realharshthakur / dagger-builpack Goto Github PK

Dagger-buildpack utilises couple open-source projects to build image from source code, generate SBOM(Software Bill of Materials) and scan the image for vulnerabilities.

You may find this useful if:

• You want to build container images from source code
• You don't want to rely on Docker
• You don't want to create a Buildkit frontend
• You want to provide a remote container build service

• Dagger
• Buildpacks
• Buildkit
• Syft
• Grype

• Why Buildkit? Buildkit has been battle-tested by Netflix and dominates container build eco-system(directly/indirectly). It is possible to horizontally scale it as required while sharing cache.

• Why Buildpacks? Buildpack is de-facto standard to go from code to image. It makes it easy to manage a fleet of application images. This project relies on buildpack spec alone and doesn't use Pack library/clients for builds as they're tied to Docker client as of today.

• Why Dagger? Before Dagger, way to interact with Buildkit was via buildkit frontend or by making API calls. Both of which require understanding of how Buildkit works. I looked at Dagger as a user-friendly wrapper over Buildkit API.

• Syft/Grype: They're just amazing tools at what they do. I didn't consider other ones but let me know if you would like to use other tools to generate SBOM/Vulnerabiltiy reports.

Run the following command:

dagger-buildpack -g https://github.com/RealHarshThakur/sample-golang 

It will push the image to ttl.sh, produce sbom.json and vuln.json in artifacts directory

If you have a remote buildkit hosted, you can export BUILDKIT_HOST"="tcp://<ip address> for image builds to be done remotely.

• Buildpack spec: https://github.com/buildpacks/spec/blob/main/platform.md
• Can we use distroless builders? buildpacks/pack#42