Kaniko: Building Container Images Inside Kubernetes

Thu, 21 Nov 2024 14:00:00 +0000

There is an awkward chicken-and-egg problem at the heart of running CI inside Kubernetes: you want to build container images, but the traditional way to build a container image is to run docker build, and docker build needs a Docker daemon, and a Docker daemon needs root and a bunch of kernel features that you really, really should not be handing to a CI pod. The old hack — mounting the host’s Docker socket into the build pod — is the security equivalent of leaving your front door open because the lock is fiddly. Anything that can talk to that socket effectively owns the node.

Kaniko - Tag - vo.rs

Kaniko: Building Container Images Inside Kubernetes