Tags

Tags give the ability to mark specific points in history as being important

  • v1.25.19-1

    protected
    92084366 · chore(release): v1.25.19-1 ·
    Release: kaniko v1.25.19-1 
    - `.gitlab/issue_templates/` and `.gitlab/merge_request_templates/`.
  Vulnerability report mirrors SECURITY.md's reporter fields and opens
  confidential; Bug and Upstream request split build-side issues from
  upstream kaniko behavior; Default is a contributor checklist drawn
  from CONTRIBUTING.md.
- Four plain-bash release scripts, added to `scripts/`, with `--help` on
  each. `set-release.sh` moves every version pin in the tree,
  `check-versions.sh` proves they agree, `tag-release.sh` builds the
  annotated tag from the CHANGELOG section for the release, and
  `go-checksum.sh` fetches the published Go tarball digests Renovate
  cannot compute. A release previously moved pins by hand across the
  documentation and examples.
- `container_scanning` now reports Go modules inside the FIPS debug
  executor binary, not only OS packages.
  `CS_DISABLE_LANGUAGE_VULNERABILITY_SCAN` is `"false"` for that job;
  the upstream template defaults it to `"true"`. The change is in
  reporting, not in the build. The Go findings the report was blind to
  at the time (moby/go-archive, docker/docker, buildkit, grpc) now
  appear, and the module overrides this release carries answer the last
  two.
- Functional smoke jobs for the five variants that never executed in
  CI: `debug-smoke`, `standard-smoke`, `standard-fips-smoke`,
  `warmer-roundtrip`, and `warmer-fips-roundtrip`. The standard images
  run through docker-in-docker rather than as a CI job `image:`, so the
  pushed bytes execute under their own `ENTRYPOINT` with the executor's
  real arguments instead of a job-script shell. The warmer jobs fill a
  cache directory with the base image, then require the matching
  executor to read it back out. All six variants now execute on merge
  request and tag pipelines; before this the pipeline ran the executor
  on the FIPS debug image alone.
- A `version-consistency` job running `check-versions.sh` on merge
  request, default-branch, and tag pipelines. On a tag pipeline it also
  requires the tree to name the tag being released.
- A `shellcheck` job over `scripts/*.sh` on the same three pipeline
  types, failing on any finding. The release scripts had no check of
  their own before this.
- The `osv-verdict` catalog component in the `test` stage. It fails only
  on a finding the merge-base did not already carry, and OSV carries
  malicious-package advisories that Dependency Scanning does not.
- An `ARG KANIKO_VERSION` default in the three Dockerfiles. Without one,
  the local build documented in `.ai/merge-requests.md` reached
  `git clone --branch ""` and failed.
- A `verify-reproducibility` job, matrixed over the standard and FIPS
  flavors, building the `Dockerfile.standard` builder stage from source
  twice with `--no-cache` and failing unless the two `/out/executor`
  binaries and the `/kaniko/executor` already pushed for that flavor all
  hash identically. `scripts/verify-reproducibility.sh` runs the same
  check locally against podman or docker.
- A `nonubi-build-smoke` job, six matrix instances, building `alpine`
  and `busybox` bases through three of the four executor variants
  (`-fips` excepted) on merge request and tag pipelines. It reads the `/usr/bin` entry count from
  the base image and fails the build if the count inside it disagrees,
  if `ls` answers as GNU coreutils, or if a Red Hat release file is
  present. Every other smoke job builds a UBI base on what used to be a
  UBI runtime, where the two coincide and a runtime file of ours is
  indistinguishable from the base's own.
- `job-image-smoke` and `job-image-fips-smoke`, asserting that each
  debug image resolves `sh` and `grep` on `PATH` and reports the
  upstream tag. GitLab Runner requires exactly that of a job `image:`.
  `debug-smoke`, `fips-smoke` and `fips-only-smoke` run their scripts
  through that same shell, so they exercise the contract, but each is
  written to test the executor and would report a shell fault as an
  executor fault. These two assert it directly.
- An OpenVEX 0.2.0 document per variant, attached to the image digest as
  a `cosign` attestation, covering the Go module findings the pinned
  upstream tag cannot move away from. Eleven statements, identical
  across the six variants because one builder stage and one module graph
  produce every binary: six `affected`, where a `replace` directive in
  upstream's `go.mod`, a retired module path, or a module that was never
  tagged holds the module below the fix, and five `not_affected`, where
  the published binary does not link the vulnerable package. Each
  statement carries the advisory identifiers OSV lists for it, so one
  document matches both scanners' spellings. Verify with
  `cosign verify-attestation --type openvex` and apply with
  `grype --vex` or `trivy image --vex`; measured on the standard digest,
  Trivy 0.74.0 reports 6 findings without the document and 5 with it,
  and Grype 0.118.0 reports 7 and 3, because an `affected` statement
  annotates rather than suppresses; between them those are every finding
  either scanner reports.

