第6章 Introduction to reproducible container builds

Red Hat Enterprise Linux (RHEL) now supports reproducible container builds using the Red Hat tools Podman and Buildah. This new feature reduces changes in images when users build them with the same inputs but at different times. Fewer changes between images can decrease the amount of data you need to pull from a registry when moving from one version of an image to a newer version of that image. Reproducible container builds are crucial for ensuring supply chain security, facilitating reliable software deployment, and facilitating effective debugging.

Previously, the escalating size of container images and increased customer apprehension regarding update payload sizes amplify the existing challenges and limitations associated with tarball creation. In systems like Konflux, each Git commit generates new tarballs, which necessitates a complete re-download of the entire image. Factors such as mtime changes mean that even when users install the same RPMs, storage requirements double, despite no alteration in the underlying data. This not only burdens registry storage but also forces clients to pull a new layer, even if no changes have occurred. This situation further exacerbates problems in environments like rhel-bootc and RHEL AI, which prioritize faster updates.