go-containerregistry

Based on the simplicity of the build it's doing, there's basically no reason to invoke Docker to produce the image at all. You could use a tool like ko[0] to simply build the Go binary and place it on top of a base image (or keep it based on scratch) without requiring privileges at all, using `ko publish`. [0] https://github.com/google/go-containerregistry/blob/master/c... [1] https://github.com/google/go-containerregistry/blob/master/c...

For folks coming to this later, a correction. The buildpacks team are using the "crane" tool in go-containerregistry[0], rather than Kaniko, as the basis for their daemonless container-building containers. There is so much container-related work coming out of Google right now that I am struggling to keep up. [0] https://github.com/google/go-containerregistry

- We've published libraries to interact with the registry without docker or the docker CLI, which we use in these projects https://github.com/google/go-containerregistry https://github.com/google/containerregistry - Our team has built something exactly like you're describing https://github.com/GoogleCloudPlatform/distroless Dockerfiles without RUN commands are technically more correct: reproducible, much easier to inspect. However, its quite limiting for the existing corpus of Dockerfiles. I like to think of kaniko as the (pull) + build + push decoupling of the docker monolith. Other tools, like cri-o, have implemented the complement (pull + run). Disclaimer: I work on kaniko and some of these other tools at Google