# Building Container Images Securely on Kubernetes

DevFeed: [Building Container Images Securely on Kubernetes](<https://devfeed.tech/articles/building-container-images-securely-on-kubernetes-35152.md>)

Original publisher: [Read original article](<https://blog.jessfraz.com/post/building-container-images-securely-on-kubernetes/>)

Published: 2018-03-20T15:25:24Z

Content type: tutorial

Language: en

Sources: [Jessie Frazelle](<https://devfeed.tech/sources/jessie-frazelle.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [container images](<https://devfeed.tech/topics/container-images.md>), [Security](<https://devfeed.tech/topics/security.md>), [Docker](<https://devfeed.tech/topics/docker.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [Dockerfile](<https://devfeed.tech/topics/dockerfile.md>)

Tags: [command-line](<https://devfeed.tech/tags/command-line.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [docker](<https://devfeed.tech/tags/docker.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This article describes the motivation and design process for building container images in Kubernetes without mounting the Docker socket or compromising cluster security. It discusses prior standalone image-builder work, an unprivileged design, and the use of Buildkit as a cache-efficient backend capable of running multiple build stages concurrently. The resulting tool is called img.

## Source excerpt

A lot of people seem to want to be able to build container images in Kubernetes without mounting in the docker socket or doing anything to compromise the security of their cluster. This all was brought to my attention when my awesome coworker at Gabe Monroy and I were chatting with Michelle Noorali over pizza at Kubecon in Austin last December. Here is pretty much how it went down: Gabe: I'd would love to switch our clusters to a lightweight runtime like containerd, but we need those docker build apis right now. I wish someone would come up with an unprivileged container image builder.. Me: Oh that's easy Gabe: Bullshit, if it was easy someone would have done it already. I've wanted this for years. Please pass the ranch dressing. Me: I'm telling you you're wrong. I'll prove it to you. It's easy. Judgy Four Seasons Staff: Excuse me, can I help you? Me: Nah we're good. Actually if you could grab me a slice of that Papa John's jalapano & pineapple that would be great. .. next morning .. 100 lines of bash shaming in Gabe's inbox proving it could be done. Prior Art A few years ago when I worked at Docker, Stephen Day and Michael Crosby did a POC demo of a standalone image builder. It still actually exists today in a fork of docker/distribution on Stephen's github. It consisted of a dist command line tool for interacting with the registry and runc. Combined together with the awesome powers of bash like so (nsinit was runc before runc was A Thing): #!/bin/bash function FROM () { mkdir rootfs dist pull "$1" rootfs } function USERNS() { export nsinituserns="$1" } function CWD() { export nsinitcwd="$1" } function MEM() { export nsinitmem="$1" } function EXEC() { nsinit exec \ --tty \ --rootfs "$(pwd)/rootfs" \ --create \ --cwd="$nsinitcwd" \ --memory-limit="$nsinitmem" \ --memory-swap -1 \ --userns-root-uid="$nsinituserns" \ -- $@ } function RUN() { t="\"$@\"" EXEC sh -c "$t" } So in their demo, you would source the above bash script and then execute your Dockerfile like it w