[HN Gopher] Build a Container Image from Scratch
___________________________________________________________________
Build a Container Image from Scratch
Author : prakashdanish
Score : 36 points
Date : 2025-03-18 05:57 UTC (2 days ago)
(HTM) web link (danishpraka.sh)
(TXT) w3m dump (danishpraka.sh)
| tmaly wrote:
| Is there a windows version ?
| donno wrote:
| Windows is is very similar, the differences are two the layer
| tarballs.
|
| The file system appears in a Files sub-directory as there is a
| Hives sub-directory for containing the Windows Registry.
|
| The other difference is there are two extra PAX headers within
| the tarball, MSWINDOWS.fileattr which is "32" for a regular
| file, and "16" for a directory and MSWINDOWS.rawsd which is a
| special encoding of the security descriptor, which you can
| think of it as the owner, group and permissions associated with
| the file (which their standard values can be seen from buildkit
| here: https://github.com/moby/buildkit/blob/22156ab20bcaea1a146
| 6d2...)
|
| I haven't looked into how to handle the Windows Registry aspect
| as in my exploration I was focused on simply adding a pre-built
| executable so I didn't need any registry entries created.
|
| The other fun gotcha is to ensure the ENV section contain PATH
| set to c:\\\Windows\\\System32;c:\\\Windows otherwise you would
| be unlikely to be able to run any Windows executable.
| mortar wrote:
| Just learnt about whiteout files from this, thanks! Trying to
| understand if you purposely included a filename into a layer with
| the same whiteout prefix ".wh.", if it would mess with the
| process that is meant to obfuscate that prefix from subsequent
| layers.
| m463 wrote:
| I learned about $_ echo abc && echo $_
| abc abc
|
| except it's used with wget... wget URL && tar
| -xvf $_
|
| does this work? Shouldn't tar take a filename?
|
| hmm... also, it says there is an alpine layer with "FROM
| scratch"??
| godelski wrote:
| $_ is the last argument. Here's a better example to
| illustrate > echo 'Hello' 'world' 'my' 'name'
| 'is' 'godelski' Hello world my name is godelski >
| echo $_ godelski
|
| The reference manual is here[0] and here's a more helpful
| list[1]
|
| So what is happening with wget is > wget
| https://dl-
| cdn.alpinelinux.org/alpine/v3.18/releases/x86_64/alpine-
| minirootfs-3.18.4-x86_64.tar.gz && tar -xvf $_ ##
| Becomes > wget https://dl-
| cdn.alpinelinux.org/alpine/v3.18/releases/x86_64/alpine-
| minirootfs-3.18.4-x86_64.tar.gz > tar -xvf https://dl-
| cdn.alpinelinux.org/alpine/v3.18/releases/x86_64/alpine-
| minirootfs-3.18.4-x86_64.tar.gz
|
| Which you are correct, doesn't work.
|
| It should actually be something like this >
| wget https://dl-
| cdn.alpinelinux.org/alpine/v3.18/releases/x86_64/alpine-
| minirootfs-3.18.4-x86_64.tar.gz -O alpine.tar.gz && tar xzf
| $_
|
| This would work as the last parameter is correct. I also
| added `z` to the tar and removed `-` because it isn't needed.
| Note that `v` often makes untaring files _MUCH_ slower
|
| [0] https://www.gnu.org/software/bash/manual/html_node/Bash-
| Vari...
|
| [1] https://www.gnu.org/software/bash/manual/html_node/Variab
| le-...
| godelski wrote:
| I often wonder, why isn't systemd-nspawn[0] used more often? It's
| self-described as "chroot on steroids". IME it pretty much lives
| up to that name. Makes it really easy to containerize things and
| since it integrates well with systemd you basically don't have to
| learn new things.
|
| I totally get these are different tools and I don't think nspawn
| makes docker or podman useless, but I do find it interesting that
| it isn't more used, especially in things you're using completely
| locally. Say, your random self-hosted server thing that isn't
| escaping your LAN (e.g. Jellyfin or anything like this)
|
| [0] https://wiki.archlinux.org/title/Systemd-nspawn
___________________________________________________________________
(page generated 2025-03-20 23:00 UTC)