[SRE-5664] Create and set up zappi/image-builder Docker image#1
Merged
itskingori merged 10 commits intomainfrom Mar 16, 2026
Merged
[SRE-5664] Create and set up zappi/image-builder Docker image#1itskingori merged 10 commits intomainfrom
zappi/image-builder Docker image#1itskingori merged 10 commits intomainfrom
Conversation
Ubuntu 24.04-based image carrying the Docker CLI (29.3.0), Docker Buildx plugin (0.31.1), and the Amazon ECR credential helper (0.12.0). Runs as a non-root builder user (UID/GID 1001). The image is designed for running docker buildx build against remote BuildKit daemons using the remote driver — no Docker Engine daemon is needed. ECR authentication is handled by docker-credential-ecr-login via IRSA; the Docker CLI config (credHelpers) is provided at runtime rather than baked into the image.
test.yml runs on every PR to main and validates that the image builds successfully for both linux/amd64 and linux/arm64 using QEMU and Docker Buildx, without pushing. release.yml triggers on any tag push. It creates a GitHub Release, then builds and pushes the multi-arch image to Docker Hub as zappi/image-builder, and syncs the README to Docker Hub via peter-evans/dockerhub-description.
Assigns @Intellection/sre as the default owner for all files in the repository.
Describes the image purpose, bundled components with versions, how the Docker CLI config is expected to be provided at runtime, and links to the upstream projects (Docker CLI, Buildx, ECR credential helper).
itskingori
changed the title
zappi/image-builder Docker image
curl is already required for fetching the Docker apt repository GPG key. Using it for the ECR credential helper download as well removes wget as a dependency.
The opening paragraph previously framed the image as ECR-specific. Widened to describe the general purpose: building and pushing container images via remote BuildKit daemons. The credential helper description previously called out IRSA specifically. Updated to reference the standard AWS credential chain, which is what the helper actually follows.
Without an explicit WORKDIR, containers start in / which is not writable by the non-root builder user.
All Docker actions (metadata, qemu, buildx, build-push, login) bumped to their latest major versions. actions/checkout bumped from v4 to v6. peter-evans/dockerhub-description bumped from v4 to v5. Replaces the archived actions/create-release@v1 (stuck on Node.js 12, no longer maintained) with a gh release create shell step.
The previous wildcard matched any tag, which would trigger a GitHub Release and Docker Hub push for non-version tags like 'test' or 'experiment'. Restricting to X.Y.Z-shaped tags prevents unintended releases.
--system sets the default shell to /usr/sbin/nologin, which is inconsistent with the /bin/bash CMD. The flag's protections (nologin shell, hidden from login screens) have no practical effect in a container. Without it, the user gets /bin/bash as its shell by default, matching the container's intended behaviour.
zacblazic
approved these changes
Mar 16, 2026
itskingori
commented
Mar 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sets up the initial image definition, CI pipelines, and documentation for
zappi/image-builder— a purpose-built image for runningdocker buildx buildagainst remote BuildKit daemons.Changes
builderuser. The Docker CLI config is provided at runtime, not baked in.Non-goals
git, theawsCLI, or any tooling beyond whatdocker buildx buildrequires.Testing
Verified multi-arch build passes in CI on this PR
References