bash docker buildx create \ --name buildkit-cache \ --driver docker-container \ --driver-opt network=host \ --driver-opt exec-opt limit.memory=6442450944 \ --platform linux/amd64 \ --use && \ docker buildx inspect --bootstrap toml /etc/buildkitd.toml [worker.oci] max-parallelism = 2 # Limits concurrent blob uploads to prevent OOM gc = true # Enables automatic garbage collection gckeepstorage = 4294967296 # 4 GB hard cap on total cache storage [worker.oci.gcpolicy] [[worker.oci.gcpolicy]] keep-bytes = 1073741824 # 1 GB tail retention window keep-duration = "24h" # Keep recent cache for one day [[worker.oci.gcpolicy]] all = true keep-bytes = 536870912 # 512 MB safety floor to prevent zero-storage states yaml steps: # Step 1: Bootstrap the buildx builder with memory limits name: 'gcr.io/cloud-builders/docker' entrypoint: 'bash' args: '-c' | docker buildx create \ --name buildkit-cache \ --driver docker-container \ --driver-opt network=host \ --driver-opt exec-opt limit.memory=6442450944 \ --platform linux/amd64 \ --use && \ docker buildx inspect --bootstrap # Step 2: Execute the build with registry-backed cache-in and cache-out name: 'gcr.io/cloud-builders/docker' entrypoint: 'bash' args: '-c' IMAGE_REF=${_IMAGE_REGISTRY} docker buildx build \ --builder buildkit-cache \ --progress=plain \ --cache-from=type=registry,ref=${CACHE_REF},mode=max,ignore-error=true \ # ignore-error=true prevents abort on first build when cache ref doesn't exist yet --cache-to=type=registry,ref=${CACHE_REF},mode=max,annotation-index.com.example.cache-mode=immutable,commit=true \ # commit=true defers manifest promotion until all blobs finish uploading atomically --output=type=image,name=${IMAGE_REF},push=true \ --build-arg UV_CACHE_DIR=/root/.cache/uv \ --build-arg PYTHON_VERSION=${_PYTHON_VERSION:-3.12} \ --ulimit nofile=65536:65536 \ # Increases file descriptor limit to prevent "too many open files" crash during parallel layer export -f Dockerfile \ . # Step 3: Tear down the builder to free resources name: 'gcr.io/cloud-builders/docker' entrypoint: 'bash' args: ['buildx', 'rm', 'buildkit-cache'] options: machineType: E2_HIGHCPU_8 dynamicSubstitutions: true logging: CLOUD_LOGGING_ONLY substitutions: _CACHE_REGISTRY: us-central1-docker.pkg.dev/${PROJECT_ID}/docker-cache _IMAGE_REGISTRY: us-central1-docker.pkg.dev/${PROJECT_ID}/app-image _PYTHON_VERSION: '3.12' dockerfile syntax=docker/dockerfile:1.12 FROM python:${_PYTHON_VERSION:-3.12}-slim AS base ENV PYTHONDONTWRITEBYTECODE=1 \ PYTHONUNBUFFERED=1 \ UV_CACHE_DIR=/root/.cache/uv \ PATH="/root/.local/bin:/root/.cache/uv/bin:$PATH" RUN curl -LsSf https://astral.sh/uv/install.sh | sh WORKDIR /app Copy only manifests first so the dependency layer stays cached across source changes COPY pyproject.toml uv.lock ./ RUN uv sync --frozen --no-install-project Then copy application source; this layer changes frequently and is cheap to rebuild COPY . .
Pre-compile all Python files so the production layer avoids import-time compilation overhead RUN uv run python -m compileall . || true FROM base AS production USER 65534:65534 CMD ["python", "-m", "your_app"] bash gcloud artifacts repositories delete docker-cache \ --location=us-central1 --quiet