Build a Container Image from Scratch • Hacker News Board

Re: Build a Container Image from Scratch

#11

Post by cmeacham98 » Fri, Mar 21, 2025, 12:00 AM UTC

godelski wrote: post #7

I often wonder, why isn't systemd-nspawn[0] used more often? It's self-described as "chroot on steroids". IME it pretty much lives up to that name. Makes it really easy to containerize things and since it integrates well with systemd you basically don't have to learn new things. I totally get these are different tools and I don't think nspawn makes docker or podman useless, but I do find it interesting that it isn't…

Because Docker/OCI/etc got the most important part right (or at least much better than the alternatives): distribution.

All you need to start running a Docker container is a location and tag (or hash). To update, all you do is bump the tag (or hash). If a little more complicated setup is necessary (environment variables, volumes, ports, etc) - this can all be easily represented in common formats like Docker compose or Kubernetes manifests.

How do you start running a system-nspawn container? Well first, you bootstrap an entire OS, then deal with that OS's package manager to install the application. You have to manage updates with the package manager yourself (which likely aren't immutable). There's no easy declarative config - you'll probably end up writing a shell script or using a third party tool like Ansible.

There have been many container/chroot concepts in the past. Docker's idea was not novel, but they did building and distribution far better than any alternative when it first released, and it still holds up well today.

Re: Build a Container Image from Scratch

#12

Post by stackskipton » Fri, Mar 21, 2025, 12:53 AM UTC

donno wrote: post #5

tmaly wrote: post #2

Is there a windows version ?

Windows is is very similar, the differences are two the layer tarballs. The file system appears in a Files sub-directory as there is a Hives sub-directory for containing the Windows Registry. The other difference is there are two extra PAX headers within the tarball, MSWINDOWS.fileattr which is "32" for a regular file, and "16" for a directory and MSWINDOWS.rawsd which is a special encoding of the security descriptor…

Registry is best handled with copy .reg file and CMD reg import blah.reg in Dockerfile

Re: Build a Container Image from Scratch

#13

Post by ranger207 » Fri, Mar 21, 2025, 1:19 AM UTC

cmeacham98 wrote: post #11

godelski wrote: post #7

I often wonder, why isn't systemd-nspawn[0] used more often? It's self-described as "chroot on steroids". IME it pretty much lives up to that name. Makes it really easy to containerize things and since it integrates well with systemd you basically don't have to learn new things. I totally get these are different tools and I don't think nspawn makes docker or podman useless, but I do find it interesting that it isn't…

Because Docker/OCI/etc got the most important part right (or at least much better than the alternatives): distribution. All you need to start running a Docker container is a location and tag (or hash). To update, all you do is bump the tag (or hash). If a little more complicated setup is necessary (environment variables, volumes, ports, etc) - this can all be easily represented in common formats like Docker compose o…

Yeah, this. Docker/container's greatest feature is less the sandboxing than the distribution. The sandboxing is essential to making the distribution work well, but it's a side feature most of the time

Re: Build a Container Image from Scratch

#14

Post by ryencoke » Fri, Mar 21, 2025, 1:34 AM UTC

godelski wrote: post #6

m463 wrote: post #4

Earlier quoted context omitted.

I learned about $_ echo abc && echo $_ abc abc except it's used with wget... wget URL && tar -xvf $_ does this work? Shouldn't tar take a filename? hmm... also, it says there is an alpine layer with "FROM scratch"??

$_ is the last argument. Here's a better example to illustrate > echo 'Hello' 'world' 'my' 'name' 'is' 'godelski' Hello world my name is godelski > echo $_ godelski > !:0 !:1 !:2 "I'm" "$_" Hello world I'm godelski The reference manual is here[0] and here's a more helpful list[1] One of my favorites is > git diff some/file/ugh/hierarchy.cpp > git add $_ ## Alternatively, but this is more cumbersome (but more flexible…

If you want to add in another bash trick called Parameter Expansion[0] you can parse out the filename automatically with the special variable $_. Something like:

  > wget https://dl-cdn.alpinelinux.org/alpine/v3.18/releases/x86_64/alpine-minirootfs-3.18.4-x86_64.tar.gz && tar xzf ${_##*/}

[0] https://www.gnu.org/software/bash/manual/html_node/Shell-Par...

Re: Build a Container Image from Scratch

#15

Post by placardloop » Fri, Mar 21, 2025, 2:05 AM UTC

ranger207 wrote: post #13

cmeacham98 wrote: post #11

Earlier quoted context omitted.

Because Docker/OCI/etc got the most important part right (or at least much better than the alternatives): distribution. All you need to start running a Docker container is a location and tag (or hash). To update, all you do is bump the tag (or hash). If a little more complicated setup is necessary (environment variables, volumes, ports, etc) - this can all be easily represented in common formats like Docker compose o…

Yeah, this. Docker/container's greatest feature is less the sandboxing than the distribution. The sandboxing is essential to making the distribution work well, but it's a side feature most of the time

It’s kind of funny that people think of “sandboxing” as the main feature of containers, or even as a feature at all. The distribution benefits have always been the entire point of Docker.

The logo of Docker is a ship with a bunch of shipping containers on it (the original logo was clearer, but the current logo still shows this). “Containers” has never been about “containment”, but about modularity and portability.

Re: Build a Container Image from Scratch

#16

Post by alkh » Fri, Mar 21, 2025, 2:12 AM UTC

godelski wrote: post #6

m463 wrote: post #4

Earlier quoted context omitted.

