Documentation
¶
Overview ¶
Package buildkit implements the builder adapter: rootless, containerized, no socket.
A builder must never receive or request a container runtime socket (R-112). The type system cannot enforce this; an integration test asserting the build container's mount list does.
Index ¶
- Constants
- func Info() api.KindInfo
- type Adapter
- func (a *Adapter) Bid(_ context.Context, src api.SourceView) (api.Bid, error)
- func (a *Adapter) Build(ctx context.Context, req api.BuildRequest) (api.BuildResult, error)
- func (a *Adapter) Capabilities(context.Context) (api.BuilderCapabilities, error)
- func (a *Adapter) Category() api.Category
- func (a *Adapter) Configure(ctx context.Context, raw json.RawMessage) error
- func (a *Adapter) Forget(_ context.Context, namespace string) error
- func (a *Adapter) HealthCheck(ctx context.Context) error
- func (a *Adapter) Kind() string
- func (a *Adapter) Plan(_ context.Context, src api.SourceView) (api.BuildPlan, error)
- type Config
Constants ¶
const Kind = "buildkit"
Kind is the adapter's kind string.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Adapter ¶
type Adapter struct {
// contains filtered or unexported fields
}
Adapter builds images with rootless BuildKit in its own container (R-111).
The build environment has no container runtime socket, and it cannot get one: BuildKit runs as a separate service that Pando talks to over its address, and nothing in that service's definition mounts a socket. R-112 is satisfied by the topology rather than by this code being careful, which is the only way it stays satisfied.
func (*Adapter) Bid ¶
Bid inspects the source. Detection proper is phase 6; this is the minimum that makes the auction's shape real.
func (*Adapter) Build ¶
func (a *Adapter) Build(ctx context.Context, req api.BuildRequest) (api.BuildResult, error)
Build produces an image and streams it back to the caller, or pushes it to the install's registry when the request says so.
R-111: Pando hands BuildKit source and receives an image. On a single host the image is exported as a tarball rather than pushed to a registry, because a registry would need daemon-level configuration on the host and charge the setup cost R-002 says is paid once (O-34). A runtime that pulls from a registry gets Push instead (issue #72, PR 5).
func (*Adapter) Capabilities ¶
Capabilities reports what this builder can do (R-254).
func (*Adapter) Forget ¶
Forget removes a deleted app's build cache.
Every build exports its cache to a directory on Pando's own disk, one per workload under the app's ID, and nothing removed it: a deleted app's cache stayed forever, hundreds of megabytes for an ordinary Python app. The GC calls this when it tears the app down.
func (*Adapter) Plan ¶
Plan makes a build plan without building anything, for detection.
The same generator the build path uses, so what somebody reviews is what runs (R-102). It writes into a copy of nothing: the source view's directory is the detection checkout, which is discarded when detection finishes.
type Config ¶
type Config struct {
// Address is a BuildKit somebody else runs: Kubernetes' Deployment, a
// multi-host control host's, one with its own registry configuration.
// Unset here and in PANDO_BUILDKIT_ADDRESS, Pando runs its own on the
// Docker daemon it runs apps on (managed.go, issue #130).
Address string `json:"address,omitempty"`
// RegistryHost and RegistryCAFile let the BuildKit Pando runs trust a
// registry signed by the installation's own CA, such as the one
// docker-compose.registry.yml runs: host:port, and a file in Pando's
// container holding the CA. Default PANDO_BUILDKIT_REGISTRY_HOST and
// PANDO_BUILDKIT_REGISTRY_CA. Not used with Address, whose BuildKit is
// configured by whoever runs it.
RegistryHost string `json:"registry_host,omitempty"`
RegistryCAFile string `json:"registry_ca_file,omitempty"`
// Networks are Docker networks Pando's own BuildKit joins besides its
// own, so it reaches a registry on one of them. Default
// PANDO_BUILDKIT_NETWORKS, separated by commas.
Networks []string `json:"networks,omitempty"`
// CacheMaxBytes caps the build service's own cache. Zero uses
// defaultCacheMaxBytes; a negative value leaves it unbounded.
CacheMaxBytes int64 `json:"cache_max_bytes,omitempty"`
// LocalCacheMaxBytes caps every app's build cache under Pando's data
// directory together, evicting whole apps' caches least recently used
// first. Zero uses defaultLocalCacheMaxBytes; a negative value leaves them
// unbounded.
LocalCacheMaxBytes int64 `json:"local_cache_max_bytes,omitempty"`
}
Config is the adapter's configuration.