|
| 1 | +# TAGLINE |
| 2 | + |
| 3 | +Build and deploy Go container images without a Dockerfile |
| 4 | + |
| 5 | +# TLDR |
| 6 | + |
| 7 | +**Build and publish** a container image from a Go import path to _$KO_DOCKER_REPO_ |
| 8 | + |
| 9 | +```ko build [./cmd/app]``` |
| 10 | + |
| 11 | +**Build into the local Docker daemon** instead of pushing |
| 12 | + |
| 13 | +```ko build --local [./cmd/app]``` |
| 14 | + |
| 15 | +**Build a multi-platform image** |
| 16 | + |
| 17 | +```ko build --platform=linux/amd64,linux/arm64 [./cmd/app]``` |
| 18 | + |
| 19 | +**Resolve Kubernetes manifests**, replacing _ko://_ image refs with built digests |
| 20 | + |
| 21 | +```ko resolve -f [path/to/manifest.yaml]``` |
| 22 | + |
| 23 | +**Build, push, and apply** a manifest to the current cluster |
| 24 | + |
| 25 | +```ko apply -f [path/to/manifest.yaml]``` |
| 26 | + |
| 27 | +**Run** a Go package as an ephemeral pod in the cluster |
| 28 | + |
| 29 | +```ko run [./cmd/app]``` |
| 30 | + |
| 31 | +**Log in** to a container registry |
| 32 | + |
| 33 | +```ko login [registry.example.com] -u [username] -p [password]``` |
| 34 | + |
| 35 | +**Print the version** |
| 36 | + |
| 37 | +```ko version``` |
| 38 | + |
| 39 | +# SYNOPSIS |
| 40 | + |
| 41 | +**ko** _command_ [_flags_] [_import-path_] |
| 42 | + |
| 43 | +# COMMANDS |
| 44 | + |
| 45 | +**ko build** [_import-path_ ...] |
| 46 | +> Build OCI images for one or more Go _main_ packages and push them to **$KO_DOCKER_REPO**. Aliases: **publish**. |
| 47 | +
|
| 48 | +**ko resolve** **-f** _file_ |
| 49 | +> Read Kubernetes YAML, build every **ko://** image reference, push it, and print the manifest with each reference rewritten to its image digest. |
| 50 | +
|
| 51 | +**ko apply** **-f** _file_ |
| 52 | +> Like **resolve**, then pipe the rewritten manifest into **kubectl apply**. |
| 53 | +
|
| 54 | +**ko create** **-f** _file_ |
| 55 | +> Like **resolve**, then pipe into **kubectl create**. |
| 56 | +
|
| 57 | +**ko delete** **-f** _file_ |
| 58 | +> Delete resources defined in the manifest from the cluster. |
| 59 | +
|
| 60 | +**ko run** _import-path_ |
| 61 | +> Build the binary, push the image, and run it as a Pod in the cluster. |
| 62 | +
|
| 63 | +**ko login** _registry_ |
| 64 | +> Authenticate to a container registry; credentials are stored in the standard Docker config file. |
| 65 | +
|
| 66 | +**ko deps** _import-path_ |
| 67 | +> Print the Go module dependency tree that would be baked into the image. |
| 68 | +
|
| 69 | +**ko version** |
| 70 | +> Print client version. |
| 71 | +
|
| 72 | +# PARAMETERS |
| 73 | + |
| 74 | +**-B**, **--base-import-paths** |
| 75 | +> Tag images with only the final path component (e.g. _app_). |
| 76 | +
|
| 77 | +**-P**, **--preserve-import-paths** |
| 78 | +> Tag images with the full import path. |
| 79 | +
|
| 80 | +**--bare** |
| 81 | +> Use _$KO_DOCKER_REPO_ as the image name verbatim, with no suffix. |
| 82 | +
|
| 83 | +**--platform** _list_ |
| 84 | +> Comma-separated platforms (e.g. _linux/amd64,linux/arm64,linux/arm/v7_). Use _all_ for every platform the base image supports. |
| 85 | +
|
| 86 | +**-t**, **--tags** _list_ |
| 87 | +> Comma-separated tags applied to the published image (default: _latest_). |
| 88 | +
|
| 89 | +**-L**, **--local** |
| 90 | +> Load the built image into the local Docker daemon instead of pushing. |
| 91 | +
|
| 92 | +**--image-refs** _file_ |
| 93 | +> Write the published image references to _file_, one per line. |
| 94 | +
|
| 95 | +**--sbom** _format_ |
| 96 | +> SBOM format to embed: _spdx_ (default), _cyclonedx_, _go.version-m_, or _none_. |
| 97 | +
|
| 98 | +**--push** _bool_ |
| 99 | +> When _false_, build without pushing. Useful with **--tarball**. |
| 100 | +
|
| 101 | +**--tarball** _file_ |
