[{"_1":2,"_152":-5,"_153":-5},"loaderData",{"_3":4,"_13":14,"_20":21,"_131":132},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","routes/_layout.r.$namespace.$reponame",{"_22":23,"_24":-5,"_25":11,"_26":11,"_27":28,"_29":30,"_31":-5,"_32":11,"_33":34,"_83":-5,"_84":85,"_124":-5,"_125":11,"_126":17,"_127":11,"_128":-5,"_129":130},"canonicalUrl","https://hub.docker.com/r/weiyigeek/kaniko-executor/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","weiyigeek","reponame","kaniko-executor","cloudBuildSource","isAutobuildsAvailable","repo",{"_35":36,"_37":38,"_40":41,"_42":43,"_44":11,"_45":46,"_47":48,"_49":50,"_52":30,"_27":28,"_53":54,"_55":39,"_56":57,"_58":57,"_59":60,"_61":-5,"_62":63,"_64":65,"_66":11,"_67":28,"_68":69,"_74":11,"_75":76,"_80":28,"_81":82},"categories",[],"content_types",[39],"image","date_registered","2022-09-08T05:20:58.529976Z","description"," kaniko 是一个在容器或 Kubernetes 集群内从 Dockerfile 构建容器镜像的工具 ( Build Container Images In Kubernetes )","is_private","last_updated","2023-12-13T04:07:59.295475Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[51],"application/vnd.oci.image.config.v1+json","name","pull_count",176,"repository_type","star_count",1,"status","status_description","active","source","collaborator_count",0,"full_description","[关注「**WeiyiGeek**」公众号](https://www.weiyigeek.top/wechat.html?key=%E6%AC%A2%E8%BF%8E%E5%85%B3%E6%B3%A8)\n\n设为「**特别关注**」每天带你玩转网络安全运维、应用开发、物联网IOT学习！\n\n希望各位看友【关注、点赞、评论、收藏、投币】，助力每一个梦想。\n\n[-] 作者主页：[https://www.weiyigeek.top](https://www.weiyigeek.top)\n\n[-] 作者博客：[https://blog.weiyigeek.top](https://blog.weiyigeek.top)\n\n---\n\n## 0x00 前言简述\n### 快速介绍\n**什么是Kaniko?**\n> kaniko 是一个在容器或 Kubernetes 集群内从 Dockerfile 构建容器镜像的工具 ( Build Container Images In Kubernetes )。\n\n温馨提示: kaniko不是谷歌官方发布支持的产品.\n\n**为啥用Kaniko?**\n> 由于 kaniko 不依赖于 Docker 守护进程，并且完全在用户空间中执行 Dockerfile 中的每个命令。这使得能够在轻松或安全地运行在`无Docker守护程序的环境`（如标准Kubernetes集群 V1.24.x）中构建容器映像。\n\n\n**Kaniko是如何工作的?**\nkaniko 执行器镜像负责从 Dockerfile 构建镜像并将其推送到注册表，其流程大致如下：\n- 首先在执行者图像中，我们提取基础镜像的文件系统（Dockerfile 中的 FROM 镜像）。 \n- 其次我们执行 Dockerfile 中的命令，之后在用户空间中对文件系统进行快照每一个。 \n- 然后在每个命令之后，我们将一层更改的文件附加到基础图像（如果有）并更新图像元数据。 \n\n\n**Kaniko已知功能问题**\n- kaniko 不支持构建 Windows 容器。 \n- kaniko 不支持 v1 Registry API。(由于其不安全性当前基本都是使用V2协议, 例如 Harbor)\n- kaniko 不支持在除官方kaniko映像之外的任何Docker映像中运行二进制Kanico可执行文件（即YMMV）。