New Bazel Ruleset Helps Developers Build Secure Container Images

Google has made it easier and safer to construct container pictures utilizing the Bazel construct system.

Bazel, an open supply construct and check instrument just like Make and Maven, helps initiatives in a number of languages and builds for a number of platforms. Builders use Starlark, a human-readable, high-level construct language, to create guidelines instructing Bazel on what to do. A rule specifies the enter recordsdata and the kind of output that will be generated in consequence, comparable to an executable or a library file. Associated guidelines are mixed right into a ruleset, comparable to guidelines for creating binaries and working checks.

Bazel can be utilized to create Distroless builds, or minimal base pictures the place what’s within the runtime container is restricted to solely elements vital for the applying. Minimal base pictures cut back the burden of managing dangers related to safety vulnerabilities within the elements and tackle governance points within the software program supple chain.

The brand new rules_oci ruleset “modernizes” the method for creating Distroless builds by including provide chain safety metadata to the container pictures, Google Open Supply Safety Staff’s Appu Goundan wrote within the put up asserting the overall availability of rules_oci. As a result of Bazel helps managing and caching dependencies by their integrity hash, it might probably make assurances in regards to the provide chain. Builders get a software program invoice of supplies exhibiting what went into the container, permitting organizations to make knowledgeable selections in regards to the pictures they’re utilizing.

Code signing permits customers to confirm that the container picture was not modified by another person after it was created by the developer who signed it.

The brand new rules_oci ruleset permits builders utilizing Bazel to create Docker containers as an alternative of utilizing the older rules_docker ruleset, which is now in upkeep mode. The benefit new ruleset has over the older one is that it permits builders to create Docker containers even when a docker daemon just isn’t already put in on the machine. There’s a Migration information to assist organizations transfer from utilizing rules_docker to rules_oci.