github osscontainertools/kaniko v1.29.0
on GitHub

4 hours ago

Update Notice

⚠️ The slim image no longer authenticates to GCR/GAR, ECR and ACR, and drops the gs://, s3:// and azure build contexts, git build contexts and OpenTelemetry export. If you use any of them, switch to latest, which is now about the same size as slim used to be.

In this Release we activated these feature-flags:

⚠️ Several of these flags change how cache keys are computed. Existing cache entries are invalidated, so the first build after upgrading is a full rebuild that repopulates the cache.

⚠️ --reproducible now leaves base layers untouched and keeps the requested image format, so the digest of a reproducible build changes once. A reproducible build from an OCI base is now pushed as OCI instead of docker, pass --image-format=docker to keep the old format.

FF_KANIKO_ADD_CHECKSUM verifies ADD --checksum. A wrong checksum used to pass silently and now fails the build, so update it to the digest of the download.

FF_KANIKO_EXPAND_HEREDOC expands variables in unquoted COPY and ADD heredoc bodies. If a body needs a literal $, quote the delimiter: 

COPY <<'EOF' /etc/motd
costs $5
EOF

FF_KANIKO_PATH_SCOPED_REGISTRY_AUTH matches an auths entry against the repository namespace, so one entry for registry.example.com/org-a covers every repository below it and you can merge your per-repository entries. It is no longer sent to sibling namespaces like registry.example.com/org-b, which now need their own entry.

FF_KANIKO_SHARED_BASE_CACHE keeps downloaded bases in /kaniko/bases after the build, --cleanup does not remove them. If you reuse an executor for many builds, clean that directory yourself.

You can roll-back any of those changes by overriding them in the environment ie. 

job:
  variables:
    FF_KANIKO_PLATFORM_CACHE_KEY: "0"
    FF_KANIKO_CROSS_REPO_MOUNT: "0"

Please also notify us by filing a new issue.

We further removed these feature-flags:

  • FF_KANIKO_RUN_MOUNT_BIND
  • FF_KANIKO_NO_PROPAGATE_ANNOTATIONS
  • FF_KANIKO_VOLUME_SKIP_MKDIR
  • FF_KANIKO_PRESERVE_HARDLINKS
  • FF_KANIKO_BUILDKIT_ARG_ENV_PRECEDENCE
  • FF_KANIKO_PRESERVE_MOUNTED_PATHS
  • FF_KANIKO_DEPRECATE_INTER_STAGE_RESTORE
  • FF_KANIKO_SECUREJOIN_EXTRACTION
  • FF_KANIKO_WARMER_CACHE_LOCK
  • FF_KANIKO_CLEAN_KANIKO_DIR
  • FF_KANIKO_RELATIVE_LINK_TARGETS
  • FF_KANIKO_OCI_WARMER
  • FF_KANIKO_IGNORE_CACHED_MANIFEST

Their behavior is now unconditional, they have no effect and can be removed.

⚠️ The warmer only reads and writes the OCI layout now. Tarballs left in a warmer cache from before v1.28.0 are no longer used, re-run the warmer to populate the cache.

Community Update

@gary-wall made their first contribution in #1205. The warmer now also caches the image index, so builds from a base pinned by index digest work air-gapped.

@gary-wall also joined us as a maintainer, welcome aboard!

Also many thanks to @philou-078 and @hanbyeol for reporting issues fixed in this release.

To get an overview over our feature flags you can check the schedule on https://osscontainertools.org/kaniko/flags/

What's Changed

Security

  • go stdlib v1.26.9: CVE-2026-111943 (eMudhra)

Bugfixes

  • warmer pulls scratch from the registry: by @gary-wall in #1205
  • FF_KANIKO_ISOLATE_CACHE_PUSH=false every cache push also writes the build outputs: #1223
  • warmer leaves nested ARG defaults unexpanded: #1209
  • FF_KANIKO_WARMER_BUILD_ARGS=false warmer lets an ARG default win over --build-arg: #1207
  • warmer pulls stage references that differ in case: #1208
  • FF_KANIKO_WARMER_PREDEFINED_ARGS=false warmer leaves TARGETARCH empty in FROM: #1210

Standardization

  • FF_KANIKO_RUN_HEREDOC_SCRIPT=false run a lone RUN heredoc body as the script: #1216
  • FF_KANIKO_COPY_KEEP_DEST_OWNER=false COPY --chown keeps the owner of an existing destination directory: #1257
  • FF_KANIKO_COPY_SUBDIR_MODE=false directory COPY applies the source mode to existing subdirectories: #1259

Caching

  • FF_KANIKO_CACHE_IMAGE_INDEX=false warmer caches the image index of index-pinned bases: by @gary-wall in #1225
  • FF_KANIKO_FORMAT_INDEPENDENT_CACHE_KEY=false keep --image-format out of cache keys: #1276

