# Traditional Dockerfile - Explicit Control
FROM golang:1.21-alpine AS builder

# Manual dependency management
RUN apk add --no-cache git ca-certificates tzdata

WORKDIR /build

# Explicit caching strategy
COPY go.mod go.sum ./
RUN go mod download

# Manual build configuration
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o app

# Manual optimization
FROM alpine:3.18
RUN apk add --no-cache ca-certificates
COPY --from=builder /build/app /app
ENTRYPOINT ["/app"]

# Cloud Native Buildpacks - Convention Over Configuration
pack build myapp --builder paketobuildpacks/builder:base

# OR with Cloud Native Buildpacks
pack build myapp \
  --builder gcr.io/buildpacks/builder:v1 \
  --env BP_GO_VERSION=1.21 \
  --env BP_GO_BUILD_FLAGS="-ldflags='-w -s'"

approach_comparison:
  dockerfile:
    philosophy: "Imperative and explicit"
    control: "Full control over every aspect"
    learning_curve: "Medium - requires container knowledge"
    flexibility: "Unlimited - can do anything"
    maintenance: "Manual - developer responsibility"
    security: "Manual - requires constant vigilance"

  buildpacks:
    philosophy: "Declarative and convention-based"
    control: "Guided by buildpack maintainers"
    learning_curve: "Low - minimal configuration needed"
    flexibility: "Limited to buildpack capabilities"
    maintenance: "Automated - buildpack updates handle it"
    security: "Automated - CVE patching by buildpack team"

# Detailed technical comparison
build_stages:
  dockerfile:
    stages:
      1_parse:
        description: "Parse Dockerfile instructions"
        complexity: "Simple text parsing"

      2_execute:
        description: "Execute each instruction sequentially"
        process: "Layer-by-layer with caching"

      3_optimize:
        description: "Manual multi-stage builds"
        responsibility: "Developer"

      4_package:
        description: "Final image assembly"
        control: "Complete control"

  buildpacks:
    stages:
      1_detect:
        description: "Auto-detect application type"
        process: "Run detect phase of buildpacks"

      2_analyze:
        description: "Analyze previous image for reuse"
        optimization: "Automatic layer reuse"

      3_build:
        description: "Execute buildpack build phases"
        process: "Stacked buildpack execution"

      4_export:
        description: "Create OCI image"
        format: "Standardized layer structure"

# Dockerfile - Manual Layer Control
FROM golang:1.21-alpine AS deps
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
# Layer 1: Base image
# Layer 2: WORKDIR
# Layer 3: COPY dependencies
# Layer 4: Download dependencies

FROM deps AS builder
COPY . .
RUN go build -o app
# Layer 5: COPY source
# Layer 6: Build binary

FROM alpine:3.18
COPY --from=builder /src/app /app
# Layer 7: Runtime base
# Layer 8: Copy binary

# Buildpack Layer Structure (Automatic)
layers:
  - name: "paketo-buildpacks/ca-certificates"
    purpose: "System CA certificates"
    cached: true

  - name: "paketo-buildpacks/go-dist"
    purpose: "Go distribution"
    cached: true
    version: "1.21.5"

  - name: "paketo-buildpacks/go-mod-vendor"
    purpose: "Go dependencies"
    cached: true

  - name: "paketo-buildpacks/go-build"
    purpose: "Compiled application"
    cached: false

  - name: "paketo-buildpacks/go-runtime"
    purpose: "Runtime configuration"
    cached: false

# Each layer has metadata for intelligent caching
layer_metadata:
  types:
    launch: true
    build: false
    cache: true

# Complex production Dockerfile
# syntax=docker/dockerfile:1.4

ARG GO_VERSION=1.21
ARG ALPINE_VERSION=3.18

# Build stage
FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS builder

# Security hardening
RUN apk add --no-cache \
    ca-certificates \
    git \
    && adduser -D -g '' appuser

WORKDIR /build

# Dependency caching
COPY go.mod go.sum ./
RUN --mount=type=cache,target=/go/pkg/mod \
    go mod download

# Build with optimization
COPY . .
RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    CGO_ENABLED=0 \
    GOOS=linux \
    GOARCH=amd64 \
    go build \
    -ldflags="-w -s -X main.version=$(git describe --tags)" \
    -o app

