[Buildroot] [All Systems Go!] Buildroot : Using embedded tools to build container images

[Esben Haabendal <esben@geanix.com>]

Arnout Vandecappelle <arnout@mind.be> writes:

> On 22/09/2019 15:13, Fran?ois Perrad wrote:
>> Le sam. 21 sept. 2019 ? 21:53, Romain Naour <romain.naour@smile.fr> a
>> ?crit :
>> 
>>> Hello,
>>>
>>> My colleague Jeremy Rosen did a presentation at All Systems Go conferences
>>> about
>>> building container images using Buildroot:
>>>
>>> https://www.youtube.com/watch?v=-CVuBLDpulo
>
>  Really interesting talk, thanks for pointing this out!
>
>
>>> It would be interesting to discuss with the community about building such
>>> container images like light container or systemd's portable services.
>>>
>>> It's probably a topic for the next Buildroot Meeting :)
>>>
>>>
>> It seems easy to create a Docker image artifact from a rootfs created by
>> Buildroot
>> 
>>     $ cat Dockerfile
>>     FROM scratch
>>     ADD rootfs.tar /
>> 
>>     $ docker build --tag br:my_proj .
>>     Sending build context to Docker daemon  4.233MB
>>     Step 1/2 : FROM scratch
>>      --->
>>     Step 2/2 : ADD rootfs.tar /
>>      ---> 60cb2207066c
>>     Successfully built 60cb2207066c
>>     Successfully tagged br:my_proj
>
>  Does this also work if the tarball is cross-compiled for a different
> architecture? Probably it does, and it just SIGILLs when you try to run the
> container...
>
>> 
>>     $ docker images
>>     REPOSITORY          TAG                 IMAGE ID            CREATED
>>         SIZE
>>     br                  my_proj             60cb2207066c         2 minutes
>> ago      1.74MB
>> 
>>     $ docker save -o br_my_proj.tar br:my_proj
>>     $ ls -1
>>     br_my_proj.tar
>>     Dockerfile
>>     rootfs.tar
>> 
>> But, it could be nice to add "Docker image" as an option in "Filesystem
>> images" choice.
>
>  Yeah, except unfortunately docker security sucks, so on most distros you need
> sudo to run any docker command, even 'docker build'.
>
>  So, it would be nice if we could generate the OCI image without docker.

You can do that with buildah:
https://github.com/containers/buildah

It allows building OCI images from scratch without root priveleges.
It supports both building from Dockerfile and using a CLI that is more
convenient for scripting.

/Esben