Oci Build Task Versions Save

What's Changed

• Bump buidkit to 0.11.0 to fix an error when building multi-arch image by @evanchaoli in https://github.com/concourse/oci-build-task/pull/109

New Contributors

• @evanchaoli made their first contribution in https://github.com/concourse/oci-build-task/pull/109

Full Changelog: https://github.com/concourse/oci-build-task/compare/v0.11.0...v0.11.1

What's Changed

• Add support for building OCI multi-arch images by @rdrgmnzs in https://github.com/concourse/oci-build-task/pull/93
• Add support for passing secrets as text by @charles-dyfis-net in https://github.com/concourse/oci-build-task/pull/88
• Bump buildkit to v0.10.4 by @dackroyd in https://github.com/concourse/oci-build-task/pull/91 and @charles-dyfis-net in https://github.com/concourse/oci-build-task/pull/102

Full Changelog: https://github.com/concourse/oci-build-task/compare/v0.10.0...v0.11.0

• Adds support for BUILDKIT_SECRETTEXT_* #88

• Fixes a bug with IMAGE_ARG_* where if the arg was uppercase the build would fail with an error. Image args can now be all or partially uppercase

• Add image_platform which allows users to build images for platforms that don't match the current platform

Bumps buildkit

this release adds support for using pre-fetched images in FROM ...! this pattern allows you to version and fetch your base image with Concourse and pass it along to the oci-build task to use directly rather than querying the registry and fetching it at build time (possibly resolving to a different version than the build triggered with).

in your oci-build task config, configure a IMAGE_ARG_* param and corresponding input:

inputs:
- name: golang

params:
  IMAGE_ARG_base_image: golang/image.tar

in your Dockerfile, change the FROM so that it can be passed as a build arg:

ARG base_image=golang
FROM ${base_image}

in your pipeline, add a resource and a get step for fetching the image:

resources:
- name: golang
  type: registry-image
  source: {repository: golang}

jobs:
- name: build
  plan:
  - get: golang
    params: {format: oci}
  - task: build
    # ...

this feature resolves quite a few issues:

• #1 - the primary feature request, calling for something analogous to load_base[s] from the docker-image resource.
• #2 - configurable CA certs for image fetching in FROM
  • please fetch the image using a resource which handles CA certs instead
  • we still need to add CA cert support to the registry-image resource: https://github.com/concourse/registry-image-resource/issues/240
• #3 & #14 - insecure & authenticated registries in FROM
  • you guessed it, just fetch it using a resource instead

how does this work?

it's kinda neat! the oci-build-task just runs a teeny tiny Docker registry on localhost that serves the OCI/docker image tarballs configured as image args, and then it passes addresses like localhost:45431/base_image as build args to the Dockerfile.

side note: if we ever do decide to switch to Kaniko (#46), the pattern will be the same; see https://github.com/concourse/docker-image-resource/issues/190#issuecomment-678524466

• @tomjw64 added support for labels (#42) - thanks!
  • configure as LABEL_* and LABELS_FILE, same as build args
• support building additional targets, i.e. to run tests (fixes #52)
  • configure as ADDITIONAL_TARGETS: target1,target2
  • if outputs: are also configured with names matching the targets, the target's image will be saved to the output in same way as the image output

• use /scratch rather than /tmp so buildkitd can use the overlayfs snapshotter
  • significant performance boost; observed one build go from 8 minutes to 4 minutes
  • thanks to @jmccann for noticing this! (#50)
• support for $REGISTRY_MIRRORS (comma-separated list)
• pass --debug to buildkitd if debug is set
• bump buildkit to v0.8.0
• bump rootlesskit to v0.11.1
• bump go-containerregistry to v0.3.0

• bump buildkit to v0.7.0