Kaniko Rootless Container Builds

# Run Kaniko as a container
docker run \
  -v $(pwd):/workspace \
  -v ~/.docker/config.json:/kaniko/.docker/config.json \
  gcr.io/kaniko-project/executor:latest \
  --dockerfile=/workspace/Dockerfile \
  --context=/workspace \
  --destination=ghcr.io/myorg/myapp:v1.0

apiVersion: batch/v1
kind: Job
metadata:
  name: build-myapp
spec:
  template:
    spec:
      containers:
        - name: kaniko
          image: gcr.io/kaniko-project/executor:latest
          args:
            - --dockerfile=Dockerfile
            - --context=git://github.com/myorg/myapp.git#refs/heads/main
            - --destination=ghcr.io/myorg/myapp:latest
            - --cache=true
            - --cache-repo=ghcr.io/myorg/myapp/cache
          volumeMounts:
            - name: docker-config
              mountPath: /kaniko/.docker/
      volumes:
        - name: docker-config
          secret:
            secretName: registry-credentials
      restartPolicy: Never

# First build: populates cache
--cache=true
--cache-repo=ghcr.io/myorg/myapp/cache

# Subsequent builds: reuses cached layers
# Only changed layers are rebuilt

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build with Kaniko
        uses: aevea/action-kaniko@master
        with:
          image: myorg/myapp
          tag: ${{ github.sha }}
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          cache: true
          cache_registry: ghcr.io/myorg/myapp/cache

apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: kaniko-build
spec:
  params:
    - name: IMAGE
      type: string
  workspaces:
    - name: source
    - name: docker-config
  steps:
    - name: build-and-push
      image: gcr.io/kaniko-project/executor:latest
      args:
        - --dockerfile=$(workspaces.source.path)/Dockerfile
        - --context=$(workspaces.source.path)
        - --destination=$(params.IMAGE)
        - --cache=true
      env:
        - name: DOCKER_CONFIG
          value: $(workspaces.docker-config.path)

# Build for multiple architectures
--customPlatform=linux/amd64
--customPlatform=linux/arm64