Most teams treat container images as something a build tool produces on their behalf. You write a Dockerfile, hand it to BuildKit, and a few hundred megabytes later you have an image. The build process itself is a black box — a daemon, a cache, a base image you didn’t author, and a format you rarely inspect.
This post takes the opposite stance: an image builder is just a program. Given a tarball and a few JSON blobs, any code that can compute a SHA-256 and write files can manufacture a valid OCI image. So instead of reaching for Docker, we’ll build an image factory — a small Go program that ingests layer tarballs, content-addresses them, assembles a manifest, and emits a spec-compliant OCI layout. The same factory can push to a registry and pull images back.
The result is a reusable tool, not a one-off trick. As a bonus, the images it produces are tiny — around 8MB for a Go server — because the factory adds nothing you didn’t ask for. But the real value is ownership: you understand and control every byte of the image format.
Read the rest here: https://cheikhhseck.medium.com/building-a-docker-image-factory-from-scratch-in-go-e3c2e7127106?sk=42cbfc6c5981a5acc6ac1e617bf932be
Top comments (0)