rpm-ostree, used together with OStree, is a powerful tool to generate immutable images for .rpm based systems, why not to use it for generating Docker images as well?
rpm-ostree already supports the generation of a Docker container tree, that can be feed to Docker almost as it is; ostree-docker-builder instead is a new tool to make this task simpler.
The following JSON description is enough to create an Emacs container using rpm-ostree based on Fedora-22.
{
"ref": "fedora-atomic/f22/x86_64/emacs",
"repos": ["fedora-22"],
"container": true,
"packages": ["emacs"]
}
It references the fedora-22 repo. Be sure that in the same directory as the .json file there is a .repo file which contains the definition for fedora-22fedora-22.repo that looks like:
[fedora-22]
name=Fedora 22 $basearch
mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=fedora-22&arch=$basearch
enabled=0
gpgcheck=0
metadata_expire=1d
These two files are enough to generate an OStree commit, assuming the first file is called emacs.json, and that repo is a valid OStree repository as:
sudo rpm-ostree --repo=repo compose tree emacs.json
At this point, once we get a commit for the fedora-atomic/f22/x86_64/emacs branch we can use ostree-docker-builder to create the Docker image. The code for the program is on github at: https://github.com/giuseppe/ostree-docker-builder.
sudo ostree-docker-builder --repo=repo -c emacs fedora-atomic/f22/x86_64/emacs --entrypoint=/usr/bin/emacs-24.5
ostree-docker-builder accepts some arguments that change how the Dockerfile, which is provided to build the Docker image, is generated.
In the example above we use –entrypoint to set the ENTRYPOINT in the Dockerfile, more information can be found in the Docker documentation: https://docs.docker.com/reference/builder/
If everything works as expected, the image should be ready after that command and we can run it as:
sudo docker run --rm -ti emacs
Repeating the same command twice won’t have any effect, unless –force is specified, if there is no new OStree commit available, ostree-docker-builder stores this information in the image itself using a Docker LABEL.
Tagging
Another feature is the automatic tagging of images, when –tag is specified, the built image will be tagged as the name provided as argument to –tag and automatically pushed to the configured Docker registry.
Advantages of ostree-docker-builder
There are mainly two advantages in using ostree-docker-builder instead of a Dockerfile:
- The same tool to generate both the OS image and the containers
- Use OStree to track what files were changed, added or removed. If there are no differences then no image is created
Special thanks to Colin Walters for his suggestions while experimenting ostree-docker-builder and how to take advantage of the OStree checksum.