xnett.org

[OPEN SOURCE] · Container image builder

LayerSmith

Build container images with purpose.

status: Active development · v0.4.0 · 2026-10-03

LayerSmith is a self-hosted web app for building OCI container images. You pick a Linux distribution, say what the image is for and choose the tools. LayerSmith generates the Containerfile and shows it to you before anything runs, builds it with Docker or Podman, and gives you an image, an OCI TAR archive or an air-gap bundle.

The same server can be driven from a terminal on another machine: a TUI and a scriptable CLI for jumphosts and laptops, with no container runtime needed on the client.

View on GitHub (opens github.com/r0lfi/layersmith in a new tab)View releases (opens GitHub Releases in a new tab)Documentation (opens docs/ on GitHub in a new tab)Container image (opens GitHub Container Registry in a new tab)

open source · MIT · contributions and issues on GitHub

layersmith — dashboard.png
LayerSmith dashboard with quick-build templates and recent builds

Dashboard: templates to start from and recent builds.

# why

A good Containerfile depends on details that change between distributions. DNS tools are bind-utils on AlmaLinux, dnsutils on Ubuntu and bind-tools on Alpine. apt wants --no-install-recommends and a cleanup afterwards. A latest tag quietly moves under you. LayerSmith encodes those details once, so templates ask for capabilities and get the right packages for each distribution.

It started as the image builder inside Ops Center and became a standalone project. Air-gapped systems were a design goal from the start: an image and everything needed to load it should travel as one archive with checksums and install instructions.

who it's for: Linux administrators and platform engineers who build tool images for jumphosts, CI or isolated networks. Also anyone who has to carry images into air-gapped environments, or who needs a pinned, offline-tested environment for LLM fine-tuning.

# what it does today

  • Purpose-driven templates (Developer, Linux Admin, Network Tools, Ansible, Kubernetes, OpenShift, Minimal), or start from nothing.
  • Distro-aware packages via dnf, apt or apk: AlmaLinux, Rocky Linux, CentOS Stream, Fedora, Ubuntu, Debian, Alpine, or any OCI base image.
  • The generated Containerfile is shown before the build and can be edited in Advanced mode. Existing Dockerfiles and Containerfiles can be imported and built as they are.
  • Immutable, versioned builds with digest-pinned base images. Each build records its Containerfile, base digest, package list, file checksums and log.
  • Build logs stream live to the browser.
  • Exports: an OCI TAR with a recorded SHA256, or an air-gap bundle with the image, manifest, Containerfile, SHA256SUMS and INSTALL.txt.
  • Optional image scanning through a pluggable scanner (Trivy), with a CycloneDX SBOM. It is off until you configure it, and it reports without blocking.
  • LLM training and fine-tuning templates: Hugging Face fine-tuning, advanced PyTorch, LLaMA-Factory and CPU dataset preparation. Stacks are hash-locked and checked offline inside the image after every build.
  • A terminal client (since v0.4.0) with an interactive TUI and a CLI with JSON output, installable offline from the release archive.

# screenshots

LayerSmith create-image wizard
The create-image wizard.
LayerSmith live build log
A live build log.
LayerSmith scan findings filtered by severity
Scan findings. Secrets are reported as rule, file and line, never the value.
LayerSmith LLM training wizard choosing a purpose and profile
LLM training templates: choose a purpose and profile.
LayerSmith terminal client showing the projects view
The terminal client (TUI).

# written about it here

# links