Skip to content

Build OpenCV in a build container#14

Merged
davidfrantz merged 3 commits intodavidfrantz:mainfrom
pjonsson:docker-opencv-buildcontainer
Mar 16, 2026
Merged

Build OpenCV in a build container#14
davidfrantz merged 3 commits intodavidfrantz:mainfrom
pjonsson:docker-opencv-buildcontainer

Conversation

@pjonsson
Copy link
Copy Markdown
Contributor

Put the build of OpenCV in a build container. It doesn't look very clear from the GitHub diffview, but there are basically 3 separate changes in this PR:

  1. Move the previous build parts into a build container and copy the built library into the image
  2. Switch the OpenCV build to using Ninja, which is slightly faster than make, and well-supported by CMake
  3. Use the Dockerfile ADD instruction for downloading the OpenCV source archive. This makes it easy to perform checksum validation to protect against supply-chain attacks, and as a side benefit it also makes the source archive reside in the Docker cache which speeds up local builds.

Besides the security and build time improvements, this is a step on the way towards being able to reduce the size of the image.

@pjonsson pjonsson force-pushed the docker-opencv-buildcontainer branch from d6c1265 to e52197a Compare February 23, 2026 13:50
@davidfrantz
Copy link
Copy Markdown
Owner

looks good. I just have one question for future updates: how do I get the sha256 key for the opencv link?

@pjonsson
Copy link
Copy Markdown
Contributor Author

pjonsson commented Mar 16, 2026

I download the binary to my local machine and run sha256sum (from coreutils package in Ubuntu) on the binary. If OpenCV has been compromised when I do this, the checksum won't help, but this protects against someone replacing the archive later at least.

Edit: give me 10 minutes and I will rebase this on top of latest main.

Put the package installation in
the internal_base image. This
will enable building OpenCV
in a build container, which
in the long run will enable
us to make the image smaller.
Build OpenCV in a separate build container
and copy the built files into the final
container. This means we can just build
and install without having to worry
about cleaning up the build files.
This also creates a separate layer
for OpenCV, so that will hit the Docker
cache more frequently.

Also switch to using Ninja while changing
things. Ninja is similar to make, but
is slightly faster and will use
all cores automatically.
This will prevent the container to
build if someone manages to replace
the OpenCV source archive.

As a side effect, this will also
cache the archive in the Docker
cache.
@pjonsson pjonsson force-pushed the docker-opencv-buildcontainer branch from e52197a to edc8e09 Compare March 16, 2026 09:18
@davidfrantz
Copy link
Copy Markdown
Owner

Thanks Peter

@davidfrantz davidfrantz merged commit 63b2727 into davidfrantz:main Mar 16, 2026
@pjonsson pjonsson deleted the docker-opencv-buildcontainer branch March 16, 2026 11:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants