delonix build

Constrói uma imagem a partir de um Dockerfile ou Delonixfile.

Builds an image from a Dockerfile or Delonixfile.

Build sem daemon nem BuildKit: sobe um container de trabalho por estágio, corre cada RUN por exec, aplica COPY no rootfs (confinado ao contexto — path traversal é rejeitado) e empacota o resultado. Sem -f, procura primeiro um Delonixfile no contexto e só depois um Dockerfile — a gramática é a mesma, com extensões (SCAN, CPUS, MEMORY, SECURITY, HEALTHCHECK). Multi-stage suportado (FROM ... AS <nome> + COPY --from=<estágio>); limitação conhecida: em modo root (overlay), o estágio final ainda tem de ser uma imagem real, não outro estágio (sem lineage OCI para um estágio clonado) — sem restrição em rootless. ARG/--build-arg e USER/ENTRYPOINT já sobrevivem ao build (incluindo em rootless). Cache de camadas por instrução (rootless — um RUN/COPY repetido não re-executa; --no-cache para saltar; modo root continua sem cache). Sem BuildKit real (sem RUN --mount=secret, sem --platform).

Build with no daemon and no BuildKit: it spins up one working container per stage, runs each RUN via exec, applies COPY to the rootfs (confined to the build context — path traversal is rejected) and packages the result. Without -f, it looks for a Delonixfile in the context first and only then a Dockerfile — same grammar, with extensions (SCAN, CPUS, MEMORY, SECURITY, HEALTHCHECK). Multi-stage supported (FROM ... AS <name> + COPY --from=<stage>); known limitation: in root mode (overlay), the final stage still has to be a real image, not another stage (no OCI lineage for a cloned stage) — no such restriction in rootless. ARG/--build-arg and USER/ENTRYPOINT already survive the build (including in rootless). Per-instruction layer cache (rootless — a repeated RUN/COPY doesn't re-execute; --no-cache to skip it; root mode still has no cache). No real BuildKit (no RUN --mount=secret, no --platform).

📄 Implementação real em Rust: cmd/build.rs

Usage: delonix build [OPTIONS] --tag <TAG> [CONTEXT]

Arguments:
  [CONTEXT]
          Build context (default: `.`) — root for `COPY`
          
          [default: .]

Options:
  -f, --file <FILE>
          Path of the Dockerfile (default: `<context>/Dockerfile`)

      --l18n <en|pt>
          Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand

  -t, --tag <TAG>
          Tag of the resulting image (`repo:tag`)

      --build-arg <BUILD_ARG>
          Build-time variable (`KEY=VALUE`), repeatable — only takes effect for a name the Dockerfile actually declares with `ARG KEY[=default]` (an override with no matching `ARG` is silently ignored, same as Docker)

      --no-cache
          Bypasses the layer cache entirely (neither reads nor writes it) — same as Docker's `--no-cache`

      --secret <SECRET>
          `id=<name>,src=<path>` — a secret a `RUN --mount=type=secret,id=<name>` can bind-mount for the duration of that one instruction (never baked into a layer). Repeatable

      --platform <PLATFORM>
          `linux/<arch>` (e.g. `linux/arm64`) — cross-arch build. Resolves the correct-arch base image and stamps it into the result; actually running a foreign-arch `RUN` needs the host's own binfmt_misc/qemu-user-static already registered (not managed by delonix — a clear preflight error names the missing interpreter instead of a confusing mid-build failure)

      --target <TARGET>
          Name or index of a `FROM ... AS <name>` stage to stop the build at and package as the result, instead of the Dockerfile's own final stage. Only the stages the target itself needs (everything at or before it, in file order) are built — later stages are skipped entirely

  -h, --help
          Print help (see a summary with '-h')

EXAMPLES:
  # build and tag from the Dockerfile in this directory
  delonix build -t myapp:v1 .

  # a Delonixfile, or any other build file path
  delonix build -t myapp:v1 -f Delonixfile .

  # a build secret, bind-mounted live for one `RUN` and structurally unable to
  # reach a layer
  delonix build -t myapp:v1 --secret id=npmrc,src=/home/me/.npmrc .

  # cross-arch: resolves the right base image and stamps the arch into the
  # result
  delonix build -t myapp:v1 --platform linux/arm64 .

SEE ALSO:
  delonix image ls · delonix image push · delonix container run · delonix init

  delonix › build

ExemplosExamples

Build com tag

Build with a tag

delonix build -t minha-app:1.0 .

Delonixfile explícito

Explicit Delonixfile

delonix build -t api:dev -f Delonixfile ./servico

LaboratórioLab

Escreve um Delonixfile multi-stage pequeno e constrói-o — sem daemon, sem BuildKit.

printf 'FROM golang:1.22 AS build\nWORKDIR /src\nCOPY . .\nRUN go build -o app\n\nFROM alpine\nCOPY --from=build /src/app /app\nENTRYPOINT ["/app"]\n' > Delonixfile
delonix build -t minha-app .
delonix container run --rm minha-app

Write a small multi-stage Delonixfile and build it — no daemon, no BuildKit.

printf 'FROM golang:1.22 AS build\nWORKDIR /src\nCOPY . .\nRUN go build -o app\n\nFROM alpine\nCOPY --from=build /src/app /app\nENTRYPOINT ["/app"]\n' > Delonixfile
delonix build -t my-app .
delonix container run --rm my-app

DesafioChallenge

Passa um segredo com --secret id=token,src=./token.txt e usa RUN --mount=type=secret,id=token dentro de uma instrução. Depois de o build terminar, confirma que o valor NÃO está na imagem final (nem sequer um ficheiro vazio).

Pass a secret with --secret id=token,src=./token.txt and use RUN --mount=type=secret,id=token in one instruction. After the build finishes, confirm the value is NOT in the final image (not even an empty file).