Performance

  • relabel cached layers without downloading them: #1275

Usability

  • warmer --dryrun prints which bases it would fetch: #1206
  • graduate feature flags for v1.29.0 release: #870 #1235
  • --predefined-annotations sets the OCI source, revision, version and base image annotations: #1227
  • --provenance attaches a SLSA provenance attestation: #1230
  • FF_KANIKO_NATIVE_INIT=false kaniko acts as its own init process: #1222

Telemetry

  • trace the push, planning and the --reproducible rewrite: #1217

Packaging

  • make the kaniko images reproducible: #1231
  • ship licenses in the images: #1247
  • ship credential helpers as hardlinks to the executor: #1224
  • add busybox and tini sources to the SBOM: #1246
  • reproducible go build of executor and warmer: by @gary-wall in #1269
  • slim image drops the cloud SDKs, go-git and OpenTelemetry: #1279 #1265

Maintenance

  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.66.3 to 1.66.6: #1215 #1255 #1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/ecrpublic from 1.47.3 to 1.47.6: #1215 #1255 #1274
  • build(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3: #1226
  • build(deps): bump github.com/klauspost/cpuid/v2 from 2.4.0 to 2.4.1: #1228
  • build(deps): bump google.golang.org/api from 0.301.0 to 0.308.0: #1229 #1245 #1256 #1264 #1283
  • build(deps): bump go from 1.26.9 to 1.27.3: #1034 #1271
  • build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.14.1 to 1.15.0: #1244
  • build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.31.0 to 2.32.0: #1243
  • build(deps): bump github.com/docker/cli from 29.9.0 to 29.9.2: #1242 #1255
  • build(deps): bump github.com/Microsoft/go-winio from 0.6.3 to 0.6.4: #1242
  • build(deps): bump github.com/moby/buildkit from 0.34.0 to 0.34.1: #1249
  • build(deps): bump step-security/harden-runner from 2.22.1 to 2.22.2: #1253
  • build(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.4.16 to 0.4.19: #1255 #1274
  • build(deps): bump anchore/grype from 0.111.1 to 0.121.0: #1261
  • build(deps): bump k3s-io/k3s from v1.36.2+k3s1 to v1.37.1+k3s1: #1262 #1286
  • build(deps): bump docker engine from 29.7.0 to 29.9.2: #1260
  • build(deps): bump alpine from 3.24.2 to 3.24.3: #1270
  • build(deps): bump docker/login-action from 4.6.0 to 4.7.0: #1272
  • build(deps): bump docker/setup-docker-action from 5.5.0 to 5.6.0: #1272
  • build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.47.3 to 1.47.4: #1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.9 to 1.33.10: #1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.114.3 to 1.114.5: #1274
  • build(deps): bump github.com/docker/docker-credential-helpers from 0.9.10 to 0.9.12: #1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream from 1.7.22 to 1.7.24: #1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.20.9 to 1.20.10: #1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/feature/ec2/imds from 1.20.3 to 1.20.4: #1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/internal/configsources from 1.5.6 to 1.5.7: #1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 from 2.8.6 to 2.8.7: #1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/internal/v4a from 1.5.6 to 1.5.7: #1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding from 1.13.21 to 1.13.22: #1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/internal/checksum from 1.11.7 to 1.11.8: #1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/internal/presigned-url from 1.14.6 to 1.14.7: #1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/internal/s3shared from 1.20.6 to 1.20.7: #1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/signin from 1.10.4 to 1.10.5: #1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/sso from 1.38.4 to 1.38.5: #1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/ssooidc from 1.43.4 to 1.43.5: #1274
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/sts from 1.51.4 to 1.51.5: #1274
  • build(deps): bump github.com/aws/smithy-go from 1.28.5 to 1.28.6: #1274
  • build(deps): bump github.com/googleapis/enterprise-certificate-proxy from 0.3.23 to 0.3.24: #1274
  • build(deps): bump github.com/ProtonMail/go-crypto from 1.4.1 to 1.5.2: #1184
  • build(deps): bump github.com/googleapis/gax-go/v2 from 2.26.2 to 2.27.0: #1282
  • build(deps): bump github.com/dimchansky/utfbom from 1.1.1 to 1.2.0: #1281
  • build(deps): bump github.com/osscontainertools/docker-credential-acr from 0.9.2 to 1.0.0: #1284
  • build(deps): bump registry from 2 to 3: #1288
  • build(deps): bump google/cloud-sdk from 256.0.0-alpine to 590.0.1-alpine: #1297
  • build(deps): bump ubi from ubi8 8.2 to ubi9 9.8: #1295
  • build(deps): bump rabbitmq from 3.7.11 to 4.4.0: #1296

Fork Related

Check out latest releases or
releases around osscontainertools/kaniko v1.29.0

Don't miss a new kaniko release

NewReleases is sending notifications on new releases.

Get notifications