oci-build task

• BUILDKITADDHOSTS (default empty): extra host definitions for buildkit

• BUILDKITEXTRACONFIG (default empty): a string written verbatim to builkit's

inputs

There are no required inputs - your task should just list each artifact it needs as an input. Typically this is in close correlation with $CONTEXT:

params:
  CONTEXT: my-image
inputs: 
name: my-image

params:
  DOCKERFILE: my-repo/Dockerfile
inputs: 
name: my-repo
 
name: some-dependency

params:
  CONTEXT: my-repo
inputs: 
name: my-repo
 
name: some-dependency
 
  path: my-repo/some-dependency

Or, to fully rely on the default behavior and use path to wire up the context accordingly, you could set your primary context as path: . and set up any additional inputs underneath:

inputs:
name: my-repo
  path: .
name: some-dependency

outputs

A single output named image may be configured:

outputs:
name: image

[outputmapping]: https://concourse-ci.org/jobs.html#schema.step.task-step.outputmapping

The output will contain the following files:

• image.tar: the OCI image tarball. This tarball can be uploaded to a registry

• image/: a directory containing the OCI image(s) in OCI Image Layout format.

• digest: the digest of the OCI config. This file can be used to tag the

docker load -i image/image.tar
  docker tag $(cat image/digest) my-name

If $UNPACK_ROOTFS is configured, the following additional entries will be created:

rootfs/: the unpacked contents of the image's filesystem.

• metadata.json: a JSON file containing the image's env and user

This is a Concourse-specific format to support using the newly built image for a subsequent task by pointing the task step's image option to the output, like so:

plan:
task: build-image
  params:
    UNPACK_ROOTFS: true
  output_mapping: {image: my-built-image}
task: use-image
  image: my-built-image

(The output_mapping here is just for clarity; alternatively you could just set image: image.)

Note: at some point Concourse will likely standardize on OCI instead.

caches

Caching can be enabled by caching the cache path on the task:

caches:
path: cache

NOTE: the contents of --mount=type=cache directories are not cached, see https://github.com/concourse/oci-build-task/issues/87

run

Your task should run the build executable:

run:
  path: build

migrating from the docker-image resource

The docker-image resource was previously used for building and pushing a Docker image to a registry in one fell swoop.

The oci-build task, in contrast, only supports building images - it does not support pushing or even tagging the image. It can be used to build an image and use it for a subsequent task image without pushing it to a registry, by configuring $UNPACK_ROOTFS.

In order to push the newly built image, you can use a resource like the registry-image resource like so:

resources:
name: my-image-src
  type: git
  source:
    uri: https://github.com/...
name: my-image
  type: registry-image
  source:
    repository: my-user/my-repo
jobs: 
name: build-and-push
 
  plan:   # fetch repository source (containing Dockerfile)   - get: my-image-src

# build using oci-build task   #   # note: this task config could be pushed into my-image-src and loaded using   # file: instead   - task: build     privileged: true     config:       platform: linux
image_resource:         type: registry-image         source:           repository: concourse/oci-build-task
inputs:       - name: my-image-src         path: .
outputs:       - name: image
run:         path: build
# push using registry-image resource   - put: my-image     params: {image: image/image.tar}

example

This repo contains an example.yml, which builds the image for the task itself:

fly -t dev execute -c example.yml -i context=. -o image=. -p
docker load -i image.tar

That -p at the end is not a typo; it runs the task with elevated privileges.

Providing Custom CA Certificates

Assuming your custom CA cert is passed in as an input to the oci-build task, you can use a task config like this to load your custom CA certificate:

platform: linux
inputs: 
name: certs
 
  path: /var/certs #Absolute path only works on Concourse >=7.5.0 #..other inputs

outputs: 
name: image
 
 params:   BUILDKITEXTRACONFIG: |     [registry."my-registry.com"]       ca=["/var/certs/my-ca.pem"]

run:   path: build