rules_docker VS cargo-chef

My company uses Bazel's rules docker to build our images: https://github.com/bazelbuild/rules_docker

They're pretty great and have a lot of the caching and parallelism benefits mentioned in the post for free out of the box, along with determinism (which Docker files don't have because you can run arbitrary shell commands). Our backend stack is also built with Bazel so we get a nice tight integration to build our images that is pretty straightforward.

We've also built some nice tooling around this to automatically put our maven dependencies into different layers using Bazel query and buildozer. Since maven deps don't change often we get a lot of nice caching advantages.

I've seen rules_docker is looking for maintainers here ; Does this mean it doesn't use it that much internally? If so, how do they go about using other services e.g docker-compose for running external services e.g database?

Did you mean this one? https://github.com/bazelbuild/rules_docker

I was very interested in this Bazel-based way of building containers but its README page says "it is on minimal life support," which does not inspire confidence. How's your experience using it?

As others have said docker in docker or a separate build server are your best options using docker. You can also use Bazel (which doesn't require the docker daemon) to build docker images which will build deterministic images every time due to not incorporating the timestamp: https://github.com/bazelbuild/rules_docker

There's some BazelCon talks about people doing similar stuff but not actually open sourcing their code.

P.S. if you use rules_docker please feel free to open a PR to add your company to our README: https://github.com/bazelbuild/rules_docker/#adopters

The docker utility isn't the only way to build and run containers. There's also cri-o, podman, and crun among others for running containers. For building there is podman again, Jib for Java applications, and bazel plus many others. The docker approach of using a client to connect to a daemon required to run as root has turned out to be slow and insecure.

During the last 3 years I've had the pleasure of using Bazel's rules_docker to generate all my container images (https://github.com/bazelbuild/rules_docker).

In a nutshell, rules_docker is a set of build rules for the Bazel build system (https://bazel.build). What's pretty nice about these rules is that they don't rely on a Docker daemon. They are rules that directly construct image tarballs that you can either load into your local Docker daemon or push to a registry.

What's nice about this approach is that image generation works on any operating system. For example, even on a Mac or Windows system that doesn't have Docker installed, you're able to build Linux containers. They are also fully reproducible, meaning that you often don't need to upload layers when pushing (either because they haven't changed, or because some colleague/CI job already pushed those layers).

I guess rules_docker works fine for a variety of programming languages. I've mainly used it with Go, though.

CI time. Do you want to micromanage your own docker images for all your CI? Great! If not, yes you do. In fact, you want to manage a docker image to build a docker image to use for CI. Use cargo-chef to prepare a build image with your dependencies pre-built if you want to do fine-grained build/test pipelines. Oh also, there's no jUnit test report generation, that was killed off today. (YES, SORRY, I'm still salty.)

Have you looked at cargo-chef? It supposedly speeds up compilation times if you're using Docker.

A tool already exists for this called Cargo-chef, and it works extremely well.

At work I've use Dockerfile and cargo-chef to improve build times. You can also look into buildkit cache mounts, but this approach is rarely super effective on hosted CI because they start from scratch on most runs. In the context of Rust specifically you may also see the target directory reflect unbounded data growth if it's reused over and over across revisions. because cargo by default won't expire older intermediate artifacts. Cargo-sweep can help with that but I wouldn't pursue this in a CI effort. This will affect both "native" builds and buildkit cache mounts if you're persisting the target directory.

We create an empty Rust binary with cargo new, this is a simple way to get Docker layer caching to work. For a more robust solution, you may want to check out cargo-chef.

If this ends up being a cleaner/easier way to having to workaround super expensive rebuilds for Rust given cache + deps compared to this https://github.com/LukeMathWalker/cargo-chef , reading this thread will have been a huge win for me (and hopefully others).

Whether introducing Bazel is easier/worth it, subjective I guess.

I did a talk (slides here) about this a few years ago, it took a bit of work to get the build caching working with cargo. As others have pointed out, there is now cargo chef to solve this problem so you probably don't have to deal with the issues I saw, but I thought it still might be helpful context.

I'm curious if you've tried out cargo-chef, I've had some decent improvements with it but I wonder how it stacks up to the sccache approach (don't have the time to try it out myself right now).

for CI have you tried to use buildkit persistent runners with caching + https://github.com/LukeMathWalker/cargo-chef ?

If you're deploying Rust with Docker I can tell you that cargo-chef is invaluable. With zero work it caches the dependency fetch and compilation steps. Most of the time the ens Docker deploy is closer to an incremental compile than full.