osscontainertools/kaniko v1.29.1 on GitHub

Community Update

@mvdberge made their first contribution in #1316. They traced unreadable node_modules entries in a real image to spurious whiteouts that every release since v1.27.0 writes into later stages, and mapped the cached-layer variant fixed in #1383.

@tran4774 made their first contribution in #1251. They put substantial work into making kaniko faster, from build metrics to cached file hashes. Parallel snapshot hashing behind FF_KANIKO_PARALLEL_HASH is the first piece to land.

A special shoutout to @gary-wall, who landed 13 changes this release. Most notably cross-stage bind mounts and --cache-from/--cache-to separation.

What's Changed

Security

golang.org/x/net v0.61.0: CVE-2026-78661 CVE-2026-97045
🔗 FF_KANIKO_CONFINE_HARDLINK_TARGET=true block hardlinks into the kaniko directory: by @stevebeattie in #1367
skip mount relocation into ignored paths: #1370

Bugfixes

a later stage whites out the files of an earlier stage: by @mvdberge in #1316
cross-stage COPY ignores an ENV shadowing an ARG: by @Dodothereal in #1323
RUN --mount deletes output next to the mount: #1336
ADD to a relative destination without WORKDIR leaves the layer empty: #1339
bake --dryrun deletes the filesystem between targets: #1364
--reproducible keeps build-time mtimes of a local base stage: #1368
COPY --from ignores predefined and inherited ARGs: #1376

Standardization

FF_KANIKO_LOCAL_UNPACK_REQUIRES_TAR=false ADD copies a non-tar archive as is: by @gary-wall in #1330
FF_KANIKO_ADD_CHOWN_TAR=false honour ADD --chown on extracted archives: by @gary-wall in #1333
FF_KANIKO_RUN_MOUNT_TMPFS=false support RUN --mount=type=tmpfs: by @gary-wall in #1315
FF_KANIKO_ADD_FOLLOW_SYMLINK=false ADD <url> follows a destination symlink: by @gary-wall in #1338 #1340
FF_KANIKO_RUN_MOUNT_BIND_RELATIVE=false resolve relative bind mounts against WORKDIR: by @gary-wall in #1337
FF_KANIKO_RUN_CROSS_STAGE_BIND_MOUNT=false support RUN --mount=type=bind,from: by @gary-wall in #1280
reject variables in COPY --from: #1378

Caching

FF_KANIKO_CACHE_COPY_FROM=false warmer caches COPY --from=<image>: by @gary-wall in #1334
FF_KANIKO_SNAPSHOT_TRACK_CACHED_LAYERS=false stop storing cached files twice: #1383

Performance

reuse pooled copy buffers: #1313 #1314
FF_KANIKO_PARALLEL_HASH=false hash snapshot files in parallel: by @tran4774 in #1251

Usability

--cache-from and --cache-to: by @gary-wall in #1346
bake per-target cache_from and cache_to: #1350
--require-digest rejects unpinned bases: by @gary-wall in #1362
bake per-target context and dockerfile: by @gary-wall in #1345
--require-add-checksum rejects remote ADD without --checksum: by @gary-wall in #1375

