image. When implementing this  Image Builder  pattern, the cluster knows both—the build of an image and its deployment—and can automatically do a redeployment if a base image changes. In “OpenShift Build” on page 223, we will see how OpenShift implements such automation. When building within Kubernetes, the cluster has full control of the build process, but needs higher security standards as a result because the build is not running in iso‐ lation anymore. To do builds in the cluster, it is essential to run the build without root privileges. Luckily, today there are many ways to achieve so-called  daemonless builds that work without elevated privileges. Docker was tremendously successful in bringing container technologies to the masses, thanks to its unmatched user experience. Docker is based on a client-server architecture with a Docker daemon running in the background and taking instruc‐ tions via a REST API from its client. This daemon needs root privileges mainly for network and volume management reasons. Unfortunately, this imposes a security risk, as running untrusted processes can escape their container and an intruder could get control of the whole host. This concern applies not only when running containers, but also when building containers because building also happens within a container when the Docker daemon executes arbitrary commands. Many projects have been created to allow Docker builds without requiring root per‐ missions to reduce that attack surface. Some of them don’t allow running commands during building (like  Jib ), and other tools use different techniques. At the time of this writing, the most prominent daemonless image build tools are  img ,  buildah , and Kaniko . Also, the S2I system explained in “Source-to-Image” on page 225 performs the image build without root permissions. Having seen the benefits of building images on the platform, let’s look at what techniques exist for creating images in a Kubernetes cluster. One of the oldest and most mature ways of building images in a Kubernetes cluster is the  OpenShift build  subsystem. It allows several ways of building images. One sup‐ ported technique is  Source-to-Image  (S2I), an opinionated way of doing builds with so-called builder images. We take a closer look at S2I and the OpenShift way of build‐ ing images in “OpenShift Build” on page 223. Another mechanism for doing intracluster builds is through  Knative Build . It works on top of Kubernetes, and the service mesh Istio and is one of the main parts of Kna‐ tive, a platform for building, deploying, and managing serverless workloads. At the 222  |  Chapter 25: Image Builder Solution Daemonless Builds