I learned about $_ echo abc && echo $_ abc abc except it's used with wget... wget URL && tar -xvf $_ does this work? Shouldn't tar take a filename? hmm... also, it says there is an alpine layer with "FROM scratch"??

$_ is the last argument. Here's a better example to illustrate > echo 'Hello' 'world' 'my' 'name' 'is' 'godelski' Hello world my name is godelski > echo $_ godelski > !:0 !:1 !:2 "I'm" "$_" Hello world I'm godelski The reference manual is here[0] and here's a more helpful list[1] One of my favorites is > git diff some/file/ugh/hierarchy.cpp > git add $_ ## Alternatively, but this is more cumbersome (but more flexible…

I am surprised that this is working, as I always thought that variables get initialized after the full command is parsed. So, I would assume that $_ would be related to the previous command (defined by a new line) and not this one, because there's no newline character here, but only an ampersand.

Re: Build a Container Image from Scratch

#17

Post by MyOutfitIsVague » Fri, Mar 21, 2025, 2:17 AM UTC

ryencoke wrote: post #14

godelski wrote: post #6

Earlier quoted context omitted.

$_ is the last argument. Here's a better example to illustrate > echo 'Hello' 'world' 'my' 'name' 'is' 'godelski' Hello world my name is godelski > echo $_ godelski > !:0 !:1 !:2 "I'm" "$_" Hello world I'm godelski The reference manual is here[0] and here's a more helpful list[1] One of my favorites is > git diff some/file/ugh/hierarchy.cpp > git add $_ ## Alternatively, but this is more cumbersome (but more flexible…

If you want to add in another bash trick called Parameter Expansion[0] you can parse out the filename automatically with the special variable $_. Something like: > wget https://dl-cdn.alpinelinux.org/alpine/v3.18/releases/x86_64/alpine-minirootfs-3.18.4-x86_64.tar.gz && tar xzf ${_##*/} [0] https://www.gnu.org/software/bash/manual/html_node/Shell-Par...

I want to make a small note, in that `$_` is a special Bashism (though it is supported widely), but Parameter Expansion is POSIX-standard and will work on all POSIX-compliant shells, not just Bash.

https://pubs.opengroup.org/onlinepubs/009604499/utilities/xc...

Re: Build a Container Image from Scratch

#18

Post by jmholla » Fri, Mar 21, 2025, 2:32 AM UTC

If the author is here, I think there's a typo in this. In section 1.4, you start working from the scratch layer, but the content continues to refer to alpine as the base layer.

    FROM scratch
    
    COPY ./hello /root/
    
    ENTRYPOINT ["./hello"]

> Here, our image contains 2 layers. The first layer comes from the base image, the alpine official docker image i.e. the root filesystem with all the standard shell tools that come along with an alpine distribution. Almost every instruction inside a Containerfile generates another layer. So in the Containerfile above, the COPY instruction creates the second layer which includes filesystem changes to the layer before it. The change here is “adding” a new file—the hello binary—to the existing filesystem i.e. the alpine root filesystem.

Re: Build a Container Image from Scratch

#19

Post by godelski » Fri, Mar 21, 2025, 2:57 AM UTC

cmeacham98 wrote: post #11

godelski wrote: post #7

I often wonder, why isn't systemd-nspawn[0] used more often? It's self-described as "chroot on steroids". IME it pretty much lives up to that name. Makes it really easy to containerize things and since it integrates well with systemd you basically don't have to learn new things. I totally get these are different tools and I don't think nspawn makes docker or podman useless, but I do find it interesting that it isn't…

Because Docker/OCI/etc got the most important part right (or at least much better than the alternatives): distribution. All you need to start running a Docker container is a location and tag (or hash). To update, all you do is bump the tag (or hash). If a little more complicated setup is necessary (environment variables, volumes, ports, etc) - this can all be easily represented in common formats like Docker compose o…

Sorry. I agree, but that's a different question. I'll circle back to that then. Why don't technical people make these interfaces, giving the same love to user experience that something like Docker gets. As you said, it is scriptable, and I think -- us all being programmers here -- we all know that means you can just make the interface easier.

Re: Build a Container Image from Scratch

#20

Post by godelski » Fri, Mar 21, 2025, 3:02 AM UTC

alkh wrote: post #16

godelski wrote: post #6

Earlier quoted context omitted.

$_ is the last argument. Here's a better example to illustrate > echo 'Hello' 'world' 'my' 'name' 'is' 'godelski' Hello world my name is godelski > echo $_ godelski > !:0 !:1 !:2 "I'm" "$_" Hello world I'm godelski The reference manual is here[0] and here's a more helpful list[1] One of my favorites is > git diff some/file/ugh/hierarchy.cpp > git add $_ ## Alternatively, but this is more cumbersome (but more flexible…

I am surprised that this is working, as I always thought that variables get initialized after the full command is parsed. So, I would assume that $_ would be related to the previous command (defined by a new line) and not this one, because there's no newline character here, but only an ampersand.

&& means there's a sequence. So the second statement will only execute conditioned on the first sequence. So...

  > thisFunctionFails && echo "Hello world" && echo "I SAID $_"
  
  > thisFunctionSucceeds && echo "Hello world" && echo "I SAID $_"
  Hello World
  I SAID Hello World

The left function has to get evaluated before the next function. So it is still related to the previous command.