Build and push a container image for a Go service directly from source with ko — no Dockerfile, no Docker daemon — optionally multi-arch, printing the pinned digest reference.

Documented steps

1. Install ko: `brew install ko`, download from GitHub Releases, or `go install github.com/google/ko@latest` (https://ko.build/install/).
2. Authenticate: ko reuses your Docker config (~/.docker/config.json) — if `docker push` already works you're set. Otherwise `ko login reg.example.com -u USER -p PASS`. ko also has built-in auth support for GCR/Artifact Registry (ADC/gcloud), Amazon ECR, Azure ACR, and GHCR (GITHUB_TOKEN). https://ko.build/get-started/
3. Set the push destination: `export KO_DOCKER_REPO=registry.example.com/my-project` (or ghcr.io/my-org/my-repo, a Docker Hub user, or ko.local/kind.local for local-only builds).
4. Build and push: `ko build ./cmd/app` — the package must be `package main`. Prints the resulting image reference with digest to stdout, e.g. `registry.example.com/my-project/app-<md5>@sha256:...`. (Called `ko publish` before v0.10; both work.) https://ko.build/get-started/ and https://ko.build/reference/ko_build/
5. Multi-platform: add `--platform=all` (every platform the base image supports) or `--platform=linux/amd64,linux/arm64`. ko cross-compiles per platform (GOOS/GOARCH) and assembles a manifest list. https://ko.build/features/multi-platform/
6. Control image naming: default is `KO_DOCKER_REPO/<pkgname>-<md5-of-importpath>`; `--base-import-paths`/`-B` drops the MD5 (`KO_DOCKER_REPO/app`); `--preserve-import-paths`/`-P` keeps the full import path; `--bare` uses only KO_DOCKER_REPO itself. https://ko.build/configuration/
7. Override the base image (default `cgr.dev/chainguard/static`): add `defaultBaseImage: <image>` to `.ko.yaml` (path overridable via KO_CONFIG_PATH), or set KO_DEFAULTBASEIMAGE (overrides the yaml). Per-importpath overrides use a `baseImageOverrides:` map in .ko.yaml.
8. SBOM: since v0.9 ko generates and uploads an SPDX SBOM for every image by default; disable with `--sbom=none`; download later with `cosign download sbom`. https://ko.build/features/sboms/
9. Use the printed digest reference directly in other tooling, e.g. `docker run -p 8080:8080 $(ko build ./cmd/app)` or `gcloud run deploy --image=$(ko build ./cmd/app)`. https://ko.build/deployment/