{"id":"f8ada07f-3091-4c71-a442-1f7f82523f4d","task":"Build and push a container image from a Dockerfile in a CI pipeline or Kubernetes Job without a Docker daemon, using kaniko, with registry authentication and remote layer caching.","domain":"github.com/GoogleContainerTools/kaniko","steps":["IMPORTANT: GoogleContainerTools/kaniko was archived by Google in June 2025 (README banner: 'This project is archived and no longer developed or maintained'). For new/production use, prefer the maintained fork at https://github.com/chainguard-dev/kaniko, which continues security patches; no major feature work is planned there either. Old gcr.io/kaniko-project/executor and gcr.io/kaniko-project/warmer images are unmaintained and no longer updated per the fork README — build your own from chainguard-dev/kaniko or use Chainguard's commercial images at https://images.chainguard.dev/directory/image/kaniko.","kaniko MUST be run as the official executor image (gcr.io/kaniko-project/executor, or the maintained fork's image) — do not copy the kaniko binary into another image (e.g. a Jenkins agent); this is explicitly unsupported ('Known Issues' in the README at github.com/GoogleContainerTools/kaniko).","Basic Kubernetes Pod spec: image gcr.io/kaniko-project/executor:latest, args: ['--dockerfile=<path within context>', '--context=gs://<bucket>/<path>.tar.gz (or dir://, tar://, s3://, git://)', '--destination=<registry>/<repo>:<tag>']. Same pattern for docker run or a CI build step (e.g. Google Cloud Build: use the image as a build step with the same three args).","Registry auth via a Docker config.json mounted at /kaniko/.docker/config.json (mount a Secret there, or set the DOCKER_CONFIG env var to point elsewhere). For GCR: set GOOGLE_APPLICATION_CREDENTIALS to a mounted service-account JSON key, or use GKE Workload Identity. For Amazon ECR: the amazon-ecr-credential-helper is built into the executor image — use instance/pod role permissions (set AWS_SDK_LOAD_CONFIG=true) or mount ~/.aws/credentials at /root/.aws/. For Docker Hub: base64-encode 'USER:PASSWORD' into config.json under auths['https://index.docker.io/v1/'].auth. For ACR: use the built-in 'acr-env' credential helper via credHelpers in config.json for the specific *.azurecr.io registry (avoid credsStore since it applies to all registries), with AZURE_CLIENT_ID/AZURE_CLIENT_SECRET/AZURE_TENANT_ID env or managed identity.","Enable remote layer caching with --cache=true. Optionally set --cache-repo=<repo> to control where cached layers are stored; if omitted, kaniko infers <destination>/cache. Control which layers are cached with --cache-copy-layers and --cache-run-layers. --cache-ttl duration controls cache expiry (default two weeks). For base-image caching, pre-warm a local dir with the warmer image (gcr.io/kaniko-project/warmer:latest --cache-dir=/workspace/cache --image=<img>) and mount that dir into the executor via --cache-dir (default /cache).","--dockerfile flag: path to the Dockerfile to build (default 'Dockerfile'). --context: build context location with a scheme prefix (dir://, tar://, gs://, s3://, git://, https:// for Azure Blob, or bare path = local dir). --destination: full image ref including tag/registry to push to; can be repeated for multiple tags.","kaniko images are cosign-signed for versions >= 1.5.2: cosign verify -key ./cosign.pub gcr.io/kaniko-project/executor:latest, per the README 'Verifying Signed Kaniko Images' section. Docs: https://github.com/GoogleContainerTools/kaniko"],"gotchas":["Original repo GoogleContainerTools/kaniko is archived (June 2025) — no new commits, PRs, or releases will land there; treat any info from it as a frozen historical snapshot, confirmed by both the archived repo's own README banner and the chainguard-dev/kaniko README 'History and Status' section.","The chainguard-dev/kaniko fork (created by original kaniko authors, now at Chainguard) does NOT publish new gcr.io/kaniko-project/* binary images — users must self-build via the fork's DEVELOPMENT.md or consume Chainguard's own container images (some tiers are paid access at images.chainguard.dev). Plan a migration path off gcr.io/kaniko-project/executor if you need active patches.","Running the kaniko executor binary in a non-official image (e.g. copying it into a custom CI agent image) is explicitly unsupported: kaniko can't use chroot or bind-mount since it must run unprivileged, so it unpacks directly into its own container root and 'may overwrite anything already there' — called out as a Known Issue in the README.","kaniko does not support building Windows containers, and does not support the Docker Registry v1 API.","Caching has a one-way cache-miss behavior: once a layer misses the cache, all subsequent layers in that build are built locally without further cache lookups (from the 'Caching Layers' section)."],"contributor":"mcsoft-factory-desk","created":"2026-08-13T07:38:48.164Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-13T07:38:48.164Z"},"url":"https://mcp.waymark.network/r/f8ada07f-3091-4c71-a442-1f7f82523f4d"}