It lets you add new layers, or edit any metadata (env vars, labels, entrypoint, etc) in existing images. You can also "flatten" an image with multiple layers into a single layer. Additionally you can "rebase" an image (re-apply your changes onto a new/updated base image). It does all this directly in the registry, so no docker needed (though it's still useful for creating the original image).
https://github.com/google/go-containerregistry/blob/main/cmd...
(updated: better link)
``` COPY ./package.deb /tmp/package.deb
RUN dpkg -i /tmp/*.deb && rm -rf /tmp/*.deb ```
This results in two layers, with one layer containing a huge file, thus being part of the final image if you don't do multi-stage builds.
Examples that come to my mind include Docker, Podman, nerdctl, Terraform and Kubernetes.
Is there any obvious advantage that GoLang offers, making it so popular for building these tools?
source: I was there.
Same. I use docker to escape the versioning hell that is modern python.
When you're trying to build a tool, the more self-contained the better.
Rust is probably the only good modern alternative that is mature.
They have not found this to be true.
It was originally written in Java.
In fact, most Go users are outside Google, internally it is all about Java, Kotlin, Dart, C++ and Python, and now Rust as well.
Kubernetes, gVisor and Android GPU debugger are probably the only major internal projects in Go.
> We've incorporated the best ideas from Borg in Kubernetes, and have tried to address some pain points that users identified with Borg over the years.
Borg was written in C++, but only contained container scheduling, resource allocation and some service discovery. Many other features of what is now Kubernetes were built later and essentially "shimmed" onto Borg.
Kubernetes was a re-write of Borg to rebuild many of its original features from the ground up using the lessons they had learned since originally building Borg. By this time, Go had been developed and was being actively used for many of these shims and supporting services surrounding Borg. Since the same team(s) were rebuilding Borg that had developed and maintained these other services, and because many of these shims and supporting services (which are already in Go) were being incorporated into Kubernetes, they decided to build the new version (which became Kubernetes) in Go.
Sources:
- https://kubernetes.io/blog/2015/04/borg-predecessor-to-kuber...
- https://storage.googleapis.com/gweb-research2023-media/pubto...
plus ecosystem effects of you can just use the packages of a different implementation for part of your code.
Dredge is another tool to look at. I use it for diffing layers.
https://github.com/mthalman/dredge/blob/main/docs/commands/i...
https://blog.haschek.at/2019/the-curious-case-of-the-RasPi-i...
I am curious if anyone knows how to get the contents of the file you have highlighted, a lot of the times I use dive to validate that a file exists in a layer and then I want to peak at it. Currently I normally revert to running the container and using cat or extracting the contents and then wandering into the folders.
And some in the docker category as well:
Edit: just checked and it allows to see the layers, but only shows the commands of each one
I use it to see what random scripts one is encouraged to pipe into bash would do to a system.
These Google open source projects seem to be in need of some TLC as a lot of the original maintainers have moved on, which is a shame. I try to throw a PR their way and close out the odd issue when I can. The testing tool in particular is invaluable to keep my sanity with a large amount of base images I have to maintain internally.
When an image is used (or "run"), it becomes a container, which makes it behave (to the client) like ordinary files & directories.
A+ software.
Dive also inspired us to make it easier to surface what is actually in your build context, on every build. So we shipped that as a feature in Depot a few weeks back.
- unneeded build dependencies. Used a scratch image and/or removed build deps in the same step - node_modules for dev-deps . Used prod - Embeded Chromium builds (with puppetteer). Removed chromium and remoted an external build
Docker desktop now has this feature built in, but I've been using dive for years to find wasted space & potential security issues.
alias dive='docker run -ti --rm -v /var/run/docker.sock:/var/run/docker.sock wagoodman/dive'