[RFC0046] Provide optional Custom Stacks Functionality in Cloud Foundry #1336

Activity

1. beyhan

   added

   rfcCFF community RFCCFF community RFC

   on Oct 15, 2025
2. cf-foundation-community-automation

   added this to CF Communityon Oct 15, 2025
3. cf-foundation-community-automation

   moved this to Inbox in CF Communityon Oct 15, 2025
4. johha commented on Nov 4, 2026

   

   johha

   on Nov 4, 2026

   Member

   More actions

   PRs for custom stack implementation in Cloud Controller

   • Preparation: Unified credentials fields in manifest/API for buildpack and CNB apps: ccng #5547 ✅ (+ bug fix with ccng #5570 ✅)
   • Custom stack implementation: ccng #5492 ✅
5. johha commented on Nov 4, 2026

   

   johha

   on Nov 4, 2026

   Member

   More actions

   RFC-0046 vs. current implementation

   Status: feature-complete per RFC, with a few deliberate refinements. Marked experimental; subject to change in the API docs.

   Matches the RFC

   • New diego_custom_stacks feature flag (disabled by default) gates docker:// stacks for the buildpack and CNB lifecycles.
   • Apps, manifests, and cf push accept a container-image reference in stack / lifecycle.data.stack.
   • lifecycle.data.credentials (host-keyed username/password) is passed through to Diego BBS as ImageUsername / ImagePassword on LRPs and tasks.
   • token-only credentials are ignored for stack pulls (CNB buildpack-only), per the RFC’s BBS constraint.
   • Custom stacks require a stackless admin buildpack or a user-supplied buildpack; otherwise the request is rejected with a clear error.
   • No Diego BBS changes required: rootfs + existing staging actions are reused.

   Refinements beyond the RFC

   • Credential routing by workload lifecycle: app lifecycle for LRPs, droplet lifecycle for tasks, requested lifecycle for staging — so build-only credentials authenticate that build’s staging while runtime/tasks require app-level credentials.
   • Hardened validation: reject URIs with embedded userinfo, empty path segments, and non-string username/password values.
   • Staging asset-cache keys use the resolved platform stack to match runtime/task builders.
   • Disk accounting: custom-stack image layers count toward the app/task disk quota (documented).
   • No Stack DB row is created for custom stacks; they live only on the lifecycle data.
   • CF_STACK / CNB_STACK_ID are derived from the final image repository component during staging only; runtime behavior is unchanged.
   • Private CustomStackCredentialResolver isolates registry credential lookup and returns { image_username:, image_password: }.

   Open

   • End-user docs
   • CATS coverage