockerfile is acceptable. The tradeoff is only worthwhile when the input is not created by a person and can be more efficient, as swapping a base image underneath layers becomes a metadata operation rather than a build process.",
  "summary": "Some workloads want an image each. A build that needs a specific toolchain, a test that needs a specific database client, a task whose dependencies are described by something other than a human. The instinct is a Dockerfile and a builder. That means a daemon or a rootless equivalent, a build job in the path of every request, a registry filling with near-identical layers, and, the part that turned…",
  "key_points": [
    "Individual images for each task without Docker or build daemon",
    "Package list provided to tools like apko for reproducible image",
    "Eliminates build step, malicious input risk, and build-time entropy"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}