Kaniko vs ko

Kaniko has no write-up on Specifiction yet; its figures are above.

ko is an open-source builder for container images of Go applications. It runs `go build` locally, so Docker does not need to be installed. The project positions it for a single Go application with few operating-system base-image dependencies, such as one without cgo or OS package requirements. Builds can target all platforms supported by the configured base image or selected platforms such as linux/amd64 and linux/arm64. For Kubernetes, `ko resolve` builds images for `ko://` references in YAML and replaces those references with image references; `ko apply` can apply the resolved configuration. ko reuses the normal Go build cache and avoids pushing image blobs already present in the remote registry. It generates and uploads SPDX-format SBOMs by default, with an option to disable this. Registry credentials can come from Docker configuration, with built-in environment credential support for Google, Amazon, Azure, and GitHub container registries. A Terraform provider supports Infrastructure-as-Code workflows. ko supports Go applications only and defaults to CGO_ENABLED=0. Windows container image support is experimental and requires a Windows base image.