kaniko

> Why isn't it under google's username on github? It's under "googleworkspace", one of Google's GitHub organizations (linked on https://developers.google.com/workspace). > Why does the repo say "This is not an officially supported Google product."? This seems to be boilerplate that Google puts on open-source releases, e.g: https://github.com/GoogleContainerTools/kaniko It's not saying that it's not released by Google, but that it's not an officially supported Google product. I presume to make it clear that it's not covered by support agreements/bug bounties/etc. in the way products like Google Docs would be. > Is it actually approved by Google or not? It went through the launch/approval process (https://news.ycombinator.com/item?id=48655744) and was announced by Justin's manager.

> This tool is not yet officially supported by Google. It is currently maintained solely by @braydonk, and unless something changes primarily in spare time. No thanks. I'm done after Kaniko. https://github.com/GoogleContainerTools/kaniko

> Sorry for not replying. No worries, I know how it is! :) > But good to see you got your answer in the end. Well, almost. Even outside that above usecase I'd still be interested in the capabilities TinyKVM needs and its overall security model & properties! There are far too many Github projects out there these days that claim to do sandboxing and for an outsider it's very difficult to compare them security-wise. > what about using more caving in your CI/CD Pipeline. The caching itself is not the issue. We already heavily cache image layers when building container images. The issue (one of them) is that on our platform AppArmor prevents containers from mounting anything, including overlayfs file systems. The latter, however, are needed for Docker/Podman to do proper image layering. The only non-mount alternative I'm aware of, Kaniko, avoi

It's not a very good one, but it is ubiquitous (it's also better if you remember to include the right syntax marker that enables heredocs): # syntax=docker/dockerfile:1 I suspect that the GP was really asking "why not use a different tool", like buildah <https://buildah.io>, buildpacks <https://buildpacks.io>, nix <https://nix.dev/tutorials/nixos/building-and-running-docker-...>, kaniko <https://github.com/GoogleContainerTools/kaniko>, ko <https://github.com/ko-build/ko>, bazel <https://github.com/bazel-contrib/rules_oci>, apko <https://github.com/chainguard-dev/apko>, or other tools. Each of those has tradeoffs compared to Dockerfiles (I have no need for bazel, but if I did, then adding `rules_oci` might be a win-win, rather than using a Dockerfile). If I used Nix, then the Nix dockerTools would be a huge win (I don't use Nix). If I

According to Kaniko documentation [1], they don't really support cross-platform compilation. Do you solve that by having both amd64- and arm64-based CI/CD runners? [1] https://github.com/GoogleContainerTools/kaniko#--customplatf...

This is nice. I have CI config on GitLab that builds and publishes the documentation automatically to "GitLab pages" with MkDocs and in the process to add something to push to PyPI automatically as well for that project, and we're in the process of adding Docker image building and pushing to a registry a spart of the CI as well (exploring Kaniko: https://github.com/GoogleContainerTools/kaniko) I also subscribe to several GitHub repositories' RSS on Thunderbird. I read release notes for libraries we depend on regularly, as well as their commit logs to predict the direction they're taking in some parts of interest.

Yeah, I am actually aware— I've been following it keenly via the buildah issue tracker, and I should have put that in my original post. But the current reality is still that building images on Kubernetes is a choice between several not-great options, especially if you're on managed k8s and can't use privileged mode as a stopgap. Anyway, even once this stuff all lands, there's still actually no way to do what I would consider to be the actual gold standard of k8s image building, which would be a method where you build the image starting from any base layers already on the kubelet. Because currently, whether it's kaniko, buildah, docker-in-docker, etc, you're basically always either downloading everything every time, or you're having to manually manage some scheme with a long-lived cache container that you volume-in each time and purge peri

kaniko is really really slow: - https://github.com/GoogleContainerTools/kaniko/issues/1392 - https://github.com/GoogleContainerTools/kaniko/issues/970 - https://github.com/GoogleContainerTools/kaniko/issues/875 I've observed basically the same stuff.