- SECURITY.md's response promises now describe what the project does.
  Fixes ship in public through the tag path rather than from a private
  branch, a High is triaged in 30 days and patched in that window where
  a fix exists, and a finding with no upstream or vendor fix is recorded
  as detected with that reason instead of dismissed. A new `## Between
  releases` section names the scheduled security policy that scans the
  six `latest` tags every Sunday at 06:00 UTC and the second policy that
  resolves what those scans stop detecting, because nothing in this
  project's own `.gitlab-ci.yml` scans an image outside a merge request
  that touches the build and a tag pipeline. SAST is struck from the
  scanner lists: the template is included but no analyzer matches this
  tree.
- The site and README no longer say the pipeline builds and exercises
  the images on every run. Image jobs and the smoke jobs share
  `.release-only-rules`, so they run on a merge request that touches the
  build and on a release tag, and a merge to `main` builds and scans no
  image. Corrected at `site/index.html` in the headline claims, the
  design list, and the pre-release gates paragraph, and in the FIPS
  paragraph of README.md.
- The documented `cosign` certificate identity is
  `refs/tags/v[0-9].*`, dropping the `refs/heads/main` alternative it
  also allowed. Every image job requires a merge request event or a tag,
  so no default-branch pipeline signs anything and the `main` arm
  matched nothing a reader could pull. Tightened on all four surfaces
  that carry the command, and holding for images released at `v1.25.19`
  and later: SECURITY.md, README.md, the `## Get it` footer
  `scripts/tag-release.sh` writes into the release notes, and
  `site/index.html`. A mirror taken before 2026-09-05 may hold a
  `latest*` digest signed at `refs/heads/main`.
- The standard and warmer variants (`:<tag>`, `:<tag>-fips`,
  `:<tag>-warmer`, `:<tag>-fips-warmer`) ship `FROM scratch`, holding
  three paths: the binary, the CA bundle the builder copies out of UBI,
  and an empty Docker config directory. They have no shell, no package
  manager, and no operating system packages, so a scanner reports the Go
  modules in the binary and no rpm database, as upstream's kaniko image
  and Chainguard's do; the warmer variants lose their `microdnf install`
  step with the base. The runtime is bare by design: kaniko unpacks a
  build's base image over its own root without clearing it first, so
  what the runtime image ships is what a customer's `RUN` steps can see.
  `PATH` is absolute rather than appended to a base's,
  `org.opencontainers.image.base.name` is `scratch`, and a new
  `io.gitlab.public-sector.kaniko.builder` label names the UBI image
  that compiled the binary.
- The debug variants (`:<tag>-debug`, `:<tag>-fips-debug`) ship
  `FROM scratch` too, with a busybox compiled from source in the UBI9
  builder at `/busybox` and `/bin/sh` symlinked into it. The shell a
  GitLab CI job image needs now comes from there, last on `PATH` and in
  a directory no base image names, so it shadows nothing a customer's
  build brought with it. busybox is pinned at 1.36.1, the newest
  release busybox.net marks stable, with its tarball checksum-verified
  against the digest busybox.net publishes and its URL overridable
  through `BUSYBOX_URL`; each debug image carries the version as the
  `io.gitlab.public-sector.kaniko.busybox_version` label.
- All six images report the upstream tag from `/kaniko/executor version`
  instead of `unset`. The three Dockerfiles pass the version ldflag
  upstream's own Makefile passes, with `KANIKO_VERSION` as the value.
- The build raises `golang.org/x/crypto` to `v0.56.0`, above the
  `v0.53.0` the pinned upstream tag requires as an indirect
  dependency. Three advisories against its `ssh` package affect that
  version: `CVE-2026-56854`, `CVE-2026-78662` and `CVE-2026-56855`.
  The images' source is still `chainguard-forks/kaniko` at
  `KANIKO_VERSION`, and no upstream file is edited: the override
  changes a build input, and because upstream vendors its modules the
  builder regenerates `vendor/` for it to take effect. Overrides are
  declared in `go-overrides.txt`, the only place their versions are
  written, and each image carries the list in its
  `io.gitlab.public-sector.kaniko.go_overrides` label, or `none`.
  `scripts/check-versions.sh` fails the pipeline once upstream
  requires the module at or above the overridden version, so an
  override cannot outlive the advisory it answers. Same upstream
  source, new binary.
- The build raises `google.golang.org/grpc` to `v1.83.1` and
  `github.com/moby/buildkit` to `v0.31.1`, above the `v1.82.1` and
  `v0.30.0` the pinned upstream tag requires. That answers three
  advisories the scanner reported: `CVE-2026-84304` (high) against
  grpc, and `CVE-2026-61711` (medium) and `CVE-2026-61712` (low)
  against buildkit. Both entries join `golang.org/x/crypto` in
  `go-overrides.txt`, so every image's
  `io.gitlab.public-sector.kaniko.go_overrides` label names three
  modules.
- `scripts/tag-release.sh` appends a `## Get it` footer to the release
  tag body: the six image references, a `docker pull` line for the
  default variant, the `cosign verify` block from SECURITY.md with the
  tag substituted, and a permalink to this CHANGELOG section. The
  CHANGELOG section itself is still all `--dry-run` extracts from; the
  footer is fixed and derived from the tag. README's `## Verification`
  now inlines the same three commands instead of sending the reader to
  SECURITY.md for them, and the badge row gains a latest-release badge
  and a signed/SLSA badge; SECURITY.md stays the long form both link
  to.
- Documentation pass before announcement: each fact lives in one file,
  README and the site describe Renovate's tracking as it works, the
  `latest` tags are documented, and about 200 words are gone.
- SECURITY.md's confidential-issue link now pre-selects the
  Vulnerability report template.
- CONTRIBUTING.md carries a `Releasing` section with four numbered
  procedures, one per trigger: an upstream kaniko release, a base-image
  rebuild, a Go toolchain bump, and a busybox bump. A base-image fix
  between upstream releases now ships as `vX.Y.Z-N`, where the upstream
  source is unchanged and only the git tag and image tags carry the
  suffix.
- Commit trailers follow the reference project's contributing standard:
  `Signed-off-by:` on every commit, `AI-Assisted:` and `AI-Tools:` where
  an AI tool touched the diff, and `Government-Work:` for U.S. federal
  employees. These replace `Co-Authored-By:`.
- `.reference.yaml` registers two exemptions with reasons: LICENSE is
  the Apache-2.0 text inherited from the upstream fork and carries no
  discrete GitLab holder line, and CHANGELOG.md no longer mentions the
  `Changelog:` trailer the changelog standard asks for. The file
  previously claimed no exemptions while failing the license standard.
- `renovate.json` no longer restates `automerge` or `labels`, which the
  shared preset owns. The rule descriptions name the script to run.
- `GOFIPS140_VERSION` is commented as a compliance pin, so it does not
  read as a Renovate-managed version that has gone stale.
- `.release-only-rules` now also gates on `rules:changes` for merge
  request pipelines: the image-touching jobs (build, sign, sbom, attest,
  scan, verify, smoke) run only when a Dockerfile, `.gitlab-ci.yml`,
  `scripts/`, `.hadolint.yaml`, or `go-overrides.txt` changed. A
  docs-only MR previously built, signed, attested, verified,
  smoke-tested, and scanned all six variants. Tag pipelines are
  unaffected and still build every variant unconditionally.
- Corrected a documentation error that the move to `scratch` then made
  moot: README, SECURITY.md, CONTRIBUTING.md, `.gitlab-ci.yml`
  comments, and the Dockerfile header comments described the standard
  and warmer variants (and their FIPS builds) as shell-less while those
  variants still ran on a UBI9-micro base carrying `bash` and
  coreutils, verified directly against the running images. The
  correction said no package manager instead. On `scratch` those four
  variants carry no shell, so the original wording is accurate again.
- Documented that the go module override moves the pinned module's
  requirements too: raising `golang.org/x/crypto` to `v0.56.0` also
  raised `golang.org/x/net` from `v0.56.0` to `v0.57.0`,
  `golang.org/x/sync` from `v0.21.0` to `v0.22.0`, `golang.org/x/sys`
  from `v0.46.0` to `v0.47.0`, and `golang.org/x/text` from `v0.39.0`
  to `v0.41.0`, none of which the
  `io.gitlab.public-sector.kaniko.go_overrides` label names.
  SECURITY.md now points to the SBOM attestation and `go version -m`
  for the complete list.

