A Code Injection Method for Rapid Docker Image Building

TL;DR

This paper introduces a code injection technique for Docker images that significantly speeds up rebuild times by selectively updating only changed layers, especially effective for interpreted languages like Python.

Contribution

It presents a novel code injection method that bypasses checksum verification to accelerate Docker image rebuilds, addressing inefficiencies in current layer update processes.

Findings

Rebuild time reduced from O(n) to O(1) for interpreted languages.

Method targets only changed layers, avoiding full layer rebuilds.

Potential extension to multi-layer injection discussed for future work.

Abstract

Docker images are composed of multiple layers, each of which contains a set of instructions, and an archive of files. Layers allow Docker to separate a large build task into smaller ones, such that when a part of the program is changed, only the corresponding layer needs to be changed. Yet the current implementation has major inefficiencies that make the rebuilding of an image unnecessarily slow when changes in bottom layers are required: uneven content distribution amongst layers, the need to rebuild an entire layer during update, and the rebuild fall-throughs in many cases. In this paper, we propose a code injection method that overcomes these inefficiencies by targeting only the changed layer and then bypassing the layer's content checksum. This process is developed specifically for an interpreted language such as Python, where changes can be detected explicitly via text diff tools and run as-is without compilation. We then demonstrate that this method can accelerate the rebuild time, effectively reducing the O(n) where n = size of layer rebuild time to O(1). Whereas for compiled languages, literal code injection cannot guarantee integrity in compiled machine code. Expanding on the same code injection principle, multi-layer targeted code injection will be addressed in a future discussion.