One Command Builds a Java Machine Learning Image

▶ Watch (2:05)

Delaney ran pack build example against a Java 25 application using the Deep Learning 4j library and Maven. The app fits a linear equation to number pairs (1,3), (2,5), (3,7) across 500 training epochs. The build ran through the standard Buildpacks analyze, detect, build, and export phases without any Dockerfile or container configuration from the developer. Docker then ran the resulting image and printed the learned equation coefficients. The entire developer interaction was a single CLI command.

Custom Builders Give Platform Teams Central Control

▶ Watch (10:08)

Platform operators control which language stacks, runtimes, and base images appear in production by owning the builder. Delaney’s custom Java CUDA builder starts from Nvidia’s base image with a CNB user added, which removes the need for root access during builds. A single builder.toml file pins specific buildpack versions and restricts language support. When Python 3.13 needs deprecating in favor of 3.15, the change happens in one builder, not across hundreds of repositories.

AI and ML Workloads Follow the Same Build Pattern

▶ Watch (15:42)

GPU-based workloads add CUDA libraries, PyTorch or TensorFlow dependencies, and native C-compiled packages to the build graph. Buildpacks address this with two options: separate builders per target platform (one for web apps, one for data science GPU clusters), or image extensions that install CUDA RPMs and deb files at build time. Either way, the developer command stays pack build. The infrastructure team controls the builder and lets data scientists focus on their models rather than image construction.

Rebase Patches CVEs Across Thousands of Images in Seconds

▶ Watch (26:37)

Rebase is a registry-only operation. It rewrites the image manifest to reference the SHA of a patched base image without rebuilding the application layers. A CVE in libz or, historically, log4j can be remediated across 10,000 images in roughly 10 seconds. Delaney contrasted this with the months many organizations spent patching the log4j vulnerability across their fleets. CUDA minor-version updates qualify for rebase; major-version changes require a full rebuild.

The Road to 1.0: What Still Needs to Ship

▶ Watch (20:11)

The Buildpacks API sits at 0.15 and has been stable for roughly two to three years. Pre-1.0 work removes deprecated stacks and mixins code paths, changes shell-process handling in the launcher to improve signal handling (particularly for Python), and ships Dockerfile image extensions as a supported subset of container file syntax. Multi-arch builds already work on ARM and AMD64 but currently produce two images instead of one. Parallel cache support and better error messages are also on the list. A 2.0 is planned but not imminent. As Delaney noted, it took eight years to reach 1.0.

Q&A

How does rebase work mechanically, and how fast is it? Rebase rewrites only the registry manifest to point at a new base image SHA, taking about 10 seconds for 10,000 images. ▶ 26:37

How does image signing integrate with Buildpacks? The KPAC Kubernetes operator handles signing via cosign, separating build from sign responsibilities so pack is a drop-in replacement in existing cosign workflows. ▶ 28:01

Notable Quotes

pack build example will build this current source code in this directory, this complex AI or ML application into an image. Aidan Delaney · ▶ 06:12

it’s taken us eight years to get to 1.0. Aidan Delaney · ▶ 21:07

you could rebase the entire fleet of images in in 10 seconds rather than the months that it took a lot of organizations to deal with with those kind of issues. Aidan Delaney · ▶ 27:35

build packs builds the image cosign signs the image and by separating out the concerns it uh we can collaborate with them. Aidan Delaney · ▶ 28:21

Key Takeaways

  • pack build converts Java 25 ML source code into an OCI image with no Dockerfile.
  • Custom builders centralize runtime policy in one place instead of hundreds of repositories.
  • Rebase patches a CVE across 10,000 images in roughly 10 seconds, no application rebuild needed.

About the Speaker(s)

Aidan Delaney is a Buildpacks.io maintainer and software engineer at Bloomberg, where he works on the Data License team. Bloomberg gives him dedicated time to contribute to the project. His primary contribution has been documentation, work recognized by the CNCF Laura Nolan award.