FR: Build Dockerfiles with incremental cache support

[stabai]

Feature request:
Allow Bazel to build Dockerfile images in a way that takes advantage of incremental build caching. The dockerfile_image rule in rules_docker contrib allows building such images, but it's incredibly slow because of the lack of build cache.

[cgrindel]

Thanks for your proposal. @thesayyn has been thinking about this, as well. He will comment on this issue with his thoughts. Hopefully, we can come up with a solution that satisfies your goals.

[thesayyn]

There are some problems that'll prevent us from doing this the way you want it;

• bazel has its own cache so anything that falls out of it is not tracked by bazel. therefore it would not be trivial to get the docker cache included in the bazel cache.
• an alternative is to keep the docker build cache local to the host and let it leak into the sandbox. but this would increase the likelihood of non-hermetic builds.
• biggest drawback is that Dockerfile is not hermetic by design, meaning instructions such as RUN apt-get install curl or make build is not repeatable, which would lead to non-reproducible builds.
• bazel already knows how to [cross-]compile various languages, so it doesn't make sense to delegate this task to docker.
• requires rules_oci to declare a dependency on a docker_toolchain which we are not willing to take.

I have been thinking about this issue for a while, how to tackle the problem without sacrificing a whole lot. combination of gazelle + rules_oci is the way to do this. to explain the idea roughly;

given a Dockerfile;

FROM node:12

RUN apt-install curl

WORKDIR /app

COPY index.js  .

RUN yarn install --production

CMD ["node", "index.js"]

EXPOSE 3000

a gazelle plugin for rules_oci would translate it to;

WORKSPACE

debian_archive(
    name = "debian_amd64_curl"
    urls = ["debian_archive_url"]
)

oci_pull(
    name = "node_12",
    repository = "index.docker.io/library/node",
    ref = "12"
)

translate_pnpm_lock(
   name = "npm",
   yarn_lock = "yarn.lock"
)

BUILD

js_binary(
   name = "app",
   entry_point = "index.js"
)
oci_image(
   name = "image",
   base = "@node_12//:image", 
   tars = [
      ":app"
   ]
   workdir = "/app",
   cmd = ["index.js"],
   ports = [3000],
   
)

[mvgijssel]

Does the debian_archive rule exist somewhere? As this would solve 90% of the problem for me!