buildkit

package
v0.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 11, 2026 License: AGPL-3.0 Imports: 38 Imported by: 0

Documentation

Overview

Package buildkit implements the builder adapter: rootless, containerized, no socket.

A builder must never receive or request a container runtime socket (R-112). The type system cannot enforce this; an integration test asserting the build container's mount list does.

Index

Constants

View Source
const Kind = "buildkit"

Kind is the adapter's kind string.

Variables

This section is empty.

Functions

func Info

func Info() api.KindInfo

Info describes this kind of adapter for the forms that configure one (api.KindInfo, R-261).

Types

type Adapter

type Adapter struct {
	// contains filtered or unexported fields
}

Adapter builds images with rootless BuildKit in its own container (R-111).

The build environment has no container runtime socket, and it cannot get one: BuildKit runs as a separate service that Pando talks to over its address, and nothing in that service's definition mounts a socket. R-112 is satisfied by the topology rather than by this code being careful, which is the only way it stays satisfied.

func New

func New() *Adapter

func (*Adapter) Bid

func (a *Adapter) Bid(_ context.Context, src api.SourceView) (api.Bid, error)

Bid inspects the source. Detection proper is phase 6; this is the minimum that makes the auction's shape real.

func (*Adapter) Build

func (a *Adapter) Build(ctx context.Context, req api.BuildRequest) (api.BuildResult, error)

Build produces an image and streams it back to the caller, or pushes it to the install's registry when the request says so.

R-111: Pando hands BuildKit source and receives an image. On a single host the image is exported as a tarball rather than pushed to a registry, because a registry would need daemon-level configuration on the host and charge the setup cost R-002 says is paid once (O-34). A runtime that pulls from a registry gets Push instead (issue #72, PR 5).

func (*Adapter) Capabilities

func (a *Adapter) Capabilities(context.Context) (api.BuilderCapabilities, error)

Capabilities reports what this builder can do (R-254).

func (*Adapter) Category

func (a *Adapter) Category() api.Category

func (*Adapter) Configure

func (a *Adapter) Configure(ctx context.Context, raw json.RawMessage) error

func (*Adapter) Forget

func (a *Adapter) Forget(_ context.Context, namespace string) error

Forget removes a deleted app's build cache.

Every build exports its cache to a directory on Pando's own disk, one per workload under the app's ID, and nothing removed it: a deleted app's cache stayed forever, hundreds of megabytes for an ordinary Python app. The GC calls this when it tears the app down.

func (*Adapter) HealthCheck

func (a *Adapter) HealthCheck(ctx context.Context) error

func (*Adapter) Kind

func (a *Adapter) Kind() string

func (*Adapter) Plan

func (a *Adapter) Plan(_ context.Context, src api.SourceView) (api.BuildPlan, error)

Plan makes a build plan without building anything, for detection.

The same generator the build path uses, so what somebody reviews is what runs (R-102). It writes into a copy of nothing: the source view's directory is the detection checkout, which is discarded when detection finishes.

type Config

type Config struct {
	// Address is a BuildKit somebody else runs: Kubernetes' Deployment, a
	// multi-host control host's, one with its own registry configuration.
	// Unset here and in PANDO_BUILDKIT_ADDRESS, Pando runs its own on the
	// Docker daemon it runs apps on (managed.go, issue #130).
	Address string `json:"address,omitempty"`

	// RegistryHost and RegistryCAFile let the BuildKit Pando runs trust a
	// registry signed by the installation's own CA, such as the one
	// docker-compose.registry.yml runs: host:port, and a file in Pando's
	// container holding the CA. Default PANDO_BUILDKIT_REGISTRY_HOST and
	// PANDO_BUILDKIT_REGISTRY_CA. Not used with Address, whose BuildKit is
	// configured by whoever runs it.
	RegistryHost   string `json:"registry_host,omitempty"`
	RegistryCAFile string `json:"registry_ca_file,omitempty"`

	// Networks are Docker networks Pando's own BuildKit joins besides its
	// own, so it reaches a registry on one of them. Default
	// PANDO_BUILDKIT_NETWORKS, separated by commas.
	Networks []string `json:"networks,omitempty"`

	// CacheMaxBytes caps the build service's own cache. Zero uses
	// defaultCacheMaxBytes; a negative value leaves it unbounded.
	CacheMaxBytes int64 `json:"cache_max_bytes,omitempty"`

	// LocalCacheMaxBytes caps every app's build cache under Pando's data
	// directory together, evicting whole apps' caches least recently used
	// first. Zero uses defaultLocalCacheMaxBytes; a negative value leaves them
	// unbounded.
	LocalCacheMaxBytes int64 `json:"local_cache_max_bytes,omitempty"`
}

Config is the adapter's configuration.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL