Adventure awaits you as we journey through the buildpack ecosystem. We’ll discuss how to find buildpacks in the wild and examine their different habitats, including Google, Heroku, and Cloud Foundry. In this talk, you’ll learn how to run buildpacks and where to find production ready buildpacks that are perfect for your app.

1. FANTASTIC
BUILDPACK
AND WHERE
TO FIND THEM

2. @codefinger

3. @_JamesWard

4. Buildpacks a History
Heroku
V1
Heroku
V2 (A)
Pivotal
V2 (B)
Pivotal
Heroku
V3/CNBs
2011 2018

6. The Result
App image that has
● a reproducible build
● metadata that can be inspected
● logical mapping of layers to
components
OS
app
dependencies

7. The Buildpack Ecosystem
Platform Implementation Core
● Pack CLI
● Tekton Template
● Lifecycle
● libbuildpack
● Specification
● RFCs
?
Buildpacks
● 3rd Parties
● Heroku
● Cloud Foundry

8. CNB: An Open Standard
Platform Lifecycle Buildpacks
CNB Specification
Platform API Buildpack API
pack
kpack
Salesforce
Evergreen
Tekton
Google Cloud
Run Button

9. Lifecycle
detect
restore
analyze
build
export
cache

10. Lifecycle: Detect
detect
restore
analyze
build
export
cache
● Tests groups of buildpacks against source, in order
(via each buildpack’s detect binary)
● First group that passes is selected
Gradle CNBJVM CNB
Maven CNBJVM CNBpom.xml
module/
pom.xml
src/
...

11. Lifecycle: Restore & Analyze
detect
restore
analyze
build
export
cache
analyze
● metadata about OCI layers generated during a
previous build are made available to buildpacks

12. Lifecycle: Build
detect
restore
analyze
build
export
cache
● For previously-selected group, executes each
buildpack’s build executable in order
pom.xml
module/
pom.xml
src/
...

13. Lifecycle: Export & Cache
detect
restore
analyze
build
export
cache
● Assembles final layers into image
● Combines information from analyze phase to ensure
only changed layers are updated
cache

14. Demo Reset
rm -rf demo.zip demo/
kubectl delete -f hello-springboot-cnb.yaml
kubectl apply -f my-volume-claim.yaml
Delete github hello-php repo

15. pack

16. heroku container deploy

17. tekton

18. Circle CI

19. Cloud Run Button

21. Case Study
Heartbleed
CVE-2014-0160

22. Java App
App
JDK
OS
FROM openjdk
...
COPY target/app.jar app.jar
...
FROM ubuntu:trusty
RUN apt-get install openjdk-8-jdk
...
FROM scratch

23. Java App
App
JDK
OS
FROM openjdk
...
COPY target/app.jar app.jar
...
FROM ubuntu:trusty
RUN apt-get install openjdk-8-jdk
...
FROM scratch

24. 500 Java Apps

25. 500 Java Apps

27. Java App
App
JDK
OS
Buildpack: heroku/java
FROM ubuntu:trusty

28. ABI Compatibility
● Application Binary Interface
● Operating System vendors (ex. Canonical for Ubuntu) guarantee a degree of
compatibility when patching

29. Rebase
App
JDK
OS OS
ABI Compatible

30. Rebase
App
JDK
OS OS
ETA to Mitigation:
A few hours

33. Coming of Age
production ready for everyone

35. Getting Started
Try it:
Spring 2.3 (BETA): ./mvnw spring-boot:build-image
Cloud Run Button: https://github.com/jamesward/hello-php
Pack CLI: https://buildpacks.io/docs/install-pack/
Use it in Jenkins via Pack or elsewhere with plugins