# Runtime stage
FROM alpine:${ALPINE_VERSION}

# Runtime dependencies
RUN apk add --no-cache \
    ca-certificates \
    tzdata \
    && adduser -D -g '' appuser

# Copy binary
COPY --from=builder /build/app /app
COPY --from=builder /etc/passwd /etc/passwd

# Security settings
USER appuser
WORKDIR /home/appuser

# Health check
HEALTHCHECK --interval=30s --timeout=3s \
  CMD ["/app", "healthcheck"]

EXPOSE 8080

ENTRYPOINT ["/app"]

# project.toml - Buildpacks Configuration
[_]
schema-version = "0.2"

[io.buildpacks]
include = [
    "cmd/",
    "internal/",
    "pkg/",
    "go.mod",
    "go.sum"
]

[[io.buildpacks.group]]
uri = "docker://gcr.io/paketo-buildpacks/go:latest"

[[io.buildpacks.group]]
uri = "docker://gcr.io/paketo-buildpacks/ca-certificates:latest"

[io.buildpacks.build]
env = [
    { name = "BP_GO_VERSION", value = "1.21.*" },
    { name = "BP_GO_BUILD_FLAGS", value = "-ldflags='-w -s'" },
    { name = "BP_GO_BUILD_TARGETS", value = "./cmd/app" }
]

[[io.buildpacks.build.processes]]
type = "web"
command = "app"
args = []
default = true

#!/bin/bash
# build-performance-test.sh - Compare build performance

set -euo pipefail

export APP_DIR="./sample-app"
export IMAGE_NAME="performance-test"
export ITERATIONS=10

echo "=== Build Performance Comparison ==="

# Test 1: Cold build (no cache)
echo -e "\n--- Cold Build Test ---"

# Dockerfile cold build
docker build --no-cache -t ${IMAGE_NAME}:dockerfile ${APP_DIR} 2>&1 | \
  grep "Successfully built" | \
  awk '{print "Dockerfile cold: " $NF}'

# Buildpacks cold build
pack build ${IMAGE_NAME}:buildpacks \
  --builder paketobuildpacks/builder:base \
  --clear-cache \
  --path ${APP_DIR} 2>&1 | \
  grep "Successfully built" | \
  awk '{print "Buildpacks cold: " $NF}'

# Test 2: Cached builds
echo -e "\n--- Cached Build Test ---"

dockerfile_times=()
buildpacks_times=()

for i in $(seq 1 $ITERATIONS); do
  # Dockerfile cached build
  start=$(date +%s)
  docker build -t ${IMAGE_NAME}:dockerfile ${APP_DIR} &>/dev/null
  end=$(date +%s)
  dockerfile_times+=($((end - start)))

  # Buildpacks cached build
  start=$(date +%s)
  pack build ${IMAGE_NAME}:buildpacks \
    --builder paketobuildpacks/builder:base \
    --path ${APP_DIR} &>/dev/null
  end=$(date +%s)
  buildpacks_times+=($((end - start)))

  echo "Iteration $i complete"
done

# Calculate averages
avg_dockerfile=$(IFS=+; echo "scale=2; (${dockerfile_times[*]})/$ITERATIONS" | bc)
avg_buildpacks=$(IFS=+; echo "scale=2; (${buildpacks_times[*]})/$ITERATIONS" | bc)

echo -e "\n--- Results ---"
echo "Dockerfile average: ${avg_dockerfile}s"
echo "Buildpacks average: ${avg_buildpacks}s"

# Test 3: Image size comparison
echo -e "\n--- Image Size Comparison ---"
docker images ${IMAGE_NAME}:dockerfile --format "Dockerfile: {{.Size}}"
docker images ${IMAGE_NAME}:buildpacks --format "Buildpacks: {{.Size}}"

# Test 4: Layer count
echo -e "\n--- Layer Count ---"
echo "Dockerfile layers: $(docker history ${IMAGE_NAME}:dockerfile --format '{{.ID}}' | wc -l)"
echo "Buildpacks layers: $(docker history ${IMAGE_NAME}:buildpacks --format '{{.ID}}' | wc -l)"

