# Building images with kaniko and GitLab CI/CD > 原文：[https://docs.gitlab.com/ee/ci/docker/using_kaniko.html](https://docs.gitlab.com/ee/ci/docker/using_kaniko.html) * [Requirements](#requirements) * [Building a Docker image with kaniko](#building-a-docker-image-with-kaniko) * [Using a registry with a custom certificate](#using-a-registry-with-a-custom-certificate) * [Video walkthrough of a working example](#video-walkthrough-of-a-working-example) # Building images with kaniko and GitLab CI/CD[](#building-images-with-kaniko-and-gitlab-cicd "Permalink") 在 GitLab 11.2 中[引入](https://gitlab.com/gitlab-org/gitlab-foss/-/issues/45512) . 需要 GitLab Runner 11.2 及更高版本. [kaniko](https://github.com/GoogleContainerTools/kaniko)是从容器或 Kubernetes 集群内部的 Dockerfile 构建容器映像的工具. kaniko 使用[Docker-in-Docker 构建](using_docker_build.html#use-docker-in-docker-workflow-with-docker-executor)方法解决了两个问题： * Docker-in-Docker 需要[特权模式](https://s0docs0docker0com.icopy.site/engine/reference/run/)才能运行，这是一个重大的安全问题. * Docker-in-Docker 通常会导致性能下降，并且可能会非常慢. ## Requirements[](#requirements "Permalink") 为了在 GitLab 中使用 kaniko，需要使用以下执行程序之一的[GitLab Runner](https://docs.gitlab.com/runner/) ： * [Kubernetes](https://docs.gitlab.com/runner/executors/kubernetes.html). * [Docker](https://docs.gitlab.com/runner/executors/docker.html). * [Docker Machine](https://docs.gitlab.com/runner/executors/docker_machine.html). ## Building a Docker image with kaniko[](#building-a-docker-image-with-kaniko "Permalink") 使用 kaniko 和 GitLab CI / CD 构建映像时，应注意一些重要细节： * 推荐使用 kaniko 调试映像（ `gcr.io/kaniko-project/executor:debug` ），因为它具有外壳，并且该映像与 GitLab CI / CD 一起使用时需要外壳. * 入口点将需要被[覆盖](using_docker_images.html#overriding-the-entrypoint-of-an-image) ，否则构建脚本将无法运行. * 需要使用所需容器注册表的身份验证信息创建一个 Docker `config.json`文件. In the following example, kaniko is used to: 1. 构建一个 Docker 镜像 2. 然后将其推送到[GitLab 容器注册表](../../user/packages/container_registry/index.html) . 仅当按下标签时作业才会运行. 使用从 GitLab CI / CD 提供的[环境变量中](../variables/README.html#predefined-environment-variables)获取的所需 GitLab 容器注册表凭据在`/kaniko/.docker`下创建一个`config.json`文件. 在最后一步中，kaniko 使用项目根目录下的`Dockerfile` ，构建 Docker 映像并将其推送到项目的 Container Registry，同时使用 Git 标签对其进行标记： ``` build: stage: build image: name: gcr.io/kaniko-project/executor:debug entrypoint: [""] script: - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}" > /kaniko/.docker/config.json - /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/Dockerfile --destination $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG only: - tags ``` ## Using a registry with a custom certificate[](#using-a-registry-with-a-custom-certificate "Permalink") 尝试推送到使用由自定义 CA 签名的证书的 Docker 注册表时，您可能会遇到以下错误： ``` $ /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/Dockerfile --no-push INFO[0000] Downloading base image registry.gitlab.example.com/group/docker-image error building image: getting stage builder for stage 0: Get https://registry.gitlab.example.com/v2/: x509: certificate signed by unknown authority ``` 可以通过将您的 CA 证书添加到 kaniko 证书存储区来解决： ``` before_script: - mkdir -p /kaniko/.docker - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}" > /kaniko/.docker/config.json - | echo "-----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----" >> /kaniko/ssl/certs/additional-ca-cert-bundle.crt ``` ## Video walkthrough of a working example[](#video-walkthrough-of-a-working-example "Permalink") [在 GitLab](https://www.youtube.com/watch?v=d96ybcELpFs)视频[上使用 Kaniko](https://www.youtube.com/watch?v=d96ybcELpFs)的[最低权限容器构建](https://www.youtube.com/watch?v=d96ybcELpFs)是对[Kaniko Docker Build](https://gitlab.com/guided-explorations/containers/kaniko-docker-build) Guided Exploration 项目管道的演练. 经过测试： * [GitLab.com Shared Runners](../../user/gitlab_com/index.html#shared-runners) * [The Kubernetes Runner executor](https://docs.gitlab.com/runner/executors/kubernetes.html) 可以将示例复制到您自己的组或实例中进行测试. 项目页面上提供了有关演示其他 GitLab CI 模式的更多详细信息.