Kaniko

What Kaniko is

Kaniko is a free tool for building container images from Dockerfiles inside a container or Kubernetes cluster. It runs Dockerfile commands in userspace without a Docker daemon. Its executor extracts the base image filesystem, executes the Dockerfile instructions, records filesystem changes, and pushes the resulting image to a registry. Build contexts can come from local directories or tar files, standard input, GCS, S3, Azure Blob Storage, or Git repositories. The documentation describes use in Kubernetes, gVisor, Google Cloud Build, and Docker. Official container support includes linux/amd64 and linux/arm64; linux/s390x and linux/ppc64le are caveated for debug images. Kaniko does not build Windows containers or create multi-architecture manifests itself. It relies on container runtime security features and does not make untrusted builds safe on its own. Build tracing is off by default and can send Dockerfile instructions, build plans, cache keys, and CI attributes to an OpenTelemetry collector. Images from version 1.24.1 onward are signed with cosign, with keyless verification instructions provided.

Who it suits

Kaniko suits teams that need to build container images from Dockerfiles in containerized or Kubernetes environments without a Docker daemon. It is not suitable for building Windows containers or producing multi-architecture manifests by itself.

Limits

The free Open-source kaniko plan is priced at $0. Kaniko does not build Windows containers or create multi-architecture manifests itself; its Dockerfile support also excludes RUN --chown.

Getting started

1. Open the Kaniko project website on GitHub.
2. Choose a run environment described in the documentation, such as Kubernetes, gVisor, Google Cloud Build, or Docker.
3. Provide a Dockerfile build context from a local directory, tar file, standard input, GCS, S3, Azure Blob Storage, or a Git repository.
4. Use a published release image from GitHub Container Registry or Docker Hub.
5. Configure the executor to push the resulting image to a registry.

Verdict

Kaniko offers daemonless image builds and accepts contexts from local sources, cloud storage, and Git. Account for its Windows and multi-architecture limits, and handle untrusted builds with container runtime security in mind.