# Real-world performance data (Node.js application)
performance_metrics:
  build_times:
    cold_build:
      dockerfile: "245s"
      buildpacks: "312s"
      winner: "Dockerfile (-21%)"

    cached_build:
      dockerfile: "18s"
      buildpacks: "12s"
      winner: "Buildpacks (-33%)"

    dependency_change:
      dockerfile: "45s"
      buildpacks: "32s"
      winner: "Buildpacks (-29%)"

    code_change_only:
      dockerfile: "15s"
      buildpacks: "8s"
      winner: "Buildpacks (-47%)"

  image_sizes:
    dockerfile_optimized: "45MB"
    dockerfile_unoptimized: "892MB"
    buildpacks: "156MB"

    notes: "Dockerfile can be smaller with manual optimization"

  cache_efficiency:
    dockerfile:
      hit_rate: "65%"
      notes: "Depends on layer ordering"

    buildpacks:
      hit_rate: "85%"
      notes: "Intelligent layer management"

  resource_usage:
    dockerfile:
      cpu: "2.3 cores average"
      memory: "1.8GB peak"

    buildpacks:
      cpu: "2.1 cores average"
      memory: "2.2GB peak"

# Dockerfile caching
dockerfile_caching:
  strategy: "Sequential layer caching"

  effectiveness:
    - "Invalidated by any change above"
    - "Requires careful instruction ordering"
    - "Manual optimization needed"

  example:
    efficient: |
      COPY go.mod go.sum ./
      RUN go mod download
      COPY . .
      RUN go build

    inefficient: |
      COPY . .
      RUN go mod download
      RUN go build

# Buildpacks caching
buildpacks_caching:
  strategy: "Content-addressable layers"

  effectiveness:
    - "Each layer independently cached"
    - "Automatic dependency detection"
    - "No manual optimization needed"

  features:
    - "Dependency layers separate from source"
    - "Build tools cached independently"
    - "Metadata-driven cache decisions"

# Dockerfile - Manual security management
FROM golang:1.21-alpine AS builder

# Developer must track and update versions
RUN apk add --no-cache \
    ca-certificates@3.18.1-r0 \
    git@2.40.1-r0

# Manual base image updates required
FROM alpine:3.18

# Periodic rebuilds needed for CVE fixes
RUN apk upgrade --no-cache

#!/bin/bash
# dockerfile-security-maintenance.sh

# Regular tasks required:
# 1. Monitor base image CVEs
# 2. Update base image versions
# 3. Rebuild all images
# 4. Test and deploy

# Scan for vulnerabilities
trivy image myapp:latest --severity HIGH,CRITICAL

# Manual remediation required
# - Update Dockerfile
# - Rebuild image
# - Redeploy application

# Buildpacks - Automated security management

# Build with current buildpacks
pack build myapp --builder paketobuildpacks/builder:base

# Buildpack maintainers handle:
# - Base image security updates
# - Dependency vulnerability fixes
# - CVE patching

# Rebase without rebuild
pack rebase myapp --builder paketobuildpacks/builder:base

# Only updates base layers, preserving application layers
# Much faster than full rebuild
# Maintains exact same application code

security_aspects:
  base_image_updates:
    dockerfile:
      frequency: "Manual - when developer notices"
      effort: "High - requires rebuild and retest"
      risk: "High - may be delayed"

    buildpacks:
      frequency: "Automatic - buildpack updates"
      effort: "Low - rebase operation"
      risk: "Low - continuous updates"

  dependency_scanning:
    dockerfile:
      implementation: "Manual integration"
      tools: "Trivy, Grype, Snyk, etc."
      blocking: "Developer must configure"

    buildpacks:
      implementation: "Built-in SBoM generation"
      tools: "CycloneDX/SPDX format"
      blocking: "Configurable in builder"

  minimal_attack_surface:
    dockerfile:
      control: "Complete control"
      optimization: "Requires expertise"
      result: "Can be very minimal"
      example: "Distroless, scratch images"

    buildpacks:
      control: "Builder-determined"
      optimization: "Automatic"
      result: "Reasonably minimal"
      example: "Bionic Beaver or Alpine-based"

  supply_chain_security:
    dockerfile:
      reproducibility: "Challenging"
      attestation: "Manual implementation"
      sbom: "Manual generation"

    buildpacks:
      reproducibility: "Built-in"
      attestation: "Standard metadata"
      sbom: "Automatic generation"

