Kaniko, from Google, builds container images from a Dockerfile inside a container or Kubernetes pod, without a Docker daemon and without privileged access. It solves a specific, common problem: how to build images as part of a CI/CD pipeline that itself runs on Kubernetes, where running the Docker daemon would require dangerous privileged mode.

The problem it solves

Building an image traditionally needs the Docker daemon, which needs root and access to the host. In a Kubernetes-based CI system (Tekton, GitLab runners on K8s, Argo Workflows), that means running build pods in privileged mode - a serious security hole, since a privileged pod can compromise the node. Kaniko executes each Dockerfile instruction in userspace inside the pod, snapshots the filesystem between steps, and pushes the finished image to a registry, all without the daemon or root.

# Kaniko as a build step in a Kubernetes pod
- name: build
  image: gcr.io/kaniko-project/executor:latest
  args:
    - --dockerfile=Dockerfile
    - --context=git://github.com/org/repo
    - --destination=registry.example.com/myimage:1.0

How it works

Kaniko reads the Dockerfile, executes commands in the pod's own filesystem, and after each instruction takes a snapshot of the changes to form a layer. It pushes layers directly to the target registry. Because everything happens in userspace within the pod, no daemon and no host privileges are involved.

Kaniko vs Buildah vs BuildKit

All build images without the classic daemon, but their home turf differs. Kaniko is designed for running as a pod inside Kubernetes CI. Buildah targets daemonless builds on a host or generic CI. Docker's own BuildKit (and rootless mode) has also closed much of the gap for daemon-light builds. If your pipeline runs on Kubernetes and needs to build images securely as a job, Kaniko is the well-trodden choice.

Where it fits

  • CI/CD that builds images as Kubernetes jobs (Tekton, Argo, GitLab/Jenkins on K8s).
  • Environments that forbid privileged containers and host daemon access.
  • Pushing built images straight to a registry from inside the cluster.