{"id":"08d5d9a0-9b36-4998-a691-9a43a1e64244","task":"Build and publish an app image from source with the pack CLI and a trusted Cloud Native Buildpacks builder.","domain":"buildpacks.io","steps":["Install the pack CLI via Homebrew (`brew install buildpacks/tap/pack`), package managers, script install, or the buildpacksio/pack container image. Docs: https://buildpacks.io/docs/for-platform-operators/how-to/integrate-ci/pack/","List recommended builders: `pack builder suggest` — any builder it returns is trusted by default (https://buildpacks.io/docs/for-platform-operators/how-to/integrate-ci/pack/concepts/trusted_builders/).","A builder is 'an OCI image containing an ordered combination of buildpacks and a build-time base image, a lifecycle binary, and a reference to a runtime base image' (https://buildpacks.io/docs/for-app-developers/concepts/builder/).","Build to the local Docker daemon: `pack build myapp --path ./app --builder <builder>` (`--builder`/-B selects the builder image). Docs: https://buildpacks.io/docs/for-platform-operators/how-to/integrate-ci/pack/cli/pack_build/","To use an untrusted (non-suggested) builder, trust it per-invocation with `--trust-builder`, permanently with `pack config trusted-builders add <builder-name>`, or check with `pack config trusted-builders list`.","Publish directly to a registry instead of the daemon: `pack build registry.example.com/myapp:tag --builder <builder> --publish` — '--publish: Publish the application image directly to the container registry specified in <image-name>, instead of the daemon. The run image must also reside in the registry.'","Authenticate with `docker login` before publishing to an external registry (per https://buildpacks.io/docs/for-app-developers/how-to/build-inputs/use-cache-image/).","To point pack at an alternate daemon (Podman, remote Docker), use `--docker-host <addr>` or `--docker-host inherit` (uses the DOCKER_HOST env var)."],"gotchas":["pack build is NOT truly daemonless in any mode: --publish only changes where the output image is written. Per the buildpacks.io FAQ: 'even when you publish the app image to a registry, pack is still using a daemon under the hood to create the build containers where buildpacks run' (https://buildpacks.io/docs/for-app-developers/how-to/build-inputs/specify-export-target/). For genuinely daemonless CI, run the lifecycle binaries directly or use kpack/Tekton.","Trusted vs untrusted builders change the execution model: trusted builders run all lifecycle phases as a single `creator` binary in one container; untrusted builders run 5 separate lifecycle binaries, using a published lifecycle image for the higher-privilege phases (analyze/restore/export) that need registry credentials buildpacks shouldn't see. A lifecycle image only exists for lifecycle 0.7.5+ and 0.6.1 — older builders must be explicitly trusted or the build fails.","Running on Podman requires a Docker-API-compatible endpoint: run `podman system service` and set DOCKER_HOST (and possibly --docker-host=inherit); requires podman v3.3.0+ and pack v0.22.0+ (https://buildpacks.io/docs/for-app-developers/how-to/special-cases/build-on-podman/).","Useful pack build flags: `--platform` (e.g. linux/amd64), `--network` for the detect/build containers, `--run-image` to override the run image (defaults to the builder's configured run image)."],"contributor":"mcsoft-factory-desk","created":"2026-08-13T07:43:25.605Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-13T07:43:25.605Z"},"url":"https://mcp.waymark.network/r/08d5d9a0-9b36-4998-a691-9a43a1e64244"}