diff --git a/README.md b/README.md index 24d48b13267d5bcfadd2b976ee30b9759ed20cf6..fc48dbfd3ff94251573e8cb05d1bb1a3b248fcb5 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ This project implements a GitLab CI/CD template to build, test and secure your container images out of a `Dockerfile`. -It supports [kaniko](https://github.com/GoogleContainerTools/kaniko), [Buildah](https://buildah.io/) or [Docker](https://www.docker.com/) as build tools. +It supports [kaniko](https://github.com/chainguard-dev/kaniko), [Buildah](https://buildah.io/) or [Docker](https://www.docker.com/) as build tools. ## Usage @@ -44,13 +44,13 @@ The template supports following ways of building container images: 1. The former **Docker-in-Docker (DinD)** technique, that was widely used for years because of no other alternative, but that is now commonly recognized to have **significant security issues** ([read this post](https://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-docker-for-ci/) for more info), -2. Or using [kaniko](https://github.com/GoogleContainerTools/kaniko), an open-source, daemonless tool from Google for building Docker - images, and that solves Docker-in-Docker security issues (and also speeds-up build times). -3. Or using [buildah](https://buildah.io/), an open-source, daemonless tool backed by RedHat for building Docker +2. Or using [buildah](https://buildah.io/), an open-source, daemonless tool backed by RedHat for building Docker images, and that solves Docker-in-Docker security issues (and also speeds-up build times), and can also be configured to run rootless. +3. Or using [kaniko](https://github.com/chainguard-dev/kaniko), an open-source, daemonless tool from Google (now maintained by Chainguard) for building Docker + images, and that solves Docker-in-Docker security issues (and also speeds-up build times). -By default, the template uses the [kaniko](https://docs.gitlab.com/ci/docker/using_kaniko/) way, but you may -select an alternate build tool by using the `DOCKER_BUILD_TOOL` variable (see below). +By default, the template uses the [kaniko](https://docs.gitlab.com/ci/docker/using_kaniko/) way, but it's official image is [no longer maintained](https://github.com/GoogleContainerTools/kaniko). +You may select an alternate build tool by using the `DOCKER_BUILD_TOOL` variable or use your own kaniko image with the `DOCKER_KANIKO_IMAGE` variable (see below). :warning: If you choose to use 'Docker-in-Docker' option considering the associated security risks, make sure your runner has required privileges to run Docker-in-Docker ([see GitLab doc](https://docs.gitlab.com/ci/docker/using_docker_build/#use-docker-in-docker-workflow-with-docker-executor)). @@ -63,7 +63,7 @@ The Docker template uses some global configuration used throughout all jobs. | Input / Variable | Description | Default value | | ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | | `build-tool` / `DOCKER_BUILD_TOOL` | The build tool to use for building container image, possible values are `kaniko`, `buildah`, `dind` or `external` | `kaniko` | -| `kaniko-image` / `DOCKER_KANIKO_IMAGE` | The image used to run `kaniko` - _for kaniko build only_ | `gcr.io/kaniko-project/executor:debug` (use `debug` images for GitLab)
[![Trivy Badge](https://to-be-continuous.gitlab.io/doc/secu/trivy-badge-DOCKER_KANIKO_IMAGE.svg)](https://to-be-continuous.gitlab.io/doc/secu/trivy-DOCKER_KANIKO_IMAGE)| +| `kaniko-image` / `DOCKER_KANIKO_IMAGE` | The image used to run `kaniko` - _for kaniko build only_ | `gcr.io/kaniko-project/executor:debug` (use `debug` images for GitLab, unmaintained)
[![Trivy Badge](https://to-be-continuous.gitlab.io/doc/secu/trivy-badge-DOCKER_KANIKO_IMAGE.svg)](https://to-be-continuous.gitlab.io/doc/secu/trivy-DOCKER_KANIKO_IMAGE)| | `buildah-image` / `DOCKER_BUILDAH_IMAGE` | The image used to run `buildah` - _for buildah build only_ | `quay.io/containers/buildah:latest`
[![Trivy Badge](https://to-be-continuous.gitlab.io/doc/secu/trivy-badge-DOCKER_BUILDAH_IMAGE.svg)](https://to-be-continuous.gitlab.io/doc/secu/trivy-DOCKER_BUILDAH_IMAGE)| | `image` / `DOCKER_IMAGE` | The Docker image used to run the docker client (see [full list](https://hub.docker.com/r/library/docker/)) - _for Docker-in-Docker build only_ | `docker.io/library/docker:latest`
[![Trivy Badge](https://to-be-continuous.gitlab.io/doc/secu/trivy-badge-DOCKER_IMAGE.svg)](https://to-be-continuous.gitlab.io/doc/secu/trivy-DOCKER_IMAGE) | | `dind-image` / `DOCKER_DIND_IMAGE` | The Docker image used to run the Docker daemon (see [full list](https://hub.docker.com/r/library/docker/)) - _for Docker-in-Docker build only_ | `docker.io/library/docker:dind`
[![Trivy Badge](https://to-be-continuous.gitlab.io/doc/secu/trivy-badge-DOCKER_DIND_IMAGE.svg)](https://to-be-continuous.gitlab.io/doc/secu/trivy-DOCKER_DIND_IMAGE)|