Skip to content

Commit

Permalink
Support reproducible builds (except packages)
Browse files Browse the repository at this point in the history
See docker-library/official-images issue 16044

- `SOURCE_DATE_EPOCH` is added.
  The value is consumed by the build scripts to make the binary reproducible.

- For Debian, `/var/log/*` is removed as they contain timestamps

- For Debian, `/var/cache/ldconfig/aux-cache` is removed as they contain inode numbers, etc.

- For Alpine, virtual package versions are pinned to "0" to eliminate
  the timestamp-based version numbers that appear in `/etc/apk/world` and `/lib/apk/db/installed`

> [!NOTE]
> The following topics are NOT covered by this commit:
>
> - To reproduce file timestamps in layers, BuildKit has to be executed with
>   `--output type=<TYPE>,rewrite-timestamp=true`.
>   Needs BuildKit v0.13 or later.
>
> - To reproduce the base image by the hash, reproducers may:
>   - modify the `FROM` instruction in Dockerfile manually
>   - or, use the `CONVERT` action of source policies to replace the base image.
>     <https://github.com/moby/buildkit/blob/v0.13.2/docs/build-repro.md>
>
> - To reproduce packages, see the `RUN` instruction hook proposed in
>   moby/buildkit issue 4576

Also, Alpine-based images still have the following diff:
```diff
diff -ur /tmp/foo/diff/input-0/layers-3/lib/apk/db/installed /tmp/foo/diff/input-1/layers-3/lib/apk/db/installed
--- /tmp/foo/diff/input-0/layers-3/lib/apk/db/installed 2024-04-26 07:07:33.000000000 +0900
+++ /tmp/foo/diff/input-1/layers-3/lib/apk/db/installed 2024-04-26 07:07:33.000000000 +0900
@@ -1,4 +1,4 @@
-C:Q1z4Lv7mwS00FpNJwDUHdH70eM2ic=
+C:Q1gHSJHNX/rtq0yNsVTKaNb96s8Mk=
 P:.ruby-rundeps
 V:0
 A:noarch
```

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
  • Loading branch information
AkihiroSuda committed Jun 11, 2024
1 parent c5a2801 commit 9656701
Show file tree
Hide file tree
Showing 25 changed files with 331 additions and 36 deletions.
15 changes: 12 additions & 3 deletions 3.1/alpine3.19/Dockerfile

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

15 changes: 12 additions & 3 deletions 3.1/alpine3.20/Dockerfile

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 12 additions & 0 deletions 3.1/bookworm/Dockerfile

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 12 additions & 0 deletions 3.1/bullseye/Dockerfile

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

16 changes: 15 additions & 1 deletion 3.1/slim-bookworm/Dockerfile

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

16 changes: 15 additions & 1 deletion 3.1/slim-bullseye/Dockerfile

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

15 changes: 12 additions & 3 deletions 3.2/alpine3.19/Dockerfile

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

15 changes: 12 additions & 3 deletions 3.2/alpine3.20/Dockerfile

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading

0 comments on commit 9656701

Please sign in to comment.