6.4. Working with reproducible container builds

Procedure

• To set these options when running your Buildah command. For example, to build an image from a Containerfile and force all timestamps to a specific point in time:

  Use a specific, immutable image.
  FROM registry.access.redhat.com/ubi10/ubi:10.0 AS builder
  
  # Set the SOURCE_DATE_EPOCH for deterministic timestamps
  ARG SOURCE_DATE_EPOCH
  ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH:-1}
  
  # Build the image using the build-arg and rewrite-timestamp options
  buildah bud --build-arg --source-date-epoch=${SOURCE_DATE_EPOCH} \
    --rewrite-timestamp \
    -f Containerfile \
    -t my-reproducible-image .

• Run the podman build command with a consistent timestamp to create the reproducible image:

  # Set a consistent timestamp using the last Git commit date
  export SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)

• Build the image with the specified timestamp:

  podman build --source-date-epoch=${SOURCE_DATE_EPOCH} --rewrite-timestamp -t my-reproducible-app .

Verification

• After building, run the reproducible command again. If the build is truly reproducible, the buildah inspect command should show the same image digest.

  buildah bud --build-arg --source-date-epoch=${SOURCE_DATE_EPOCH} \ --rewrite-timestamp \ -f Containerfile \ -t my-reproducible-image-2 .

• Compare the digests:

  buildah inspect --format '{{.Digest}}' my-reproducible-image
  buildah inspect --format '{{.Digest}}' my-reproducible-image-2