\n\n\n### 参考来源\n项目地址: https://github.com/GoogleContainerTools/kaniko\n图像镜像仓库: gcr.io/kaniko-project/executor\n国内镜像: weiyigeek/kaniko-executor:latest\n\n---\n\n### 小试牛刀之在containerd.io中构建并发布镜像\n描述：当我们的环境中只安装了containerd.io 容器运行时没有 Docker 或者 Kubernetes 环境时，我们也可以采用kaniko进行镜像构建与发布，具体操作流程步骤如下：\n\n**环境说明**\n```bash\n$ lsb_release -a\nDistributor ID: Ubuntu\nDescription: Ubuntu 20.04.3 LTS\nRelease: 20.04\nCodename: focal\n\n$ containerd -v\ncontainerd containerd.io 1.4.12 7b11cfaabd73bb80907dd23182b9347b4245eb5d\n\n$ ctr -v\nctr containerd.io 1.4.12\n```\n\n温馨提示: 此处使用的是 Ubuntu 20.04 操作系统, 该系统已做安全加固和内核优化符合等保2.0要求【[SecOpsDev/Ubuntu-InitializeSecurity.sh at master · WeiyiGeek/SecOpsDev](https://github.com/WeiyiGeek/SecOpsDev/blob/master/OS-%E6%93%8D%E4%BD%9C%E7%B3%BB%E7%BB%9F/Linux/Ubuntu/Ubuntu-InitializeSecurity.sh) 】, 如你的Linux未进行相应配置环境可能与读者有些许差异, 如需要进行(windows server、Ubuntu、CentOS)安全加固请参照如下加固脚本进行加固, 请大家疯狂的star 。\n加固脚本地址:【 https://github.com/WeiyiGeek/SecOpsDev/blob/master/OS-%E6%93%8D%E4%BD%9C%E7%B3%BB%E7%BB%9F/Linux/Ubuntu/Ubuntu-InitializeSecurity.sh 】\n\n温馨提示：如果你使用的是最新 Ubuntu 22.04 操作系统，并需要对其安全加固和内核优化以满足等保2.0要求可参考如下加固脚本【[https://github.com/WeiyiGeek/SecOpsDev/tree/master/OperatingSystem/Security/Ubuntu](https://github.com/WeiyiGeek/SecOpsDev/tree/master/OperatingSystem/Security/Ubuntu)】。\n\n![Ubuntu 22.04加固脚本示例图](https://github.com/WeiyiGeek/SecOpsDev/raw/master/OperatingSystem/Security/Ubuntu/Readme.assets/image-20220823143235577.png)\n\n\n
\n\n**操作流程**\n\n步骤 01.此处假设你已经安装配置好containerd.io了，如果没有安装配置请参考此篇文章【 1.Containerd容器运行时初识与尝试 - https://blog.weiyigeek.top/2021/6-27-570.html 】，此处不再累述。\n\n步骤 02.验证 containerd.io 服务状态以及提前拉取 `kaniko-executor:latest` 镜像以加快构建速度，此处将镜像拉到默认的名称空间下。\n\n```bash\n$ systemctl status containerd.service\n● containerd.service - containerd container runtime\n Loaded: loaded (/lib/systemd/system/containerd.service; enabled; vendor preset: enabled)\n Active: active (running) since Thu 2022-09-08 11:48:30 CST; 4h 49min ago\n Docs: https://containerd.io\n Process: 561811 ExecStartPre=/sbin/modprobe overlay (code=exited, status=0/SUCCESS)\n Main PID: 561812 (containerd)\n Tasks: 106\n Memory: 4.0G\n\n$ ctr -n default images pull registry.cn-hangzhou.aliyuncs.com/weiyigeek/kaniko-executor:latest\n```\n\n\n步骤 03.准备登录 hub docker 的账号以及密码，你可以按照下述的流程进行生成config.json文件。\n\n```bash\nmkdir /storage/dev/soft/kaniko/{config,demo1}\ncd /storage/dev/soft/kaniko/config\n# 生成认证所需的凭据\n# BASE64 编码，注意下述为格式为你的hub账号:你的hub密码\nAUTH=$(echo -n \"weiyigeek:password\" | base64)\n# BASE64 解码\necho ${AUTH} | base64 -d\n# 使用该方法可以解析变量 AUTH (值得注意)\ncat > config.json <

weiyigeek/kaniko-executor

Tags for weiyigeek/kaniko-executor