buildstrategy_buildkit_cr.yaml

---
apiVersion: shipwright.io/v1alpha1
kind: ClusterBuildStrategy
metadata:
  name: buildkit
  annotations:
    # See https://github.com/moby/buildkit/blob/master/docs/rootless.md#about---oci-worker-no-process-sandbox for more information
    container.apparmor.security.beta.kubernetes.io/step-build-and-push: unconfined
    # The usage of seccomp annotation will be deprecate in k8s v1.22.0, see
    # https://kubernetes.io/docs/tutorials/clusters/seccomp/#create-a-pod-with-a-seccomp-profile-for-syscall-auditing for more information
    container.seccomp.security.alpha.kubernetes.io/step-build-and-push: unconfined
spec:
  parameters:
  - name: insecure-registry
    description: "enables the push to an insecure registry"
    default: "false"
  buildSteps:
    - name: prepare
      image: alpine:latest
      securityContext:
        runAsUser: 0
        capabilities:
          add:
            - CHOWN
      command:
        - /bin/chown
      args:
        - -R
        - 1000:1000
        - /tekton/home
    - name: build-and-push
      image: moby/buildkit:nightly-rootless
      imagePullPolicy: Always
      securityContext:
        allowPrivilegeEscalation: true
        runAsUser: 1000
        runAsGroup: 1000
      workingDir: $(params.shp-source-root)
      env:
      - name: DOCKER_CONFIG
        value: /tekton/home/.docker
      - name: HOME
        value: /tekton/home
      # See https://github.com/moby/buildkit/blob/master/docs/rootless.md#about---oci-worker-no-process-sandbox for more information
      - name: BUILDKITD_FLAGS
        value: --oci-worker-no-process-sandbox
      command:
        - /bin/ash
      args:
        - -c
        - |
          set -euo pipefail

          buildctl-daemonless.sh build \
            --progress=plain \
            --frontend=dockerfile.v0 \
            --local=context='$(params.shp-source-context)' \
            --local=dockerfile='$(params.shp-source-root)/$(build.dockerfile)' \
            --output=type=image,name='$(params.shp-output-image)',push=true,registry.insecure=$(params.insecure-registry) \
            --export-cache=type=inline \
            --import-cache=type=registry,ref='$(params.shp-output-image)' \
            --metadata-file /tmp/image-metadata.json
          
          # Store the image digest
          sed -E 's/.*containerimage.digest":"([^"]*).*/\1/' < /tmp/image-metadata.json > '$(results.shp-image-digest.path)'