rules_oci

There have got to be a million ways to do this by now. Some of the more principled approaches are tools like Nix (https://xeiaso.net/talks/2024/nix-docker-build/) and Bazel (https://github.com/bazel-contrib/rules_oci). But if you want to use an existing package manager like apt, you can pick it apart. Apt calls dpkg, and dpkg extracts files and runs post-install scripts. Only the post-install script needs to run inside the container. I may be a little out of touch here, because the last time I did this, we used a wholly custom package manager.

A Bazel option is https://github.com/bazel-contrib/rules_oci Doesn’t even need Docker, just writes the image files with a small Python script. Can build from scratch, or use the very small Distroless images.

It's not a very good one, but it is ubiquitous (it's also better if you remember to include the right syntax marker that enables heredocs): # syntax=docker/dockerfile:1 I suspect that the GP was really asking "why not use a different tool", like buildah <https://buildah.io>, buildpacks <https://buildpacks.io>, nix <https://nix.dev/tutorials/nixos/building-and-running-docker-...>, kaniko <https://github.com/GoogleContainerTools/kaniko>, ko <https://github.com/ko-build/ko>, bazel <https://github.com/bazel-contrib/rules_oci>, apko <https://github.com/chainguard-dev/apko>, or other tools. Each of those has tradeoffs compared to Dockerfiles (I have no need for bazel, but if I did, then adding `rules_oci` might be a win-win, rather than using a Dockerfile). If I used Nix, then the Nix dockerTools would be a huge win (I don't use Nix). If I

> your runfiles tree I don't remember using runfiles much outside of tests in Bazel, even at Google. My guess would be that runfiles are packaged up into via MPM [1], which in open source world I would guess a container image is the closest equivalent? Then you get hermetic runtime environment, especially because k8s/containers seems to be the default deployment platform these days. I think the bazel OCI rules [2] should package runfiles too (I haven't checked) [1]: https://www.usenix.org/conference/lisa14/conference-program/... [2]: https://github.com/bazel-contrib/rules_oci

rules_docker is now deprecated but rules_oci[0] is the replacement and so far I find it much nicer [0] - https://github.com/bazel-contrib/rules_oci

rules_docker is deprecated in favor of rules_oci, which also has Rust support: https://github.com/bazel-contrib/rules_oci/blob/main/docs/ru... I think Bazel can be a good fit for larger polyglot organizations that need to manage large codebases in many languages in a uniform way. Basically Google-circa-2010-sized organizations, coincidentally! For smaller teams, adopting Bazel too early can be a real productivity drain, where you get all of the downsides of its constraints without as many of its benefits. Bazel is overkill for a project of ~10 Go apps, for example. Ko was actually created to help such a project (Knative) migrate off of Bazel's rules_docker to something better, and I think it achieved the goal!

Not really. I create my docker images with Bazel/crane [1]. (For reproducibility.) There are no Dockerfiles at all. --- The .py example is bad because there is nothing else (AFAIK) that produces .pyc. [1] https://github.com/bazel-contrib/rules_oci