A purpose-built image for building and pushing container images via remote BuildKit daemons. It carries only what is needed for this role — no Docker Engine daemon, no git, no build toolchains.
Published to Docker Hub as zappi/image-builder. Built for linux/amd64 and linux/arm64.
| Component | Version |
|---|---|
| Base image | Ubuntu 24.04 LTS |
| Docker CLI | 29.3.0 |
| Docker Buildx plugin | 0.31.1 |
| Amazon ECR Credential Helper | 0.12.0 |
The image runs as a non-root builder user (UID/GID 1001).
No ~/.docker/config.json is baked into the image. It is expected to be provided at runtime — for example, mounted via a Kubernetes ConfigMap.
The config should wire the ECR credential helper for the registries the builder needs to authenticate with:
{
"credHelpers": {
"public.ecr.aws": "ecr-login",
"<account-id>.dkr.ecr.<region>.amazonaws.com": "ecr-login"
}
}The ECR credential helper (docker-credential-ecr-login) is already present in the image. It follows the standard AWS credential chain, so no static credentials need to be baked into the image.
Images are tagged and pushed to Docker Hub on every GitHub Release. Tags follow the version in the release (e.g. zappi/image-builder:1.0.0).