Live data from Hacker News

Buildpacks vs. Dockerfiles

technology.doximity.com

51–60 of 91 posts

Re: Buildpacks vs. Dockerfiles

#51

During the last 3 years I've had the pleasure of using Bazel's rules_docker to generate all my container images ( https://github.com/bazelbuild/rules_docker ). In a nutshell, rules_docker is a set of build rules for the Bazel build system ( https://bazel.build ). What's pretty nice about these rules is that they don't rely on a Docker daemon. They are rules that directly construct image tarballs that you can either l…

We've used Google Jib for Docker for the same reasons. It also means we don't have to think about the layout of our images. I know that if we went with Dockerfiles each team would put application code in different directories. There would be no consistency. Jib hides that away from us.

Jib is also great because it integrates into your existing build system (Bazel is a big lift for most projects, especially JVM ones) and takes care of the important parts of building a good JVM image like separating the dependencies into a different layer etc.

Also it doesn't require a Docker daemon to build and push the image which is a huge win.

Re: Buildpacks vs. Dockerfiles

#52
post #46

Reading the article I am still struggling to understand why exactly you would transition away from something that has a ton of community support and a lot of people use (you are more likely to find a developer with Docker experience than Buildpack). This just seems like a more opinionated DockerFile that doesn't give you the power to change things that you may need. You will end up being stuck somewhere down the road…

Give this a watch, and I think it may change your mind on some these points: https://www.youtube.com/watch?v=ofH9_sE2qy0

Since this is 30mins, could you please provide at TL;DW ?

Re: Buildpacks vs. Dockerfiles

#53
post #42

One of the purported benefits is security, however from my experience in the financial software industry, I have to say - good luck getting your software validated where a major part of it's build chain is from an external "community". politelemon here is spot-on in this regard: dockerfiles provide a higher level of transparency. Although they do have a higher developer-error surface area compared to more higher-leve…

I see your point but there is nothing to stop organisations maintaining their own set of "trusted builders". `FROM node` etc is still relying on external communities, the buck has to stop somewhere

You can actually do from a private Docker image that YOU have created and going upwards you only hit from "scratch"

so in that case there are no external communities involved. I am not saying that people should do this in practice, but it is certainly possible.

Re: Buildpacks vs. Dockerfiles

#54

During the last 3 years I've had the pleasure of using Bazel's rules_docker to generate all my container images ( https://github.com/bazelbuild/rules_docker ). In a nutshell, rules_docker is a set of build rules for the Bazel build system ( https://bazel.build ). What's pretty nice about these rules is that they don't rely on a Docker daemon. They are rules that directly construct image tarballs that you can either l…

> What's pretty nice about these rules is that they don't rely on a Docker daemon

You can also use podman, img, kaniko, jib and several other tools that don't need a docker daemon

No need to adopt a whole build system (Bazel) just to simplify the way you create artifacts.

Re: Buildpacks vs. Dockerfiles

#55
post #46

Reading the article I am still struggling to understand why exactly you would transition away from something that has a ton of community support and a lot of people use (you are more likely to find a developer with Docker experience than Buildpack). This just seems like a more opinionated DockerFile that doesn't give you the power to change things that you may need. You will end up being stuck somewhere down the road…

Give this a watch, and I think it may change your mind on some these points: https://www.youtube.com/watch?v=ofH9_sE2qy0

Watching this now. Some comments while watching.

I disagree with using the Python Image as an example of an issue with DockerFiles. Since that is something that as me pulling the Python image I don't need to take care of and that would be the same as any "gynastics" that Buildpack may be taking care of behind the scenes (If I understand what you were showing correctly).

You mention issues with images and vulnerabilities, but I fail to see how exactly BuildPack magically addresses this issue other than claiming that it just isn't an issue because it is "better".

IMO in the beginning it sounds like you are determined to make managing a Dockerfile as hard as possible when it really is not.

If one of your arguments is that having the choice of images (different applications have different needs even if they are the same language) is an issue your argument is fundamentally flawed. Yes there are a lot of tags for images, but they are fairly well organized for most of them and should not take long to find what you want to use.

It is great that BuildPack produces a standard Docker Image. But nothing about this changes my opinion that this is an opinionated builder that when you get to the point that you need to do something a bit funky or weird in your application or build process you will end up needing to ditch it and build a Dockerfile anyways. I don't see what benefit this has to an internally built docker image that we use in our applications so the Dockerfiles in the dev's repos are 10 lines max.

Using a "From" image for DockerFile is just as reusable as Buildpack, so that is not an advantage. Again near the end you claim BuildPack is "safe" but why and how?

If you are using Docker and your mitigation of something like heart bleed is "years" (for your images at least) your not using Docker properly and is likely a flaw in your CI pipeline and not something that this tool will magically fix since the issue is somewhere else in your pipeline (including people in that pipeline).

Re: Buildpacks vs. Dockerfiles

#56
post #20

I’m sure it’s usually just a case of “thinking while typing”, but I find it surprising how often articles about Docker stuff get some basic details a bit wrong. In the very first code example there is a RUN instruction where the author probably meant to have a CMD instruction, and they talk about BuildKit and build cache optimisation even though that was always something to think about, way before BuildKit was a thin…

Hi @ilkkal. Thank you for the note - I've corrected the directive!

Re: Buildpacks vs. Dockerfiles

#57
post #25

I like the other alternative Packer + ansible instead of Dockerfiles as explained here https://alex.dzyoba.com/blog/packer-for-docker/

This post had me at "solves the problem of massive disk space usage with Docker."

Re: Buildpacks vs. Dockerfiles

#58
post #8

What are some hosting providers providing build packages support? Google and Heroku were mentioned in the article. I've also had a good experience with self-managed Dokku deployment. Are there any managed service providers that support buildpack deployment?

Dokku is worthy of a look. Great support for buildpacks.

Re: Buildpacks vs. Dockerfiles

#59

During the last 3 years I've had the pleasure of using Bazel's rules_docker to generate all my container images ( https://github.com/bazelbuild/rules_docker ). In a nutshell, rules_docker is a set of build rules for the Bazel build system ( https://bazel.build ). What's pretty nice about these rules is that they don't rely on a Docker daemon. They are rules that directly construct image tarballs that you can either l…

I'm a huge fan of offline generation of these kinds of things across the board— one that I'm found surprisingly tricky is OVAs. You can create your rootfs in a loopback, and use qemu-img to turn that into a vmdk, but there's not a lot of documentation or helpers/validators out there to assist with producing the XML ovf metadata, and if you get it wrong in any way, vmware just coughs up a generic error message.

One thing that is quite helpful as an example to pick through is the 40MB yVM from here: https://cloudarchitectblog.wordpress.com/2015/11/11/yvm-down...

Anyone else got tips or resources for this?

Post reply on HN