Add some way to get the sha256 digest of the image

[sindreij]

We are looking into using this instead of kaniko for building our images. Kaniko has --digest-file to get the digest of the built image. Is there some way of doing this with buildkit and buildkitctl? It looks like we can try to get the digest from the build-log, but that looks like a hacky solution.

[tonistiigi]

if you use https://github.com/docker/buildx with buildkit you can use --iidfile for this. It is not exposed in buildctl atm. but supported in api.

[sindreij]

How is the support for running buildx in a docker container in kubernetes. Does it work without docker? Would you accept a PR to save the metadata in resp.ExporterResponse (where this is in buildctl) to a file?

[tonistiigi]

buildx currently has docker-container and docker daemon driver. direct k8s driver is not currently implemented but would be accepted docker/buildx#22 .

For buildctl I'm not against it but as buildctl is designed to be more like generic reference cli implementation, maybe the flag should be --metadata-file where it would write all the metadata in resp.ExporterResponse. @AkihiroSuda wdyt?

[sindreij]

I'd like to start the daemon manually, and then have buildx inside a k8s-pod using that, do you know if that is possible with buildx?

The --metadata-file flag sounds like a great solution for our use case.

[tonistiigi]

I'd like to start the daemon manually, and then have buildx inside a k8s-pod using that, do you know if that is possible with buildx?

That's not possible in current buildx. Would need a separate driver. The current driver starts the buildkit container itself as part of the build flow.

[AkihiroSuda]

related: #993

[tonistiigi]

@AkihiroSuda for #993 we probably would need a special option that cli(or exporter) understands. these requirements seem very specific.