Kaniko

Spec sheet

Purpose

Kaniko builds container images from Dockerfiles inside a container or Kubernetes cluster.Read 3 Oct 2026 · github.com

Security

Kaniko relies on container runtime security features and says it does not by itself make untrusted builds safe to run.Read 3 Oct 2026 · github.com

Support

The project directs community questions to GitHub issues and offers Matrix support and announcements rooms.Read 3 Oct 2026 · github.com

Architecture support

The documentation lists official container support for linux/amd64, linux/arm64, linux/s390x, and linux/ppc64le, with the latter two caveated for debug images.Read 3 Oct 2026 · github.com

Build contexts

Supported build context sources include local directories or tar files, standard input, GCS, S3, Azure Blob Storage, and Git repositories.Read 3 Oct 2026 · github.com

Build process

The executor extracts the base image filesystem, runs Dockerfile commands, snapshots filesystem changes, and pushes the resulting image to a registry.Read 3 Oct 2026 · github.com

Daemonless builds

Kaniko does not depend on a Docker daemon and executes Dockerfile commands in userspace.Read 3 Oct 2026 · github.com

Dockerfile support limit

Kaniko supports COPY --chown and ADD --chown but does not support RUN --chown.Read 3 Oct 2026 · github.com

Image distribution

The project publishes release images on GitHub Container Registry and Docker Hub.Read 3 Oct 2026 · github.com

Image signing

Kaniko images for versions 1.24.1 and later are signed with cosign, and the documentation gives instructions for keyless verification.Read 3 Oct 2026 · github.com

Maintainers

The project website describes OSS Container Tools as five maintainers who rely on Kaniko in their own CI and continue the project as a community effort.Read 3 Oct 2026 · osscontainertools.org

Notable limits

Kaniko does not support building Windows containers or creating multi-architecture manifests itself.Read 3 Oct 2026 · github.com

Run environments

The documentation describes running Kaniko in Kubernetes, gVisor, Google Cloud Build, and Docker.Read 3 Oct 2026 · github.com

Telemetry

Build tracing is off by default and can export Dockerfile instructions, build plan, cache keys, and CI attributes to an OpenTelemetry collector.Read 3 Oct 2026 · github.com

Plans and prices

Every Kaniko plan and price →

Where Specifiction places it

• Container Build Tools#21 of 347.6