Telemetry

trace fetching the build context: #1343
background telemetry export: #1344

Packaging

list every source file in the image SBOMs: #1304

Maintenance

build(deps): bump golang: #1307 #1317 #1325 #1355 #1380
build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.10 to 1.33.16: #1308 #1310 #1335 #1361 #1382
build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.20.10 to 1.20.16: #1308 #1310 #1335 #1361 #1382
build(deps): bump github.com/aws/aws-sdk-go-v2/service/signin from 1.10.5 to 1.12.4: #1308 #1310 #1335 #1361 #1382
build(deps): bump google.golang.org/api from 0.308.0 to 0.311.0: #1309 #1328 #1358
build(deps): bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.66.6 to 1.67.5: #1311 #1319 #1335 #1361 #1382
build(deps): bump google.golang.org/grpc from 1.84.0 to 1.85.0: #1312
build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.47.4 to 1.47.8: #1310 #1361 #1382
build(deps): bump github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream from 1.7.24 to 1.7.26: #1310 #1361
build(deps): bump github.com/aws/aws-sdk-go-v2/feature/ec2/imds from 1.20.4 to 1.20.8: #1310 #1361 #1382
build(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.4.19 to 0.5.5: #1310 #1335 #1361 #1382
build(deps): bump github.com/aws/aws-sdk-go-v2/internal/configsources from 1.5.7 to 1.5.11: #1310 #1361 #1382
build(deps): bump github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 from 2.8.7 to 2.8.11: #1310 #1361 #1382
build(deps): bump github.com/aws/aws-sdk-go-v2/internal/v4a from 1.5.7 to 1.5.11: #1310 #1361 #1382
build(deps): bump github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding from 1.13.22 to 1.13.24: #1310 #1361
build(deps): bump github.com/aws/aws-sdk-go-v2/service/internal/checksum from 1.11.8 to 1.11.12: #1310 #1361 #1382
build(deps): bump github.com/aws/aws-sdk-go-v2/service/internal/presigned-url from 1.14.7 to 1.14.11: #1310 #1361 #1382
build(deps): bump github.com/aws/aws-sdk-go-v2/service/internal/s3shared from 1.20.7 to 1.20.11: #1310 #1361 #1382
build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.114.5 to 1.114.9: #1310 #1361 #1382
build(deps): bump github.com/aws/aws-sdk-go-v2/service/sso from 1.38.5 to 1.39.4: #1310 #1335 #1361 #1382
build(deps): bump github.com/aws/aws-sdk-go-v2/service/ssooidc from 1.43.5 to 1.44.4: #1310 #1335 #1361 #1382
build(deps): bump github.com/aws/aws-sdk-go-v2/service/sts from 1.51.5 to 1.51.9: #1310 #1361 #1382
build(deps): bump github.com/aws/smithy-go from 1.28.6 to 1.28.8: #1310 #1352
build(deps): bump step-security/harden-runner from 2.22.2 to 2.22.4: #1318 #1381
build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.32.0 to 2.33.0: #1321
build(deps): bump google.golang.org/genproto/googleapis/api from 0.0.0-20261012220534-4341edf3f941 to 0.0.0-20261026165753-2ffab32bce7e: #1321
build(deps): bump github.com/moby/sys/user from 0.4.1 to 0.5.0: #1322
build(deps): bump github.com/aws/aws-sdk-go-v2/service/ecrpublic from 1.47.6 to 1.47.11: #1319 #1335 #1361 #1382
build(deps): bump golang.org/x/net from 0.61.0 to 0.62.0: #1320
build(deps): bump busybox: #1326 #1331
build(deps): bump cloud.google.com/go/auth from 0.24.1 to 0.24.3: #1327 #1361
build(deps): bump cloud.google.com/go/auth/oauth2adapt from 0.3.0 to 0.3.1: #1327
build(deps): bump twuni/docker-registry.helm from v2.2.2 to v3.0.0: #1287
build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/storage/azblob from 1.8.2 to 1.8.3: #1347
build(deps): bump github.com/moby/buildkit from 0.34.1 to 0.34.2: #1347
build(deps): bump github.com/klauspost/cpuid/v2 from 2.4.1 to 2.4.2: #1347
build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.23.3 to 1.24.0: #1348
build(deps): bump github.com/docker/cli from 29.9.2 to 29.9.3: #1352
build(deps): bump docker/login-action from 4.7.0 to 4.8.0: #1356
build(deps): bump sigstore/cosign-installer from 4.1.2 to 4.1.3: #1356
build(deps): bump docker/setup-docker-action from 5.6.0 to 5.7.0: #1356
build(deps): bump github.com/googleapis/enterprise-certificate-proxy from 0.3.24 to 0.3.25: #1361
build(deps): bump alpine from 3.24.3 to 3.24.4: #1360 #1384
build(deps): bump google.golang.org/genproto/googleapis/rpc from 0.0.0-20261019180522-ce908d29299b to 0.0.0-20261026165753-2ffab32bce7e: #1358
build(deps): bump github.com/osscontainertools/docker-credential-acr from 1.0.0 to 1.0.1: #1382
build(deps): bump github.com/spf13/pflag from 1.0.10 to 1.1.0: #1382

Fork Related

update docs: #1303
race detector in integration tests: #1305 #1351 #1366
test improvements: #1300 #1302 #1341 #1342
coderabbit config: by @gary-wall in #1359
failing tests check the error message: by @gary-wall in #1379