#!/bin/bash
# generate-dockerfile-sbom.sh - Manual SBoM generation

# Use Syft for SBoM generation
syft packages docker:myapp:latest -o cyclonedx-json > sbom.json

# Or use Docker's built-in (experimental)
docker sbom myapp:latest --format cyclonedx-json > sbom.json

# Buildpacks automatic SBoM
pack inspect myapp --bom

# SBoM automatically included in image metadata
# Multiple formats supported:
# - CycloneDX
# - SPDX
# - Syft

# Extract SBoM
pack sbom download myapp --output-dir ./sbom/

developer_workflows:
  dockerfile:
    learning_curve:
      time: "2-3 weeks for basics"
      expertise: "Months for optimization"

    workflow:
      1_write_dockerfile:
        complexity: "Medium to High"
        knowledge_required:
          - "Container concepts"
          - "Linux system administration"
          - "Build optimization"
          - "Security best practices"

      2_build_image:
        command: "docker build -t myapp ."
        debugging: "Can be challenging"

      3_optimize:
        responsibility: "Developer"
        effort: "Significant"

      4_maintain:
        updates: "Manual monitoring required"
        security: "Developer responsibility"

  buildpacks:
    learning_curve:
      time: "1-2 hours for basics"
      expertise: "Days for advanced features"

    workflow:
      1_configure:
        complexity: "Low"
        knowledge_required:
          - "Basic application structure"
          - "Optional: buildpack configuration"

      2_build_image:
        command: "pack build myapp"
        debugging: "Clear detection errors"

      3_optimize:
        responsibility: "Buildpack maintainers"
        effort: "Minimal"

      4_maintain:
        updates: "Automatic with rebuilds"
        security: "Buildpack team responsibility"

# .gitlab-ci.yml - Dockerfile approach
stages:
  - build
  - scan
  - deploy

variables:
  IMAGE_NAME: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA

build:
  stage: build
  image: docker:latest
  services:
    - docker:dind
  script:
    - docker build -t $IMAGE_NAME .
    - docker push $IMAGE_NAME
  cache:
    key: $CI_COMMIT_REF_SLUG
    paths:
      - .docker/

security-scan:
  stage: scan
  image: aquasec/trivy:latest
  script:
    - trivy image --severity HIGH,CRITICAL $IMAGE_NAME
  allow_failure: false

deploy:
  stage: deploy
  image: bitnami/kubectl:latest
  script:
    - kubectl set image deployment/myapp myapp=$IMAGE_NAME

# .gitlab-ci.yml - Buildpacks approach
stages:
  - build
  - deploy

variables:
  IMAGE_NAME: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA

build:
  stage: build
  image: buildpacksio/pack:latest
  script:
    - pack build $IMAGE_NAME --builder paketobuildpacks/builder:base --publish
  cache:
    key: buildpacks-cache
    paths:
      - $HOME/.pack/

  # SBoM automatically generated
  # Security scanning built into buildpacks
  # No separate scan stage needed

deploy:
  stage: deploy
  image: bitnami/kubectl:latest
  script:
    - kubectl set image deployment/myapp myapp=$IMAGE_NAME

# Separate Dockerfile per language
# Dockerfile.golang
FROM golang:1.21-alpine
...

# Dockerfile.nodejs
FROM node:20-alpine
...

# Dockerfile.python
FROM python:3.11-slim
...

# Single builder, auto-detection
pack build golang-app --builder paketobuildpacks/builder:base
pack build nodejs-app --builder paketobuildpacks/builder:base
pack build python-app --builder paketobuildpacks/builder:base

# Or composite buildpack for monorepo
pack build monorepo-app \
  --builder paketobuildpacks/builder:full \
  --buildpack paketo-buildpacks/nodejs \
  --buildpack paketo-buildpacks/go

#!/bin/bash
# migrate-to-buildpacks.sh - Gradual migration script

set -euo pipefail

export APP_DIR="${1:-.}"
export BUILDER="paketobuildpacks/builder:base"

echo "=== Buildpacks Migration Tool ==="

# Step 1: Analyze current Dockerfile
echo "Analyzing current Dockerfile..."
if [ -f "$APP_DIR/Dockerfile" ]; then
  # Extract key information
  BASE_IMAGE=$(grep "^FROM" $APP_DIR/Dockerfile | head -1 | awk '{print $2}')
  echo "Current base image: $BASE_IMAGE"

  # Detect language
  if grep -q "golang" $APP_DIR/Dockerfile; then
    LANG="Go"
  elif grep -q "node" $APP_DIR/Dockerfile; then
    LANG="Node.js"
  elif grep -q "python" $APP_DIR/Dockerfile; then
    LANG="Python"
  else
    LANG="Unknown"
  fi
  echo "Detected language: $LANG"
fi