- The `Changelog:` commit trailer and every claim of a changelog
  generator, from CONTRIBUTING.md, CHANGELOG.md, SECURITY.md and the
  `.ai/` topic files. No generator was ever wired up. CHANGELOG.md is
  written by hand in the release MR and is the only source for release
  notes.
- `UBI_VERSION`. It was a CI variable at `9.8`, passed to all six
  container builds, declared in each Dockerfile with a stale default of
  `9.5`, and interpolated by nothing. `UBI_IMAGE`, `UBI_MINIMAL_IMAGE`
  and `UBI_MICRO_IMAGE` are what pin the bases.
- The `UBI_MICRO_IMAGE` build argument, from `Dockerfile.standard`. That
  runtime stage is `FROM scratch` and takes no base image reference.
  `UBI_IMAGE` pins the builder in all three Dockerfiles, so an airgap
  consumer still redirects every base it pulls; a caller passing the
  retired argument gets a warning from the build tool.
- The `UBI_MINIMAL_IMAGE` build argument and the `microdnf install`
  step it fed, from `Dockerfile.debug` and `Dockerfile.warmer`. Those
  runtime stages are `FROM scratch` and take no base image reference, so
  `UBI_IMAGE` and `BUSYBOX_URL` are what an airgap consumer redirects; a
  caller passing the retired argument gets a warning from the build
  tool. A debug image can no longer install a package at job time.
  Upstream's debug image cannot either.
- `examples/kaniko-warmer.gitlab-ci.yml`, held. Its cache path never
  reached the build job (fixed in history), and with that fixed kaniko
  v1.25.19 pushes an invalid manifest whenever the base image is
  OCI-typed (upstream kaniko#2423 and #2713; fix PR #3231 unmerged since
  2024). The warmer variants still ship; the executor cannot consume
  their output for OCI bases.