| 102 | +> Write the image to a tarball loadable by **docker load**. |
| 103 | +
|
| 104 | +**--kubeconfig** _file_ |
| 105 | +> Path to a kubeconfig used by **apply**, **create**, **run**, **delete**. |
| 106 | +
|
| 107 | +**--selector** _label=value_ |
| 108 | +> Apply only to resources matching the label selector. |
| 109 | +
|
| 110 | +# CONFIGURATION |
| 111 | + |
| 112 | +**ko** reads a per-project **.ko.yaml** at the repository root. Common keys: |
| 113 | + |
| 114 | +**defaultBaseImage**: _registry/image:tag_ |
| 115 | +> Distroless image used as the base layer (default: _cgr.dev/chainguard/static_). |
| 116 | +
|
| 117 | +**baseImageOverrides**: _map_ |
| 118 | +> Per-import-path base images. |
| 119 | +
|
| 120 | +**builds**: _list_ |
| 121 | +> Per-import-path build settings (env, flags, ldflags, main, dir). |
| 122 | +
|
| 123 | +**defaultPlatforms**: _list_ |
| 124 | +> Default value for **--platform**. |
| 125 | +
|
| 126 | +**ko** also honors these environment variables: |
| 127 | + |
| 128 | +**KO_DOCKER_REPO** |
| 129 | +> Target registry/repo. Set to _ko.local_ to write to the local Docker daemon, or _kind.local_ to load into a Kind cluster. |
| 130 | +
|
| 131 | +**KO_DEFAULTBASEIMAGE** |
| 132 | +> Overrides _defaultBaseImage_ from **.ko.yaml**. |
| 133 | +
|
| 134 | +**KOCACHE** |
| 135 | +> Directory used to cache built layers; speeds up incremental builds. |
| 136 | +
|
| 137 | +**KO_CONFIG_PATH** |
| 138 | +> Path to **.ko.yaml** when it is not at the repo root. |
| 139 | +
|
| 140 | +# DESCRIPTION |
| 141 | + |
| 142 | +**ko** is a container image builder dedicated to Go. It compiles a Go _main_ package with the local **go** toolchain, lays the resulting static binary on top of a small distroless base image, and produces an OCI image, all without spawning **docker** or executing a Dockerfile. Because the build is just **go build**, cross-compilation, reproducible builds, and Go module caching all work as they do outside of containers. |
| 143 | + |
| 144 | +A typical workflow stores a fragment of YAML such as _image: ko://github.com/me/app/cmd/server_ in a Kubernetes manifest. **ko resolve** reads the manifest, runs **ko build** for every such reference, pushes the resulting images to **$KO_DOCKER_REPO**, and emits a new manifest where each **ko://** reference has been rewritten to an immutable digest. **ko apply** does the same and pipes the output to **kubectl apply**, giving GitOps-style deployment in a single command. |
| 145 | + |
| 146 | +Images include an SBOM by default (SPDX) and are reproducible across machines because the Go binary, base image digest, and entrypoint are the only inputs. Multi-platform images are built in parallel and assembled into an OCI image index. |
| 147 | + |
| 148 | +# CAVEATS |
| 149 | + |
| 150 | +**ko** only ships Go binaries; cgo, system packages, and arbitrary RUN steps are not supported. Projects that need glibc, system tools, or a custom base layer must pick an alternate distroless or **cgr.dev/chainguard/\*** base via _defaultBaseImage_, or use a different builder. |
| 151 | + |
| 152 | +The **--local** flag requires a running Docker daemon; without it, **ko** talks directly to the registry and never touches Docker. |
| 153 | + |
| 154 | +# HISTORY |
| 155 | + |
| 156 | +**ko** was created at **Google** in **2018** by **Jason Hall**, **Matt Moore**, and others on the **Knative** team to publish their Go services without writing Dockerfiles. It was donated to the **ko-build** GitHub organization in **2021** and accepted into the **CNCF Sandbox** in **2022**. |
| 157 | + |
| 158 | +# SEE ALSO |
| 159 | + |
| 160 | +[docker](/man/docker)(1), [buildah](/man/buildah)(1), [crane](/man/crane)(1), [kubectl](/man/kubectl)(1), [skaffold](/man/skaffold)(1) |
0 commit comments