A purpose-built image for building and pushing container images via remote BuildKit daemons. It carries only what is needed for this role — no Docker Engine daemon and no general build toolchains.
Published to Docker Hub as zappi/image-builder. Built for linux/amd64 and linux/arm64.
| Component | Version |
|---|---|
| Base image | Ubuntu 24.04 LTS |
| Git | distro package |
| Git LFS | distro package |
| OpenSSH client | distro package |
| Docker CLI | 29.3.0 |
| Docker Buildx plugin | 0.31.1 |
| Amazon ECR Credential Helper | 0.12.0 |
git, git-lfs and OpenSSH client tools are included as part of the
builder toolchain.
The image runs as a non-root builder user (UID/GID 65533).
No ~/.docker/config.json is baked into the image. It is expected to be provided at runtime — for example, mounted via a Kubernetes ConfigMap.
The config should wire the ECR credential helper for the registries the builder needs to authenticate with:
{
"credHelpers": {
"public.ecr.aws": "ecr-login",
"<account-id>.dkr.ecr.<region>.amazonaws.com": "ecr-login"
}
}The ECR credential helper (docker-credential-ecr-login) is already present in the image. It follows the standard AWS credential chain, so no static credentials need to be baked into the image.
Images are tagged and pushed to Docker Hub on every GitHub Release. Tags follow the version in the release (e.g. zappi/image-builder:1.0.0).