catalog

I don't use buildkit for artifacts, but I do like to output images to an OCI Layout so that I can finish some local checks and updates before pushing the image to a registry. But the real hidden power of buildkit is the ability to swap out the Dockerfile parser. If you want to see that in action, look at this Dockerfile (yes, that's yaml) used for one of their hardened images: https://github.com/docker-hardened-images/catalog/blob/main/...

Docker has to maintain relatively complicated looking build instructions like this to make these images: https://github.com/docker-hardened-images/catalog/blob/b5c7a... Meanwhile, nix already has packaged more software than any other distro, and the vast majority of its software can be put into a container image with no additional dependencies (i.e. "hardened" in the same way as these are) with exactly zero extra work specific to each package. The nixpkgs repository already contains the instructions to build and isolate outputs, there's already a massive cache infrastructure setup, builds are largely reproducible, and docker will have to make all of that for their own tool to reach parity... and without a community behind it like nix has.

> Open Source Where? Lets take a random example: https://hub.docker.com/hardened-images/catalog/dhi/traefik Ok, where is the source? Open source means I can build it myself, maybe because I'm working in an offline/airgapped/high compliance environment. I found a "catalogue" https://github.com/docker-hardened-images/catalog/blob/main/... but this isn't a build file, it's some... specialized DHI tool to build? Nothing https://github.com/docker-hardened-images shows me docs where I can build it myself or any sort of "dhi" tool.

TL;DR https://github.com/docker-hardened-images/catalog?tab=readme...

Thanks for reporting, team is fixing it, the right url is: https://github.com/docker-hardened-images/catalog/issues/