Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Build a Container Image from Scratch

danishpraka.sh

Post reply on HN
Print view View original

1–10 of 60 posts

Re: Build a Container Image from Scratch

#3

Post by mortar »

Just learnt about whiteout files from this, thanks! Trying to understand if you purposely included a filename into a layer with the same whiteout prefix “.wh.”, if it would mess with the process that is meant to obfuscate that prefix from subsequent layers.

Re: Build a Container Image from Scratch

#4

Post by m463 »

mortar wrote: post #3

Just learnt about whiteout files from this, thanks! Trying to understand if you purposely included a filename into a layer with the same whiteout prefix “.wh.”, if it would mess with the process that is meant to obfuscate that prefix from subsequent layers.

I learned about $_

  echo abc && echo $_
  abc
  abc
except it's used with wget...

  wget URL && tar -xvf $_
does this work? Shouldn't tar take a filename?

hmm... also, it says there is an alpine layer with "FROM scratch"??

Re: Build a Container Image from Scratch

#5

Post by donno »

tmaly wrote: post #2

Is there a windows version ?

Windows is is very similar, the differences are two the layer tarballs.

The file system appears in a Files sub-directory as there is a Hives sub-directory for containing the Windows Registry.

The other difference is there are two extra PAX headers within the tarball, MSWINDOWS.fileattr which is "32" for a regular file, and "16" for a directory and MSWINDOWS.rawsd which is a special encoding of the security descriptor, which you can think of it as the owner, group and permissions associated with the file (which their standard values can be seen from buildkit here: https://github.com/moby/buildkit/blob/22156ab20bcaea1a1466d2...)

I haven't looked into how to handle the Windows Registry aspect as in my exploration I was focused on simply adding a pre-built executable so I didn't need any registry entries created.

The other fun gotcha is to ensure the ENV section contain PATH set to c:\\Windows\\System32;c:\\Windows otherwise you would be unlikely to be able to run any Windows executable.

Re: Build a Container Image from Scratch

#6

Post by godelski »

m463 wrote: post #4
mortar wrote: post #3

Just learnt about whiteout files from this, thanks! Trying to understand if you purposely included a filename into a layer with the same whiteout prefix “.wh.”, if it would mess with the process that is meant to obfuscate that prefix from subsequent layers.

I learned about $_ echo abc && echo $_ abc abc except it's used with wget... wget URL && tar -xvf $_ does this work? Shouldn't tar take a filename? hmm... also, it says there is an alpine layer with "FROM scratch"??

$_ is the last argument. Here's a better example to illustrate

  > echo 'Hello' 'world' 'my' 'name' 'is' 'godelski'
  Hello world my name is godelski
  > echo $_
  godelski
  > !:0 !:1 !:2 "I'm" "$_"
  Hello world I'm godelski
The reference manual is here[0] and here's a more helpful list[1]

One of my favorites is

  > git diff some/file/ugh/hierarchy.cpp
  > git add $_
  ## Alternatively, but this is more cumbersome (but more flexible)
  !!:s^diff^add
So what is happening with wget is

  > wget https://dl-cdn.alpinelinux.org/alpine/v3.18/releases/x86_64/alpine-minirootfs-3.18.4-x86_64.tar.gz && tar -xvf $_
  ## Becomes
  > wget https://dl-cdn.alpinelinux.org/alpine/v3.18/releases/x86_64/alpine-minirootfs-3.18.4-x86_64.tar.gz
  > tar -xvf https://dl-cdn.alpinelinux.org/alpine/v3.18/releases/x86_64/alpine-minirootfs-3.18.4-x86_64.tar.gz
Which you are correct, doesn't work.

It should actually be something like this

  > wget https://dl-cdn.alpinelinux.org/alpine/v3.18/releases/x86_64/alpine-minirootfs-3.18.4-x86_64.tar.gz -O alpine.tar.gz && tar xzf $_
This would work as the last parameter is correct. I also added `z` to the tar and removed `-` because it isn't needed. Note that `v` often makes untaring files MUCH slower

[0] https://www.gnu.org/software/bash/manual/html_node/Bash-Vari...

[1] https://www.gnu.org/software/bash/manual/html_node/Variable-...

Re: Build a Container Image from Scratch

#7

Post by godelski »

I often wonder, why isn't systemd-nspawn[0] used more often? It's self-described as "chroot on steroids". IME it pretty much lives up to that name. Makes it really easy to containerize things and since it integrates well with systemd you basically don't have to learn new things.

I totally get these are different tools and I don't think nspawn makes docker or podman useless, but I do find it interesting that it isn't more used, especially in things you're using completely locally. Say, your random self-hosted server thing that isn't escaping your LAN (e.g. Jellyfin or anything like this)

[0] https://wiki.archlinux.org/title/Systemd-nspawn

Re: Build a Container Image from Scratch

#8

Post by mdaniel »

m463 wrote: post #4
mortar wrote: post #3

Just learnt about whiteout files from this, thanks! Trying to understand if you purposely included a filename into a layer with the same whiteout prefix “.wh.”, if it would mess with the process that is meant to obfuscate that prefix from subsequent layers.

I learned about $_ echo abc && echo $_ abc abc except it's used with wget... wget URL && tar -xvf $_ does this work? Shouldn't tar take a filename? hmm... also, it says there is an alpine layer with "FROM scratch"??

It's not an alpine layer, it's a Dockerfile construct representing basically an empty tar file layer: https://docs.docker.com/build/building/base-images/#create-a...> and https://github.com/moby/moby/pull/8827>

Re: Build a Container Image from Scratch

#10

Post by [deleted] »

godelski wrote: post #7

I often wonder, why isn't systemd-nspawn[0] used more often? It's self-described as "chroot on steroids". IME it pretty much lives up to that name. Makes it really easy to containerize things and since it integrates well with systemd you basically don't have to learn new things. I totally get these are different tools and I don't think nspawn makes docker or podman useless, but I do find it interesting that it isn't…

[deleted]
Post reply on HN