# Step 2: Test buildpacks build
echo -e "\nTesting buildpacks build..."
pack build test-migration \
  --builder $BUILDER \
  --path $APP_DIR \
  --env BP_LOG_LEVEL=debug

if [ $? -eq 0 ]; then
  echo "✓ Buildpacks build successful"
else
  echo "✗ Buildpacks build failed"
  echo "Manual intervention required"
  exit 1
fi

# Step 3: Compare images
echo -e "\nComparing images..."
docker build -t test-dockerfile $APP_DIR

DOCKERFILE_SIZE=$(docker images test-dockerfile --format "{{.Size}}")
BUILDPACKS_SIZE=$(docker images test-migration --format "{{.Size}}")

echo "Dockerfile image size: $DOCKERFILE_SIZE"
echo "Buildpacks image size: $BUILDPACKS_SIZE"

# Step 4: Generate project.toml
echo -e "\nGenerating project.toml..."
cat > $APP_DIR/project.toml <<EOF
[_]
schema-version = "0.2"

[io.buildpacks]
builder = "$BUILDER"

[[io.buildpacks.group]]
uri = "docker://gcr.io/paketo-buildpacks/$LANG:latest"

[io.buildpacks.build]
env = []

[[io.buildpacks.build.processes]]
type = "web"
command = "app"
default = true
EOF

echo "✓ Migration configuration created"

# Step 5: Create parallel CI/CD pipeline
echo -e "\nGenerating parallel CI/CD configuration..."
cat > $APP_DIR/.gitlab-ci-buildpacks.yml <<'EOF'
# Parallel pipeline for comparison
build:dockerfile:
  stage: build
  script:
    - docker build -t $IMAGE_NAME:dockerfile .
  only:
    - branches

build:buildpacks:
  stage: build
  script:
    - pack build $IMAGE_NAME:buildpacks --builder paketobuildpacks/builder:base
  only:
    - branches

compare:
  stage: test
  script:
    - ./compare-images.sh $IMAGE_NAME:dockerfile $IMAGE_NAME:buildpacks
  dependencies:
    - build:dockerfile
    - build:buildpacks
EOF

echo "✓ Parallel CI/CD configuration created"
echo -e "\nMigration preparation complete!"
echo "Next steps:"
echo "1. Review project.toml configuration"
echo "2. Test builds locally"
echo "3. Enable parallel CI/CD pipeline"
echo "4. Monitor and compare results"
echo "5. Switch to buildpacks when confident"

# migration-phases.yaml
migration_strategy:
  phase_1_evaluation:
    duration: "2 weeks"
    activities:
      - Assess current Dockerfile complexity
      - Test buildpacks with sample applications
      - Evaluate builder options
      - Performance testing

    success_criteria:
      - Buildpacks can build all application types
      - Performance acceptable
      - Security requirements met

  phase_2_pilot:
    duration: "1 month"
    activities:
      - Select 2-3 pilot applications
      - Implement parallel builds
      - Monitor production performance
      - Gather team feedback

    success_criteria:
      - No production issues
      - Developer satisfaction
      - Operational metrics equivalent

  phase_3_rollout:
    duration: "3 months"
    activities:
      - Migrate applications by priority
      - Update CI/CD pipelines
      - Train development teams
      - Document standards

    success_criteria:
      - 80% of applications migrated
      - Reduced maintenance burden
      - Improved security posture

  phase_4_optimization:
    duration: "Ongoing"
    activities:
      - Custom buildpack development
      - Builder customization
      - Process refinement
      - Continuous improvement

# Dockerfile with buildpacks base
FROM paketobuildpacks/run:base-cnb

# Add custom configuration
COPY custom-ca.crt /etc/ssl/certs/
RUN update-ca-certificates

# Add custom tools
RUN apt-get update && apt-get install -y \
    custom-monitoring-agent

# Use buildpack-built layers
COPY --from=app /layers /layers
COPY --from=app /workspace /workspace

# Custom entrypoint
COPY entrypoint.sh /
RUN chmod +x /entrypoint.sh

ENTRYPOINT ["/entrypoint.sh"]

#!/bin/bash
# Custom buildpack - bin/detect

set -e

# Check if application should use this buildpack
if [[ -f go.mod ]] && [[ -f internal/custom/config.yaml ]]; then
  echo "Custom Go Buildpack"
  exit 0
else
  exit 100
fi

