Unprivileged Image Builds: What are the Challenges and Where are we Today?
summary
Claim: unprivileged image builds are practical now by combining user namespaces, overlayfs, and modern build tools, but they require explicit kernel/runtime options and trade isolation for usability. Demonstrations use BuildKit and Builder to produce OCI images without privileged Docker or mounting the Docker socket; Kiko is dismissed for poor isolation and bugs. Remaining obstacles include proc masking, seccomp/MAC tweaks, kernel bugs that have appeared in recent years, and GitLab Runner limitations that prevent a frictionless rollout.
AI-written summary · about
chapters (9)
- 0:00Intro
- 2:20Container Image Builds
- 3:25Why this is bad
- 5:41Username Spaces
- 10:15Procfs
- 17:08Security
- 20:04Build Tools
- 26:10Other Build Tools
- 29:46Conclusion
related talks
31mTowards unprivileged container builds
30mRootless, Reproducible, and Hermetic: Secure Container Build Showdown
14mAre Your Builds Running Separately from Your Production Cluster? (Q1)
35mBuilding Container Images In Kubernetes: It’s Been a Journey!
42mSecuring Filesystem Images for Unprivileged Containers
43mBuilding Docker Images on Kubernetes: A Long Journey!
31mYour Containers Aren’t Alone: Demystifying Container Isolation
49mContainers without Docker