Image builders

When DSS builds images it prepares a Dockerfile and a build context, then sends them to an image builder.

The default image builder is Docker. In environments where the DSS host cannot or should not build images locally, DSS can instead use an in-cluster builder or an OpenShift builder.

The image builder used for base images is configured separately from containerized execution configurations and image build configurations. If you customize the base image builder, it must publish images to a registry that is consistent with the image build configuration used by DSS workloads.

Image build configuration

Image build configurations define builder-specific settings, how images are built, and where images are pushed. They can specify the image builder to use, the source image or base image tag, and the publishing destination for built images.

Docker builder

This is the default builder. The daemon can run locally on the DSS host, or remotely. see Using Docker instead of Kubernetes.

Most of the time, this is the builder that should be used.

In-cluster builder

Warning

This builder requires knowledge of containers, image builds, registries, and Kubernetes permissions.

This builder runs rootless-Buildah in a container running in a Kubernetes cluster. It is useful when the DSS host does not have access to a Docker daemon, or when image builds must run inside the same cluster environment as the workloads.

Use this builder when:

  • There is no docker daemon available to DSS

  • There is a cluster attached to DSS

An in-cluster builder configuration identifies the Kubernetes context and namespace used for builder pods, and the registry where base images are pushed.

OpenShift builder

The OpenShift builder is intended for OpenShift clusters where image builds must follow OpenShift security and runtime constraints.

Use this builder when:

  • The target runtime is OpenShift.

  • The build must run inside OpenShift rather than on the DSS host.

  • The OpenShift project and service account used for builds have the required permissions to build and push images.

For OpenShift runtime setup, see Using Openshift.