https://pantsbuild.org/ logo
Join Slack
Powered by
Has anyone successfully build reproducible Docker ...
# general
f
Has anyone successfully build reproducible Docker images with Pants? šŸ§µ
Some things I've tried: ā€¢ In 
pants.toml
, set:
Copy code
[docker]
use_buildx = true
build_args = ["SOURCE_DATE_EPOCH"]
env_vars = [
    "SOURCE_DATE_EPOCH",
]
ā€¢ Create 
.pants.bootstrap
with:
Copy code
export SOURCE_DATE_EPOCH=$(git log -1 --format='%at')
ā€¢ Added the following to 
docker_image()
target:
Copy code
output={
        "type": "docker", # Default output type.
        "rewrite-timestamp": "true"
    },
ā€¢ Added the 
SOURCE_DATE_EPOCH
to my Dockerfile.
But for some reason, image IDs keep changing even though the layers are exactly the same in all images I make...
I've also ran pants with 
--docker-build-verbose
and I can see that it sets 
SOURCE_DATE_EPOCH
correctly and it rewrites the timestamps as well.
Would it make sense to create an issue for this?
f
Does your build output produce consistent hashes pre-docker?
If so, I would 
docker inspect
the image across two runs to see what differs, probably metadata, if layer contents are the same
f
"Does your build output produce consistent hashes pre-docker?" -> I don't know what this means?
I'll double check the created images with 
docker inspect
.
c
There also may be some breadcrumbs at https://github.com/pantsbuild/pants/issues/20699
f
Running the same test as https://github.com/pantsbuild/pants/issues/20699, I get indeed identical images... However, running this test with pants (with a 
docker_image
target), results in an image with different IDs.
Additionally, doing 
docker inspect
on the images generated from https://github.com/pantsbuild/pants/issues/20699 shows that everything matches (except 
Metadata.LastTagTime
but I guess this isn't used in the sha calculation). The images generated with pants only differ in 
Id
, 
RepoDigests1
& 
LastTagTime
, nothing else...
Found all the missing levers šŸ™‚ I can produce reproducible Docker images with pants.
f
Glad you solved it! For reference by > "Does your build output produce consistent hashes pre-docker?" I meant does the output of what you're building produce consistent output. So for example you may build pex-files, you could compare the output of 
sha1sum your-pex-file.pex
across runs of 
pants build
of those to make sure the input to the dockerfiles are not unstable in themselves
Timestamps tend to be the reason why things become non-reproducible, because they tend to have to be "wiped out" for that in many cases. not only for docker, but many other build tools as well
but I guess this isn't used in the sha calculation).
no but something else probably changed to affect the digest of the image
Feel free to share your findings so that it is shared with others in the same spot šŸ™‚
f
Does it make my sense to add my findings to https://github.com/pantsbuild/pants/issues/20699?
f
That seems reasonable to me šŸ™‚
šŸ‘ 1
3 Views
Open in Slack
PreviousNext
Powered by