carverauto/serviceradar

Fork 0

chore: investigate using chainguard apko images #548

New issue

Open

opened 2026-03-28 04:25:37 +00:00 by mfreeman451 · 5 comments

mfreeman451 commented

2026-03-28 04:25:37 +00:00

Owner

Imported from GitHub.

Original GitHub issue: #1733
Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/issues/1733
Original created: 2025-10-10T03:10:31Z

https://github.com/chainguard-dev/rules_apko

bazel_dep(name = "rules_apko", version = "1.4.2")
...
###############################################################################
Apko Rules
https://github.com/chainguard-dev/rules_apko
###############################################################################
Translate apko.lock.json to @base_image//:contents
https://edu.chainguard.dev/open-source/build-tools/apko/bazel-rules/
apk = use_extension("@rules_apko//apko:extensions.bzl", "apko")
apk.translate_lock(
    name = "base_image",
    lock = "//build/images/base_image:apko.lock.json",
)
use_repo(apk, "base_image")

Imported from GitHub. Original GitHub issue: #1733 Original author: @mfreeman451 Original URL: https://github.com/carverauto/serviceradar/issues/1733 Original created: 2025-10-10T03:10:31Z --- https://github.com/chainguard-dev/rules_apko ```bazel bazel_dep(name = "rules_apko", version = "1.4.2") ... ############################################################################### Apko Rules https://github.com/chainguard-dev/rules_apko ############################################################################### Translate apko.lock.json to @base_image//:contents https://edu.chainguard.dev/open-source/build-tools/apko/bazel-rules/ apk = use_extension("@rules_apko//apko:extensions.bzl", "apko") apk.translate_lock( name = "base_image", lock = "//build/images/base_image:apko.lock.json", ) use_repo(apk, "base_image") ```

mfreeman451 added this to the 1.1.2 milestone

2026-03-28 04:25:37 +00:00

mfreeman451 added the

k8s

label

2026-03-28 04:25:37 +00:00

mfreeman451 commented

2026-03-28 04:25:37 +00:00

Author

Owner

Imported GitHub comment.

Original author: @marvin-hansen
Original URL: https://github.com/carverauto/serviceradar/issues/1733#issuecomment-3388624699
Original created: 2025-10-10T07:25:03Z

This one is a bit tricky. I tried to a config today, but ran into multiple checksum failures when Bazel tried to download the Chainsaw packages for the configured base image. No idea how that is even possible as I have re-generated a new lock file.
For now, I have removed the config. Take another look on another day.

Imported GitHub comment. Original author: @marvin-hansen Original URL: https://github.com/carverauto/serviceradar/issues/1733#issuecomment-3388624699 Original created: 2025-10-10T07:25:03Z --- This one is a bit tricky. I tried to a config today, but ran into multiple checksum failures when Bazel tried to download the Chainsaw packages for the configured base image. No idea how that is even possible as I have re-generated a new lock file. For now, I have removed the config. Take another look on another day.

mfreeman451 commented

2026-03-28 04:25:37 +00:00

Author

Owner

Imported GitHub comment.

Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/issues/1733#issuecomment-3978663138
Original created: 2026-03-01T00:01:17Z

wondering if we should revisit this sooner than later.. there are other secure container options maybe we can look into?

Imported GitHub comment. Original author: @mfreeman451 Original URL: https://github.com/carverauto/serviceradar/issues/1733#issuecomment-3978663138 Original created: 2026-03-01T00:01:17Z --- wondering if we should revisit this sooner than later.. there are other secure container options maybe we can look into?

mfreeman451 commented

2026-03-28 04:25:37 +00:00

Author

Owner

Imported GitHub comment.

Original author: @marvin-hansen
Original URL: https://github.com/carverauto/serviceradar/issues/1733#issuecomment-3979946487
Original created: 2026-03-01T13:20:45Z

From what I have seen today,
this would imply a major rewrite of the Bazel config for building all
container images. Right now, the oci rules are basically abused as docker
replacement with an exceptionally ugly set of Docker files.

Conventionally you would write something like this

https://github.com/marvin-hansen/alpha-system/blob/main/alpha_system/mds/mddb/mddb_service/BUILD.bazel

And you get cacheable image builds for free by basically just copying the
build binary into the OCI stub.

Not sure if you really want to open up this can of worms. However, these
Bazel build files are trivial to maintain so there is that.

On Sun, Mar 1, 2026 at 08:01 Michael Freeman @.***>
wrote:

mfreeman451 left a comment (carverauto/serviceradar#1733)
https://github.com/carverauto/serviceradar/issues/1733#issuecomment-3978663138

wondering if we should revisit this sooner than later.. there are other
secure container options maybe we can look into?

—
Reply to this email directly, view it on GitHub
https://github.com/carverauto/serviceradar/issues/1733#issuecomment-3978663138,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AFYR7XGHIXZQBYKCO6HBZAL4OIT6FAVCNFSM6AAAAACIZNGSNSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTSNZYGY3DGMJTHA
.
You are receiving this because you were assigned.Message ID:
@.***>

Imported GitHub comment. Original author: @marvin-hansen Original URL: https://github.com/carverauto/serviceradar/issues/1733#issuecomment-3979946487 Original created: 2026-03-01T13:20:45Z --- From what I have seen today, this would imply a major rewrite of the Bazel config for building all container images. Right now, the oci rules are basically abused as docker replacement with an exceptionally ugly set of Docker files. Conventionally you would write something like this https://github.com/marvin-hansen/alpha-system/blob/main/alpha_system/mds/mddb/mddb_service/BUILD.bazel And you get cacheable image builds for free by basically just copying the build binary into the OCI stub. Not sure if you really want to open up this can of worms. However, these Bazel build files are trivial to maintain so there is that. On Sun, Mar 1, 2026 at 08:01 Michael Freeman ***@***.***> wrote: > *mfreeman451* left a comment (carverauto/serviceradar#1733) > <https://github.com/carverauto/serviceradar/issues/1733#issuecomment-3978663138> > > wondering if we should revisit this sooner than later.. there are other > secure container options maybe we can look into? > > — > Reply to this email directly, view it on GitHub > <https://github.com/carverauto/serviceradar/issues/1733#issuecomment-3978663138>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AFYR7XGHIXZQBYKCO6HBZAL4OIT6FAVCNFSM6AAAAACIZNGSNSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTSNZYGY3DGMJTHA> > . > You are receiving this because you were assigned.Message ID: > ***@***.***> >

mfreeman451 commented

2026-03-28 04:25:37 +00:00

Author

Owner

Imported GitHub comment.

Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/issues/1733#issuecomment-3981804846
Original created: 2026-03-02T03:26:54Z

Needs to be done, I can take care of it unless you really want to spend 2-3 days dealing with that

Imported GitHub comment. Original author: @mfreeman451 Original URL: https://github.com/carverauto/serviceradar/issues/1733#issuecomment-3981804846 Original created: 2026-03-02T03:26:54Z --- Needs to be done, I can take care of it unless you really want to spend 2-3 days dealing with that

mfreeman451 commented

2026-03-28 04:25:38 +00:00

Author

Owner

Imported GitHub comment.

Original author: @marvin-hansen
Original URL: https://github.com/carverauto/serviceradar/issues/1733#issuecomment-3981966257
Original created: 2026-03-02T04:25:33Z

Sounds urgent to me. I cannot block 3 days for this, so I am afraid you have to take over now.

In this case, it might be better to do it your way e.g. replace the Rust binaries with Elexir as you alrady suggested and convert the existing Dockerfile mess into proper Bazel container builds.

here is a sample Bazel config for full apko based Image building:

https://github.com/marvin-hansen/alpha-system

The apko rules are in:

https://github.com/marvin-hansen/alpha-system/tree/main/build/images/base_image

And the custom image build rule is here:
https://github.com/marvin-hansen/alpha-system/blob/main/build/container.bzl

And the MODULE config for Apko Rules:
https://github.com/marvin-hansen/alpha-system/blob/main/MODULE.bazel

Parallel container build and run has been done with rules multun the the root BUILD config file

https://github.com/marvin-hansen/alpha-system/blob/main/BUILD.bazel

Meaning, when you call

bazel build //:push

All those containers are build in parallel because jobs = 0 is set. this is a bit upside down because normally one would expect parallel=true, but somehow the rule author decided jobs = 0 is it..

Aliases are resolved in:
https://github.com/marvin-hansen/alpha-system/blob/main/alias/service/BUILD.bazel

and a typical Bazel native build file with OCI config looks like:
https://github.com/marvin-hansen/alpha-system/blob/main/alpha_system/mds/mddb/mddb_service/BUILD.bazel

Hope that helps. If you run into a major blocker, let me know and I try to helpl as much as I can.

In the meantime, I pause the Rust work until this has been resolved.

Imported GitHub comment. Original author: @marvin-hansen Original URL: https://github.com/carverauto/serviceradar/issues/1733#issuecomment-3981966257 Original created: 2026-03-02T04:25:33Z --- Sounds urgent to me. I cannot block 3 days for this, so I am afraid you have to take over now. In this case, it might be better to do it your way e.g. replace the Rust binaries with Elexir as you alrady suggested and convert the existing Dockerfile mess into proper Bazel container builds. here is a sample Bazel config for full apko based Image building: https://github.com/marvin-hansen/alpha-system The apko rules are in: https://github.com/marvin-hansen/alpha-system/tree/main/build/images/base_image And the custom image build rule is here: https://github.com/marvin-hansen/alpha-system/blob/main/build/container.bzl And the MODULE config for Apko Rules: https://github.com/marvin-hansen/alpha-system/blob/main/MODULE.bazel Parallel container build and run has been done with rules multun the the root BUILD config file https://github.com/marvin-hansen/alpha-system/blob/main/BUILD.bazel Meaning, when you call bazel build //:push All those containers are build in parallel because jobs = 0 is set. this is a bit upside down because normally one would expect parallel=true, but somehow the rule author decided jobs = 0 is it.. Aliases are resolved in: https://github.com/marvin-hansen/alpha-system/blob/main/alias/service/BUILD.bazel and a typical Bazel native build file with OCI config looks like: https://github.com/marvin-hansen/alpha-system/blob/main/alpha_system/mds/mddb/mddb_service/BUILD.bazel Hope that helps. If you run into a major blocker, let me know and I try to helpl as much as I can. In the meantime, I pause the Rust work until this has been resolved.