Documentation
¶
Overview ¶
Package buildkit implements the builder adapter: rootless, containerized, no socket.
A builder must never receive or request a container runtime socket (R-112). The type system cannot enforce this; an integration test asserting the build container's mount list does.
Index ¶
- Constants
- func Info() api.KindInfo
- type Adapter
- func (a *Adapter) Bid(_ context.Context, src api.SourceView) (api.Bid, error)
- func (a *Adapter) Build(ctx context.Context, req api.BuildRequest) (api.BuildResult, error)
- func (a *Adapter) Capabilities(context.Context) (api.BuilderCapabilities, error)
- func (a *Adapter) Category() api.Category
- func (a *Adapter) Configure(ctx context.Context, raw json.RawMessage) error
- func (a *Adapter) Forget(ctx context.Context, namespace string) error
- func (a *Adapter) HealthCheck(ctx context.Context) error
- func (a *Adapter) Kind() string
- func (a *Adapter) LimitDaemons(limit func(context.Context) int)
- func (a *Adapter) Plan(_ context.Context, src api.SourceView) (api.BuildPlan, error)
- func (a *Adapter) PlanPrebuild(_ context.Context, src api.SourceView, dockerfile string) (api.BuildPlan, error)
- type Config
Constants ¶
const Kind = "buildkit"
Kind is the adapter's kind string.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Adapter ¶
type Adapter struct {
// contains filtered or unexported fields
}
Adapter builds images with rootless BuildKit in its own container (R-111).
The build environment has no container runtime socket, and it cannot get one: BuildKit runs as a separate service that Pando talks to over its address, and nothing in that service's definition mounts a socket. R-112 is satisfied by the topology rather than by this code being careful, which is the only way it stays satisfied.
func (*Adapter) Bid ¶
Bid inspects the source. Detection proper is phase 6; this is the minimum that makes the auction's shape real.
func (*Adapter) Build ¶
func (a *Adapter) Build(ctx context.Context, req api.BuildRequest) (api.BuildResult, error)
Build produces an image and streams it back to the caller, or pushes it to the install's registry when the request says so.
R-111: Pando hands BuildKit source and receives an image. On a single host the image is exported as a tarball rather than pushed to a registry, because a registry would need daemon-level configuration on the host and charge the setup cost R-002 says is paid once (O-34). A runtime that pulls from a registry gets Push instead (issue #72, PR 5).
func (*Adapter) Capabilities ¶
Capabilities reports what this builder can do (R-254).
func (*Adapter) Forget ¶
Forget removes a deleted app's build cache, and its BuildKits (R-117).
Every build exports its cache to a directory on Pando's own disk, one per workload under the app's ID, and nothing removed it: a deleted app's cache stayed forever, hundreds of megabytes for an ordinary Python app. The GC calls this when it tears the app down.
func (*Adapter) LimitDaemons ¶ added in v0.14.0
LimitDaemons bounds how many of Pando's own BuildKits run and wait warm together: limit is host policy's max_concurrent_deploys, read as the deploy queue reads it, zero or less for its default. Without it, the bound is that default.
func (*Adapter) Plan ¶
Plan makes a build plan without building anything, for detection.
The same generator the build path uses, so what somebody reviews is what runs (R-102). It writes into a copy of nothing: the source view's directory is the detection checkout, which is discarded when detection finishes.
func (*Adapter) PlanPrebuild ¶ added in v0.5.0
func (a *Adapter) PlanPrebuild(_ context.Context, src api.SourceView, dockerfile string) (api.BuildPlan, error)
PlanPrebuild is the Dockerfile at dockerfile with the repository's own build run before it, when the Dockerfile copies that build's output and the repository does not have it. An empty plan when it does not.
type Config ¶
type Config struct {
// Address is the BuildKit an install topology runs beside Pando, set by
// it through PANDO_BUILDKIT_ADDRESS: deploy/kubernetes runs one as its
// own Deployment. Internal, and not among Info's settings: Pando does not
// support a BuildKit on another server, so nobody sets this by hand.
// Unset, Pando runs its own on the Docker daemon it runs apps on, one per
// app (managed.go, daemons.go). One named here is shared by every app.
Address string `json:"address,omitempty"`
// TLS for the BuildKit at Address: files in Pando's container holding
// the CA its certificate is checked against, and the client certificate
// and key Pando presents. Default PANDO_BUILDKIT_TLS_CA,
// PANDO_BUILDKIT_TLS_CERT and PANDO_BUILDKIT_TLS_KEY. TLSServerName,
// PANDO_BUILDKIT_TLS_SERVER_NAME, is the name its certificate is checked
// for when it is not the address's host. Unset, the connection is plain.
TLSCAFile string `json:"tls_ca_file,omitempty"`
TLSCertFile string `json:"tls_cert_file,omitempty"`
TLSKeyFile string `json:"tls_key_file,omitempty"`
TLSServerName string `json:"tls_server_name,omitempty"`
// RegistryHost and RegistryCAFile let the BuildKit Pando runs trust a
// registry signed by the installation's own CA, such as the one
// docker-compose.registry.yml runs: host:port, and a file in Pando's
// container holding the CA. Default PANDO_BUILDKIT_REGISTRY_HOST and
// PANDO_BUILDKIT_REGISTRY_CA. Internal, like Networks: the install
// topology sets them. Not used with Address, whose BuildKit the topology
// configures itself.
RegistryHost string `json:"registry_host,omitempty"`
RegistryCAFile string `json:"registry_ca_file,omitempty"`
// Networks are Docker networks Pando's own BuildKit joins besides its
// own, so it reaches a registry on one of them. Default
// PANDO_BUILDKIT_NETWORKS, separated by commas.
Networks []string `json:"networks,omitempty"`
// CacheMaxBytes caps the build service's own cache. Zero uses
// defaultCacheMaxBytes; a negative value leaves it unbounded.
CacheMaxBytes int64 `json:"cache_max_bytes,omitempty"`
// LocalCacheMaxBytes caps every app's build cache under Pando's data
// directory together, evicting whole apps' caches least recently used
// first. Zero uses defaultLocalCacheMaxBytes; a negative value leaves them
// unbounded.
LocalCacheMaxBytes int64 `json:"local_cache_max_bytes,omitempty"`
}
Config is the adapter's configuration.
Source Files
¶
- bases.go
- buildkit.go
- cachedir.go
- confine.go
- daemons.go
- declared.go
- doc.go
- dockerignore.go
- dotnet.go
- embedded.go
- golang.go
- jekyll.go
- jvm.go
- languages.go
- laravel.go
- makefile.go
- managed.go
- meteor.go
- node.go
- outdir.go
- php.go
- prebuild.go
- procfile.go
- push.go
- python.go
- railpack.go
- runners.go
- rust.go
- ssg.go
- starts.go
- staticsite.go
- steer.go
- sweep.go
- synthesize.go
- tls.go
- workflow.go