zappi/image-builder

Docker Image Builder

A purpose-built image for building and pushing container images via remote https://github.com/moby/buildkit daemons. It carries only what is needed for this role — no Docker Engine daemon and no general build toolchains.

Published to Docker Hub as https://hub.docker.com/r/zappi/image-builder. Built for linux/amd64 and linux/arm64.

Contents

git and git-lfs are included as part of the builder toolchain.

The image runs as a non-root builder user (UID/GID 65533).

Docker CLI Configuration

No ~/.docker/config.json is baked into the image. It is expected to be provided at runtime — for example, mounted via a Kubernetes ConfigMap.

AWS ECR Credential Helper Configuration

The config should wire the ECR credential helper for the registries the builder needs to authenticate with:

json
{
  "credHelpers": {
    "public.ecr.aws": "ecr-login",
    "<account-id>.dkr.ecr.<region>.amazonaws.com": "ecr-login"
  }
}

The ECR credential helper (docker-credential-ecr-login) is already present in the image. It follows the standard AWS credential chain, so no static credentials need to be baked into the image.

Releases

Images are tagged and pushed to Docker Hub on every https://github.com/Intellection/docker-image-builder/releases. Tags follow the version in the release (e.g. zappi/image-builder:1.0.0).

References

• https://github.com/docker/cli
• https://github.com/docker/buildx
• https://github.com/git/git
• https://github.com/git-lfs/git-lfs
• https://github.com/awslabs/amazon-ecr-credential-helper