You can build and push docker/oci images without the need to execute a docker daemon (and requiring privileged containers) thanks to tools like kanikoBuilding and pushing docker/oci images - 图1 and buildahBuilding and pushing docker/oci images - 图2

Using Kaniko

Basic image build

A basic task for building images using kaniko is this. Add --no-push if you don’t want to push the image. This doesn’t take care of registry authentication. See below for an example with registry authentication.

  1.     tasks:
  2.       # kaniko image doesn't have the git command installed
  3.       - name: checkout code
  4.         runtime:
  5.           containers:
  6.             - image: alpine/git
  7.         steps:
  8.           - clone:
  9.           - save_to_workspace:
  10.               contents:
  11.                 - source_dir: .
  12.                   dest_dir: .
  13.                   paths:
  14.                     - '**'
  15.       - name: build docker image
  16.         runtime:
  17.           containers:
  18.             - image: gcr.io/kaniko-project/executor:debug
  19.         shell: /busybox/sh
  20.         steps:
  21.           - restore_workspace:
  22.               dest_dir: .
  23.           #- run: /kaniko/executor --no-push
  24.           - run: /kaniko/executor --destination registry/image
  25.         depends:
  26.           - checkout code

With authentication

For more information refer to the kaniko doc. Kaniko document some ways to authenticate to gcr and aws registries and its images already include a credential helper for amazon ecr.

At the end you should create a docker config.json config file with the required auth data:

  1.     tasks:
  2.       # kaniko image doesn't have the git command installed
  3.       - name: checkout code
  4.         runtime:
  5.           containers:
  6.             - image: alpine/git
  7.         steps:
  8.           - clone:
  9.           - save_to_workspace:
  10.               contents:
  11.                 - source_dir: .
  12.                   dest_dir: .
  13.                   paths:
  14.                     - '**'
  15.       - name: build docker image
  16.         runtime:
  17.           containers:
  18.             - image: gcr.io/kaniko-project/executor:debug
  19.         environment:
  20.           DOCKERAUTH:
  21.             from_variable: dockerauth
  22.         shell: /busybox/sh
  23.         steps:
  24.           - restore_workspace:
  25.               dest_dir: .
  26.           - run:
  27.               name: generate docker config
  28.               command: |
  29.                 cat << EOF > /kaniko/.docker/config.json
  30.                 {
  31.                   "auths": {
  32.                     "https://index.docker.io/v1/": { "auth" : "$DOCKERAUTH" }
  33.                   }
  34.                 }
  35.                 EOF
  36.           - run: /kaniko/executor --destination registry/image
  37.         depends:
  38.           - checkout code

Using Buildah

TODO