Re: Request for Multibuildpack Use Cases

Guillaume Berche


Some additional related use-cases:

1- our corporate CF platform provider is willing to scan content all apps
pre staging and post-staging. For instance, in order to black list of
known-to-be-vulnerable php library pulled by the production apps, or
perform static code analysis. We're currently considering a php buildpack
fork to insert an extension to do this. Being able to do such scanning
without forking the buildpack would be useful.

This seemed well match

2- add some features that are language-independent to the set of supported
buildpacks without forking them (e.g. an agent collocated with the app, or
a command prexecuted prior to app starting).

A concrete example of this is securely fetching secrets from an hashicorp
vault before app startup and expose them as transient env vars (i.e. env
vars not stored in CC db). More details into

As a starting point we have decided to work with officially provided
buildpacks as their behavior is known and controlled by the buildpacks team.

I worry that only supporting a combination of the officially provided
buildpacks will drastically limit the number of use-cases addressed such a
"multi-buildpack" 1st step



On Wed, Apr 13, 2016 at 12:16 AM, Danny Rosen <drosen(a)> wrote:

As a starting point we have decided to work with officially provided
buildpacks as their behavior is known and controlled by the buildpacks
team. By discovering use cases (thank you John, Jack and David for your
examples) we can start work towards implementing multibuildpack solutions
that would be open to the community to consume and iterate on.
On Apr 12, 2016 1:06 PM, "Mike Youngstrom" <youngm(a)> wrote:


It sounds like the buildpack team is thinking the multi buildpack feature
would only work for buildpacks they provide not a custom
"dependency-resolution" buildpack. Or at least that is how I understood
the message from Danny Rosen earlier in the thread.


On Tue, Apr 12, 2016 at 10:45 AM, John Feminella <jxf(a)> wrote:

Multibuildpack is absolutely useful and I'm excited for this proposal.

I encounter a lot of use cases for this. The most common is that an
application wants to pull in private dependencies during a future
dependency-resolution step of a later buildpack, but the dependency
resolver needs to be primed in some specific way. If you wait until
buildpack time it's too late.

On Heroku, for example, this is accomplished by having something like
the netrc buildpack (, adding a
GITHUB_TOKEN environment variable, and then running your "real" buildpack.
The netrc BP runs first, allowing Bundler to see the private dependencies.

~ jf

On Tue, Apr 12, 2016 at 12:36 PM Jack Cai <greensight(a)> wrote:

It would be more useful if the multi-buildpack can reference an admin
buildpack in addition to a remote git-hosted buildpack. :-)


On Tue, Apr 12, 2016 at 6:38 AM, David Illsley <davidillsley(a)>

In the past we've used the multi-buildpack to be able to use ruby sass
to compile SCSS for non-ruby projects (node and Java). In that case we used
the multi-buildpack and a .buildpacks file which worked reasonably well
(and was very clear).

On Mon, Apr 11, 2016 at 1:15 AM, Danny Rosen <drosen(a)>

Hi there,

The CF Buildpacks team is considering taking on a line of work to
provide more formal support for multibuildpacks. Before we start, we would
be interested in learning if any community users have compelling use cases
they could share with us.

For more information on multibuildpacks, see Heroku's documentation

[1] -

Join to automatically receive all group messages.