- `chainguard-forks/kaniko` v1.25.19, from `KANIKO_VERSION` in
  `.gitlab-ci.yml` and the `ARG KANIKO_VERSION=v1.25.19` default in the
  three Dockerfiles. The rebuild suffix is not an upstream component.
- `go` 1.27.0, from `GO_VERSION: "1.27.0"` in `.gitlab-ci.yml`, with
  `ARG GO_VERSION=1.27.0` as the matching Dockerfile default.
- `ubi` `registry.access.redhat.com/ubi9/ubi:9.8-1788245065`, the
  `UBI_IMAGE` builder stage in all three Dockerfiles. The `ubi9-minimal`
  and `ubi9-micro` references the `v1.25.19` block names are gone with
  the runtime bases.
- Runtime base `scratch`, all six variants.
- `busybox` 1.36.1, the two debug variants.
- `GOFIPS140` v1.0.0, the three FIPS variants.
- Go module overrides, from `go-overrides.txt`:
  `golang.org/x/crypto@v0.56.0`, `google.golang.org/grpc@v1.83.1`, and
  `github.com/moby/buildkit@v0.31.1`.
- `public-sector/pipeline` catalog components at `@6`. The `v1.25.19`
  block names `@v6.2.1`; commit `bf72496`, "chore(ci): pin the catalog
  major and declare reference v2.2.0", moved every component pin to the
  floating major.

- `registry.gitlab.com/gitlab-com/public-sector/kaniko:v1.25.19-1`
- `registry.gitlab.com/gitlab-com/public-sector/kaniko:v1.25.19-1-fips`
- `registry.gitlab.com/gitlab-com/public-sector/kaniko:v1.25.19-1-debug`
- `registry.gitlab.com/gitlab-com/public-sector/kaniko:v1.25.19-1-fips-debug`
- `registry.gitlab.com/gitlab-com/public-sector/kaniko:v1.25.19-1-warmer`
- `registry.gitlab.com/gitlab-com/public-sector/kaniko:v1.25.19-1-fips-warmer`

```shell
docker pull registry.gitlab.com/gitlab-com/public-sector/kaniko:v1.25.19-1
```

Verify the signature, SBOM, and provenance before you rely on them
([`SECURITY.md`](https://gitlab.com/gitlab-com/public-sector/kaniko/-/blob/v1.25.19-1/SECURITY.md#verifying-an-image) has the long form):

```shell
IMAGE=registry.gitlab.com/gitlab-com/public-sector/kaniko:v1.25.19-1
IDENTITY='^https://gitlab\.com/gitlab-com/public-sector/kaniko//\.gitlab-ci\.yml@refs/tags/v[0-9].*$'

cosign verify \
  --certificate-identity-regexp "$IDENTITY" \
  --certificate-oidc-issuer https://gitlab.com \
  $IMAGE

cosign verify-attestation --type cyclonedx \
  --certificate-identity-regexp "$IDENTITY" \
  --certificate-oidc-issuer https://gitlab.com \
  $IMAGE

cosign verify-attestation --type slsaprovenance1 \
  --certificate-identity-regexp "$IDENTITY" \
  --certificate-oidc-issuer https://gitlab.com \
  $IMAGE

cosign verify-attestation --type openvex \
  --certificate-identity-regexp "$IDENTITY" \
  --certificate-oidc-issuer https://gitlab.com \
  $IMAGE
```

Full changelog: https://gitlab.com/gitlab-com/public-sector/kaniko/-/blob/v1.25.19-1/CHANGELOG.md#v12519-1---2026-09-08
    Verified

  • v1.25.19

    protected
    2d8e277a · chore(release): re-cut v1.25.19 on UBI 9.8 ·
    Release: kaniko v1.25.19 
    kaniko v1.25.19

First release under the mirrored tag scheme: the tag names the chainguard-forks/kaniko tag the images were built from. Six variants on UBI 9.8 and Go 1.27.0; the three FIPS variants build against the Go Cryptographic Module v1.0.0 (CMVP certificate #5247).

- The fips-strict variant is retired. Its patch worked around golang/go#78178, which Go 1.27 fixes; the plain FIPS images now build under `GODEBUG=fips140=only`, and a regression guard fails the pipeline if the refusal returns. Consumers of `-fips-strict-debug` move to `-fips-debug`.
- The Go toolchain tarball is SHA256-verified against go.dev before use, and every image carries `io.gitlab.public-sector.kaniko.upstream` and `upstream_version` labels.
- Documentation states only what the pipeline demonstrates: SECURITY.md follows the reference security-md standard, README carries the support posture and the published architecture (linux/amd64), and the examples pin tags that exist.
- Re-tagged on UBI 9.8 before any announcement. The first v1.25.19 images, tag, and release, built on UBI 9.5, were removed.

Full details in CHANGELOG.md.
    Verified

  • v1.0.2

    protected
    5d3213d2 · ci: adopt pipeline/release@v3.3.2 + bump other catalog pins ·
    Release: kaniko v1.0.2 
    **v1.0.2 — catalog adoption.**

Closes the architectural loop on the v1.0.1 release-page backtick bug: kaniko now consumes the fixed `pipeline/release@v3.3.2` catalog component instead of the inline `release-create` job introduced in MR !10. Every other catalog pin gets a uniform bump to v3.3.2.

- **Adopted `pipeline/release@v3.3.2` catalog component.** Replaces the inline `release-create` job that had the shell-eval-on-backticks bug and the `--no-update` re-run failure. The catalog reads the tag annotation directly into a file and passes it to `glab release create --notes-file`, so backtick-delimited content survives intact and force-pushed tags update the release page idempotently.
- **Uniform pin bump to v3.3.2.** Every catalog component (`container-scan-summary`, `compliance`, `vale`, `container`, `container-sbom`, `container-attest`, `verify`) moves from `@v3.2.0` to `@v3.3.2` in one consistent bump. v3.3.2 also fixes the `GOVULNCHECK_VERSION` pin that was silently blocking catalog tag pipelines from reaching the release stage.

