Commit 7684a6b
committed
Support reproducible builds (except packages)
See docker-library/official-images issue 16044
- `ARG SOURCE_DATE_EPOCH` is added.
The argument value is consumed by the build scripts to make the binary reproducible.
- For Debian, `/var/log/*` is removed as they contain timestamps
- For Debian, `/var/cache/ldconfig/aux-cache` is removed as they contain inode numbers, etc.
- For Alpine, virtual package versions are pinned to "0" to eliminate
the timestamp-based version numbers that appear in `/etc/apk/world` and `/lib/apk/db/installed`
> [!NOTE]
> The following topics are NOT covered by this commit:
>
> - To reproduce file timestamps in layers, BuildKit has to be executed with
> `--output type=<TYPE>,rewrite-timestamp=true`.
> Needs BuildKit v0.13 or later.
>
> - To reproduce the base image by the hash, reproducers may:
> - modify the `FROM` instruction in Dockerfile manually
> - or, use the `CONVERT` action of source policies to replace the base image.
> <https://github.com/moby/buildkit/blob/v0.13.2/docs/build-repro.md>
>
> - To reproduce packages, see the `RUN` instruction hook proposed in
> moby/buildkit issue 4576
Also, Alpine-based images still have the following diff:
```diff
diff -ur /tmp/foo/diff/input-0/layers-3/lib/apk/db/installed /tmp/foo/diff/input-1/layers-3/lib/apk/db/installed
--- /tmp/foo/diff/input-0/layers-3/lib/apk/db/installed 2024-04-26 07:07:33.000000000 +0900
+++ /tmp/foo/diff/input-1/layers-3/lib/apk/db/installed 2024-04-26 07:07:33.000000000 +0900
@@ -1,4 +1,4 @@
-C:Q1z4Lv7mwS00FpNJwDUHdH70eM2ic=
+C:Q1gHSJHNX/rtq0yNsVTKaNb96s8Mk=
P:.ruby-rundeps
V:0
A:noarch
```
Signed-off-by: Akihiro Suda <[email protected]>1 parent 0d22570 commit 7684a6b
File tree
24 files changed
+183
-25
lines changed- 3.0
- alpine3.16
- bullseye
- buster
- slim-bullseye
- slim-buster
- 3.1
- alpine3.18
- alpine3.19
- bookworm
- bullseye
- slim-bookworm
- slim-bullseye
- 3.2
- alpine3.18
- alpine3.19
- bookworm
- bullseye
- slim-bookworm
- slim-bullseye
- 3.3
- alpine3.18
- alpine3.19
- bookworm
- bullseye
- slim-bookworm
- slim-bullseye
24 files changed
+183
-25
lines changedSome generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments