Run pack against containerized rootless docker and podman

pack with containerized daemon.md

Pre-reqs

Download pack with build --docker-host support

As of 2021-03-04, you'll need to download a pre-release build:

• Visit latest builds from main
• Click the top-most green result
• Click pack-macos (or whatever OS you're using)
• Download and extract
• Open terminal in directory containing pack

pack within dind-rootless container

docker run \
  --name pack-dind-ctr \
  --detach \
  --rm \
  --privileged \
  --env DOCKER_TLS_CERTDIR="" \
  docker:20.10.5-dind-rootless

docker cp pack pack-dind-ctr:/usr/local/bin/pack

docker exec -it \
  -e DOCKER_HOST=unix:///run/user/1000/docker.sock \
  pack-dind-ctr \
  pack build myapp --docker-host=inherit --builder cnbs/sample-builder:alpine --path /var/empty

docker rm -f pack-dind-ctr

pack over TLS to dind-rootless container

docker run \
  --name pack-dind-tls-ctr \
  --rm \
  --detach \
  --privileged \
  --publish 2376:2376 \
  --env DOCKER_TLS_CERTDIR="/certs" \
  --volume ~/.docker/dind:/certs \
   docker:20.10.5-dind-rootless
   
export DOCKER_CERT_PATH=~/.docker/dind/client/
export DOCKER_TLS_VERIFY=1
export DOCKER_HOST=tcp://localhost:2376

pack build myapp --docker-host=unix:///run/user/1000/docker.sock --builder cnbs/sample-builder:alpine --path /var/empty

docker rm -f pack-dind-tls-ctr

pack within podman container

docker build . --tag pack-podman -f <(cat <<EOF
FROM fedora

RUN dnf -y install podman && dnf clean all && systemctl enable podman.socket && sed -i.orig 's/driver = "overlay"/driver = "vfs"/' /etc/containers/storage.conf

ENTRYPOINT ["/sbin/init"]
EOF
)

docker run \
  --name pack-podman-ctr \
  --detach \
  --rm \
  --privileged \
  pack-podman

docker cp pack pack-podman-ctr:/usr/local/bin/pack

docker exec -it \
  -e DOCKER_HOST=unix:///run/podman/podman.sock \
  pack-podman-ctr \
  pack build myapp --docker-host=inherit --builder cnbs/sample-builder:alpine --path /var/empty

docker rm -f pack-podman-ctr

Note:

Never run any untrusted app or buildpack this way. All containers run with --privileged, as does pack when exec'd inside.