#!/bin/bash
# Custom buildpack - bin/build

set -e

layers_dir="$1"
platform_dir="$2"
plan_path="$3"

# Custom build logic
echo "Building with custom requirements..."

# Reuse standard Go buildpack
/cnb/buildpacks/paketo-buildpacks_go/bin/build "$@"

# Add custom layers
custom_layer="$layers_dir/custom-config"
mkdir -p "$custom_layer"

# Install custom tools
echo "Installing custom monitoring..."
cp internal/custom/monitor "$custom_layer/"

# Layer metadata
cat > "$custom_layer.toml" <<EOF
launch = true
build = false
cache = false
EOF

echo "Custom buildpack complete"

# builder.toml - Custom builder definition
[_]
schema-version = "0.1"

[buildpacks]
  [[buildpacks.groups]]
    [[buildpacks.groups.buildpacks]]
      id = "paketo-buildpacks/ca-certificates"
      version = "3.6.3"

    [[buildpacks.groups.buildpacks]]
      id = "custom/monitoring-agent"
      version = "1.0.0"

    [[buildpacks.groups.buildpacks]]
      id = "paketo-buildpacks/go"
      version = "4.5.0"

[stack]
  id = "io.buildpacks.stacks.bionic"
  build-image = "paketobuildpacks/build:base-cnb"
  run-image = "paketobuildpacks/run:base-cnb"

[lifecycle]
  version = "0.17.0"

# Build custom builder
pack builder create my-company/builder:latest --config builder.toml

# Use custom builder
pack build myapp --builder my-company/builder:latest

# buildpacks-platform.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: buildpacks-platform
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: buildpacks-config
  namespace: buildpacks-platform
data:
  builders.yaml: |
    builders:
      - name: "base"
        image: "paketobuildpacks/builder:base"
        default: true

      - name: "full"
        image: "paketobuildpacks/builder:full"

      - name: "tiny"
        image: "paketobuildpacks/builder:tiny"

      - name: "custom"
        image: "my-company/builder:latest"

  build-config.yaml: |
    # Default build configuration
    cache:
      enabled: true
      volume:
        size: "10Gi"
        storageClass: "fast-ssd"

    resources:
      requests:
        cpu: "2000m"
        memory: "4Gi"
      limits:
        cpu: "4000m"
        memory: "8Gi"

    timeout: "30m"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: buildpacks-api
  namespace: buildpacks-platform
spec:
  replicas: 3
  selector:
    matchLabels:
      app: buildpacks-api
  template:
    metadata:
      labels:
        app: buildpacks-api
    spec:
      serviceAccountName: buildpacks-api
      containers:
      - name: api
        image: my-company/buildpacks-api:latest
        ports:
        - containerPort: 8080
        env:
        - name: BUILDERS_CONFIG
          value: /config/builders.yaml
        - name: BUILD_CONFIG
          value: /config/build-config.yaml
        volumeMounts:
        - name: config
          mountPath: /config
        resources:
          requests:
            cpu: 500m
            memory: 512Mi
          limits:
            cpu: 1000m
            memory: 1Gi
      volumes:
      - name: config
        configMap:
          name: buildpacks-config
---
apiVersion: v1
kind: Service
metadata:
  name: buildpacks-api
  namespace: buildpacks-platform
spec:
  selector:
    app: buildpacks-api
  ports:
  - port: 80
    targetPort: 8080
  type: LoadBalancer

#!/bin/bash
# buildpacks-build-service.sh - Automated build orchestration

set -euo pipefail

# Configuration
export BUILDERS_API="http://buildpacks-api.buildpacks-platform"
export REGISTRY="gcr.io/my-project"
export CACHE_REGISTRY="gcr.io/my-project/cache"

# Function to trigger build
build_application() {
  local app_name=$1
  local git_ref=$2
  local builder=$3

  echo "Building $app_name @ $git_ref with $builder"

  # Create build job
  kubectl create job "build-${app_name}-$(date +%s)" \
    -n buildpacks-platform \
    --image=buildpacksio/pack:latest \
    -- pack build "${REGISTRY}/${app_name}:${git_ref}" \
      --builder "${builder}" \
      --publish \
      --cache-image "${CACHE_REGISTRY}/${app_name}" \
      --network host \
      --env "GIT_REF=${git_ref}"
}

