Building untrusted container images safely at scale

Summary

A lot of our customers run into the same problem: they need to run code on behalf of their customers. Whether you're hosting user-generated Python scripts, processing custom containers, or running code in isolated environments, you end up needing fast, reliable container builds that don't become a bottleneck. Rather than managing all the container orchestration complexity in-house, many of our customers outsource the container building to us and use our API for the heavy lifting. In this post, we'll walk through how to use the Depot API to set up and administer isolated project cache, report build metrics, and get build logs for your customer workloads. We'll use Go to build tooling that creates and manages container builds for a multi-tenant SaaS platform. Depot core API The Depot core API uses buf.build, so it supports both Connect and gRPC protocols. Thanks to Buf, we can automatically generate client libraries for many languages. In this example, we'll use Go as the backend language, but Buf can be used in many other languages. Architecture overview We'll build some tools to create isolated build environments for users. For a new user, we'll create a new project and a new project-scoped token. Next, we'll get container build metrics including durations. Finally, we'll retrieve the container's steps. Getting started with the Go Client First, let's create a new go program. go mod init github.com/depot/saasCopy code Next, we'll add the Connect Depot API clients. go get connectrpc.com/connect go get buf.build/gen/go/depot/api/connectrpc/go go get buf.build/gen/go/depot/api/protocolbuffers/goCopy code You can find the complete documentation for the Go client at the Buf registry. Creating projects for customer isolation We recommend mapping an individual user to a single Depot project. We'll build a simple command-line tool that creates projects. mkdir -p ./cmd/projectCopy code Add this to the file cmd/project/main.go: package main import ( "context" "flag" "fmt" "log...