---
title: kaniko and OSS Container Tools
description: kaniko builds every image here without a Docker daemon. Google archived it in 2024; a group of maintainers took it over.
weight: 10
icons: [tekton, cncf]
tags: [kaniko, tekton, ci, oss]
---

kaniko builds every image this platform runs, inside a Tekton task, with no Docker
daemon and no privileged pod. That still works because the maintainers who depend on it
took it over after Google archived the project in 2024, forming
[OSS Container Tools](https://osscontainertools.org/).

The pipeline here pins `ghcr.io/osscontainertools/kaniko` and mounts the cluster's CA
bundle, because egress in this cluster verifies TLS against that bundle rather than the
public roots:

```
- name: kaniko
  image: ghcr.io/osscontainertools/kaniko:v1.28.5
  env:
    - name: SSL_CERT_FILE
      value: /kaniko/ca/ca-certificates.crt
```

Without those two lines every registry pull fails with `certificate signed by unknown
authority`, which is a confusing way to learn how a cluster's egress is wired.