# Webhook handler
handle_webhook() {
  local payload=$1

  # Parse webhook payload
  app_name=$(echo "$payload" | jq -r '.repository.name')
  git_ref=$(echo "$payload" | jq -r '.ref' | cut -d'/' -f3)

  # Detect builder
  builder=$(curl -s "$BUILDERS_API/detect?app=$app_name" | jq -r '.builder')

  # Trigger build
  build_application "$app_name" "$git_ref" "$builder"
}

# Main webhook endpoint
while true; do
  # Listen for webhooks
  nc -l -p 9000 -c "handle_webhook"
done

# Pack CLI - Primary buildpacks tool
pack build myapp --builder paketobuildpacks/builder:base
pack rebase myapp
pack inspect myapp
pack sbom download myapp

# Tekton Buildpacks Task
tkn task start buildpacks \
  --param IMAGE=gcr.io/project/app \
  --param BUILDER_IMAGE=paketobuildpacks/builder:base \
  --workspace name=source,claimName=source-pvc

# kpack - Kubernetes-native Buildpacks
kubectl apply -f - <<EOF
apiVersion: kpack.io/v1alpha2
kind: Image
metadata:
  name: myapp
spec:
  tag: gcr.io/project/myapp
  builder:
    name: default-builder
    kind: Builder
  source:
    git:
      url: https://github.com/org/myapp
      revision: main
EOF

# Spring Boot Maven Plugin
mvn spring-boot:build-image \
  -Dspring-boot.build-image.builder=paketobuildpacks/builder:base

# Docker BuildKit
docker buildx build \
  --platform linux/amd64,linux/arm64 \
  --cache-from type=registry,ref=myapp:cache \
  --cache-to type=registry,ref=myapp:cache,mode=max \
  -t myapp:latest \
  --push .

# Kaniko - Kubernetes builds
kubectl run kaniko \
  --image=gcr.io/kaniko-project/executor:latest \
  --rm -it --restart=Never \
  --overrides='{...}'

# Buildah - Daemonless builds
buildah bud -t myapp:latest .
buildah push myapp:latest docker://registry/myapp:latest

# Podman - Docker alternative
podman build -t myapp:latest .
podman push myapp:latest

decision_matrix:
  choose_dockerfile_when:
    control_requirements:
      - Need specific base image
      - Custom optimization required
      - Specific layer structure needed
      - Advanced caching strategies

    technical_requirements:
      - Multi-stage builds with complex logic
      - Custom build tools
      - Specific OS packages required
      - Non-standard application structure

    organizational:
      - Team has container expertise
      - Existing Dockerfile investment
      - Custom security scanning
      - Regulatory base image requirements

  choose_buildpacks_when:
    automation_priorities:
      - Automated security updates important
      - Minimal maintenance desired
      - Standard application patterns
      - Multiple similar applications

    developer_experience:
      - Reduce complexity for developers
      - Standardize across teams
      - Onboard developers quickly
      - Focus on application code

    security_priorities:
      - Automated CVE patching
      - SBoM generation required
      - Compliance automation
      - Supply chain security

  hybrid_approach_when:
    requirements:
      - Need both control and automation
      - Gradual migration
      - Custom extensions to standard builds
      - Team expertise varies

## Dockerfile Implementation
- [ ] Design multi-stage build strategy
- [ ] Implement build argument patterns
- [ ] Configure BuildKit features
- [ ] Optimize layer caching
- [ ] Add security scanning
- [ ] Generate SBoM
- [ ] Document base image updates
- [ ] Create maintenance runbooks
- [ ] Setup automated rebuilds
- [ ] Configure registry mirroring

## Buildpacks Implementation
- [ ] Select appropriate builder
- [ ] Configure project.toml
- [ ] Test application detection
- [ ] Configure build environment
- [ ] Setup cache strategy
- [ ] Integrate with CI/CD
- [ ] Configure rebase automation
- [ ] Setup monitoring
- [ ] Document extension points
- [ ] Plan custom buildpack needs

## Hybrid Implementation
- [ ] Identify applications for each approach
- [ ] Create migration plan
- [ ] Develop custom buildpacks
- [ ] Build custom builder
- [ ] Setup parallel pipelines
- [ ] Compare performance
- [ ] Train development teams
- [ ] Document decision criteria
- [ ] Establish governance
- [ ] Monitor and optimize