---
name: "kaniko-in-cluster-image-build"
description: "Build and push Docker images inside Kubernetes clusters without privileged security contexts."
metadata:
  author: "Google Container Tools"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "build docker image in k8s kaniko"
  - "configure kaniko cache"
  - "run kaniko pod"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Kaniko Daemonless In-Cluster Container Image Builds

Configures Google Kaniko: building container images from Dockerfiles inside Kubernetes pods, snapshotting userspace filesystems, pushing to secure registries with secret credentials, and caching build layers to S3.

## When to Invoke
Invoke this skill whenever you need to:
- build docker image in k8s kaniko
- configure kaniko cache
- run kaniko pod

## Execution SOP & Rules
1. Define Kubernetes Pod or Job with container image gcr.io/kaniko-project/executor:latest.
2. Pass build arguments: --context=dir:///workspace --dockerfile=Dockerfile --destination=my-reg/app:tag.
3. Add caching argument: --cache=true --cache-repo=my-reg/app-cache to reuse cached layers.
4. Mount registry authentication credentials file as a secret to /kaniko/.docker/config.json.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.