Buf remote plugin

[julienfouilhe]

Hi,

I created a buf plugin for pbandk. Dockerfile is available here.

This allows buf users to use pbandk as a remote plugin without having to install it locally.

I'm not very familiar with java so I couldn't make a smaller image work. Also pbandk problem running as root meant I had to add a custom user.

Would you be interested in taking the ownership of that repository and publishing the plugin to the buf registry yourself?

[garyp]

Thanks for the contribution @julienfouilhe! Yeah we'd be interested in publishing the plugin to the buf registry ourselves. Seems like a pretty low-maintenance thing to maintain. I'll create a GitHub issue for copying your Dockerfile to the main pbandk repo and wiring up the buf registry publishing step into our CI publishing flow. It might be a bit of time before we get around to doing this though.

I'm not very familiar with java so I couldn't make a smaller image work.

Looks like the Amazon Corretto image you're using is 205MB. You could try the Eclipse Temurin image instead. In addition to images with the full JDK, Temurin also provides images with just the JRE. eclipse-temurin:18-jre is only 89MB. They also have alpine-based images (eclipse-temurin:18-jre-alpine is only 47MB), though I don't know if using the alpine image would cause any compatibility issues. We've never tested running pbandk under alpine.

Getting the image any smaller than that could probably be done by building a protoc-gen-pbandk native executable using GraalVM. That's probably a fair amount of work, but we'd be very interested in accepting a pull request that adds GraalVM support to pbandk.

Also pbandk problem running as root meant I had to add a custom user.

We're avid users of buf at Streem, but we haven't used the new buf registry functionality yet so I'm not familiar with what limitations it imposes. Are there any problems with running the buf remote plugin as a non-root user inside the Docker container?

[julienfouilhe]

I tried the alpine and it didn't work out of the box, it seemed like it didn't find the JRE but I could be wrong, I'll try with eclipse-temurin:18-jre.

we haven't used the new buf registry functionality yet so I'm not familiar with what limitations it imposes. Are there any problems with running the buf remote plugin as a non-root user inside the Docker container?

The problem is not with buf remote plugins per say, but if you want to install pbandk in a docker image it can become a problem, because maybe proto files have been copied as root and therefore a non-root user doesn't have access, or other tools require root access?
Examples where I can imagine it being a problem:

• if you want to run a vscode dev container (to use in Github Codespaces for instance) with pbandk installed (but not just pbandk).
• In a CI environment. I used Semaphore CI for instance, and I was using a docker image with all my tools installed to run my CI/CD pipelines. Installing pbandk meant I had to resort to using sudo to run some commands because I had to do everything else as a non-root user.

It would be way simpler if pbandk

[garyp]

I created issue #224 for adding this Dockerfile to the main pbandk repo.