Kubexa

work in progressThis site is being written now: pages appear and change as the cluster does. The AI layer is the most incomplete part.

kaniko and OSS Container Tools

kaniko builds every image here without a Docker daemon. Google archived it in 2024; a group of maintainers took it over.

tektoncncf

kaniko builds every image this platform runs, inside a Tekton task, with no Docker daemon and no privileged pod. That still works because the maintainers who depend on it took it over after Google archived the project in 2024, forming OSS Container Tools.

The pipeline here pins ghcr.io/osscontainertools/kaniko and mounts the cluster's CA bundle, because egress in this cluster verifies TLS against that bundle rather than the public roots:

- name: kaniko
  image: ghcr.io/osscontainertools/kaniko:v1.28.5
  env:
    - name: SSL_CERT_FILE
      value: /kaniko/ca/ca-certificates.crt

Without those two lines every registry pull fails with certificate signed by unknown authority, which is a confusing way to learn how a cluster's egress is wired.