Seven variants per release, signed and attested end-to-end. Same shape as [v1.0.0](https://gitlab.com/gitlab-com/public-sector/kaniko/-/releases/v1.0.0), rebuilt against the `refs/tags/v1.0.2` identity.

| Tag                              | Variant   | Crypto                              |
| -------------------------------- | --------- | ----------------------------------- |
| `:v1.0.2`                        | standard  | Go stdlib                           |
| `:v1.0.2-fips`                   | standard  | Go 1.25 FIPS 140-3                  |
| `:v1.0.2-debug`                  | debug     | Go stdlib                           |
| `:v1.0.2-fips-debug`             | debug     | Go 1.25 FIPS 140-3                  |
| `:v1.0.2-fips-strict-debug`      | debug     | FIPS 140-3 + P-curve patch          |
| `:v1.0.2-warmer`                 | warmer    | Go stdlib                           |
| `:v1.0.2-fips-warmer`            | warmer    | Go 1.25 FIPS 140-3                  |

- **Docs:** <https://gitlab-com.gitlab.io/public-sector/kaniko/>
- **Source:** <https://gitlab.com/gitlab-com/public-sector/kaniko>
- **Catalog adoption MR:** [!13](https://gitlab.com/gitlab-com/public-sector/kaniko/-/merge_requests/13)
- **Previous release:** [v1.0.1](https://gitlab.com/gitlab-com/public-sector/kaniko/-/releases/v1.0.1)

  • v1.0.1

    protected
    c94554e6 · ci: release-create job for tag pipelines ·
    Release: v1.0.1 
    **release-create CI now wired.** The empty `release` stage from v1.0.0 is filled in; future tag pipelines auto-create their GitLab Release page from the annotated tag body.

- New `release-create` job in the `release` stage. Fires on tag pipelines matching `v\d+\.\d+\.\d+`. Uses GitLab's built-in `release:` keyword (release-cli image). Description sourced from `CI_COMMIT_TAG_MESSAGE` — the annotated tag body verbatim, which means **the tag IS the source of truth** for release notes. Updating notes means re-tagging.
- CHANGELOG: closed `Unreleased` into `[v1.0.0] - 2026-05-21`; new `Unreleased` describes the release-create work that ships in this tag.

Same shape as [v1.0.0](https://gitlab.com/gitlab-com/public-sector/kaniko/-/releases/v1.0.0), rebuilt against the `refs/tags/v1.0.1` identity. Seven variants, signed and attested end-to-end.

| Tag                              | Variant   | Crypto                              |
| -------------------------------- | --------- | ----------------------------------- |
| `:v1.0.1`                        | standard  | Go stdlib                           |
| `:v1.0.1-fips`                   | standard  | Go 1.25 FIPS 140-3                  |
| `:v1.0.1-debug`                  | debug     | Go stdlib                           |
| `:v1.0.1-fips-debug`             | debug     | Go 1.25 FIPS 140-3                  |
| `:v1.0.1-fips-strict-debug`      | debug     | FIPS 140-3 + P-curve patch          |
| `:v1.0.1-warmer`                 | warmer    | Go stdlib                           |
| `:v1.0.1-fips-warmer`            | warmer    | Go 1.25 FIPS 140-3                  |

- **Docs:** <https://gitlab-com.gitlab.io/public-sector/kaniko/>
- **Source:** <https://gitlab.com/gitlab-com/public-sector/kaniko>
- **Previous release:** [v1.0.0](https://gitlab.com/gitlab-com/public-sector/kaniko/-/releases/v1.0.0)

  • v1.0.0

    protected
    0b6e63a7 · feat: brand assets + Pages site against the docs chrome ·
    Release: v1.0.0 
    v1.0.0 -- first public release.

Initial public flip of the kaniko build pipeline. Seven image variants
per release, each signed and attested end-to-end:

  :v1.0.0                       standard, Go stdlib
  :v1.0.0-fips                  standard, Go 1.25 FIPS 140-3
  :v1.0.0-debug                 debug, Go stdlib, bash
  :v1.0.0-fips-debug            debug, FIPS 140-3, bash
  :v1.0.0-fips-strict-debug     debug, FIPS 140-3 + P-curve patch, bash
  :v1.0.0-warmer                warmer, Go stdlib
  :v1.0.0-fips-warmer           warmer, Go 1.25 FIPS 140-3

cosign keyless signatures (GitLab OIDC), CycloneDX SBOM, SLSA v1.0
provenance per variant. Architectures linux/amd64 and linux/arm64.

Docs:   https://gitlab-com.gitlab.io/public-sector/kaniko/
Source: https://gitlab.com/gitlab-com/public-sector/kaniko