What are Cloud Native Buildpacks?
Cloud Native Buildpacks
Cloud Native Buildpacks (CNB) — turn application source into OCI images without a Dockerfile per app.
buildpacks.io turn application source into OCI images — without every team shipping a Dockerfile.
The problem
Section titled “The problem”GitOps
Declarative delivery from Git — manifests live in a repository; Argo CD applies changes on sync. solved deploy. Many platforms still leave build in each application repo: a Dockerfile, CI credentials, and its own base-image upgrade path.
What buildpacks change
Section titled “What buildpacks change”| Dockerfile per app | Platform buildpacks | |
|---|---|---|
| Who owns the build | Each application team | Platform / ops |
| What devs push | Source + Dockerfile + CI config | Source only |
| Base image CVEs | Chase N repos | Rebase CNB operation to refresh an app image onto a newer stack without a full rebuild from source. one builder stack |
| In this lab | Left column above | kpack Kubernetes-native build service that runs CNB builds on-cluster and pushes images to a registry. on EKS Amazon Elastic Kubernetes Service — this lab uses cluster name `cluster-1`. |
How there is no Dockerfile
Section titled “How there is no Dockerfile”A Dockerfile is a recipe the app repo owns. Buildpacks move that recipe into a shared builder image the platform owns.
- Builder — An OCI image (here Paketo
Paketo Buildpacks — mature open-source builders for Go, Node, Java, Python, and more. jammy) that already contains language buildpacks and a CNB lifecycle binary. Nothing indemo/app/has to know how toFROM golangor copy layers. - Detect — Each buildpack inspects the source tree. Pulse has
go.mod/./cmd/pulse, so the Go buildpack passes; others skip. Detection replaces “read the Dockerfile.” - Build + Export — The selected buildpacks compile the app into layers, then the lifecycle writes a normal OCI image (run image + app layers) and pushes it. Same end product as
docker build, different author of the steps. - Optional config, not a Dockerfile — Pulse’s
project.tomlonly setsBP_GO_TARGETS=./cmd/pulseso Paketo knows which package to build. You can omit it for many apps; it is metadata, not an image recipe.
You never write FROM / RUN / COPY in the app repo because the builder already encodes those steps for supported languages. The hands-on phase log (Detect → Build → Export) is on CNB lifecycle.
Lab pipeline
Section titled “Lab pipeline”Push Go source to CodeCommit
AWS managed Git hosting — GitHub alternative used for app source and deploy manifests in this lab. → kpack
Kubernetes-native build service that runs CNB builds on-cluster and pushes images to a registry. runs CNB on-cluster → image in ECR
Amazon Elastic Container Registry — stores OCI images built by kpack; EKS pulls from here. → managed Argo CD
EKS Capability for Argo CD — AWS-managed Argo CD that reads CodeCommit via IAM on the capability role. deploys → Pulse
Sample app in this lab — HTTP service monitor with dashboard, API, and Kubernetes health probes. serves HTTP.
Pulse sample app
Section titled “Pulse sample app”Pulse
Sample app in this lab — HTTP service monitor with dashboard, API, and Kubernetes health probes. is a Go service monitor: dashboard, JSON API, background health checks, and /healthz / /readyz probes. It proves a real service runs after a buildpack build — not hello-world.
See demo/app/ in the repository.