Skip to content

v1.29.0 dry-run: flip switch-on feature flags to default #870

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
mzihlmann wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

v1.29.0 dry-run: flip switch-on feature flags to default #870

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b929966
v1.29.0 dry-run: flip switch-on feature flags to default true (except…
mzihlmann Jul 3, 2026
233753d
read FF_KANIKO_VOLUME_SKIP_MKDIR and FF_KANIKO_DEPRECATE_INTER_STAGE_…
mzihlmann Jun 29, 2026
8dc802f
v1.29.0 dry-run: remove deprecated feature flags and their legacy cod…
mzihlmann Jul 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 0 additions & 6 deletions cmd/executor/cmd/root.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -402,12 +402,6 @@ func checkNoDeprecatedFlags() {
if opts.SkipUnusedStagesDeprecated {
logrus.Warn("Flag --skip-unused-stages is deprecated. This is the new default behaviour. If you want to build multiple independent stages pass them as --target instead")
}

if !config.EnvBool("FF_KANIKO_DEPRECATE_INTER_STAGE_RESTORE") {
if opts.PreserveContext && !opts.PreCleanup {
logrus.Warn("--preserve-context without --pre-cleanup restores the original context between stages; this is deprecated and will be removed. Use --mount=type=secret for secrets. Set FF_KANIKO_DEPRECATE_INTER_STAGE_RESTORE=1 to opt into the new behaviour now.")
}
}
}

// cacheFlagsValid makes sure the flags passed in related to caching are valid
Expand Down
8 changes: 0 additions & 8 deletions integration/dockerfiles/Dockerfile_test_issue_mz793
View file
Open in desktop

This file was deleted.

6 changes: 0 additions & 6 deletions integration/images.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,6 @@ var envsMap = map[string][]string{
"Dockerfile_test_issue_cg188": {"SECRET=blubb"},
"Dockerfile_test_issue_mz774": {"FF_KANIKO_SKIP_WRITE_WHITEOUTS=1"},
"Dockerfile_test_issue_mz775": {"FF_KANIKO_CACHE_LOOKAHEAD=0", "FF_KANIKO_SKIP_RELABEL_RECOMPRESS=1"},
"Dockerfile_test_issue_mz793": {"FF_KANIKO_VOLUME_SKIP_MKDIR=0"},
"Dockerfile_test_issue_mz473": {"KANIKO_DIR=/kaniko2"},
"Dockerfile_test_issue_mz661": {"KANIKO_DIR=/kaniko2"},
"Dockerfile_test_stopsignal": {"FF_KANIKO_OCI_SCRATCH_BASE=0"},
Expand Down Expand Up @@ -266,10 +265,6 @@ var diffArgsMap = map[string][]string{
// mz595: surprisingly the missing files are **not** picked up if we ignore layer-length-mismatch,
// which we do by default in TestRun, we should move to disable that globally urgently.
"TestRun/test_Dockerfile_test_issue_mz595": {"--extra-ignore-layer-length-mismatch=false"},
// mz793: with FF_KANIKO_VOLUME_SKIP_MKDIR off, VOLUME creates the directory fresh on
// each build, so its mtime differs between the two cached builds. That divergence is the
// known volume non-determinism the flag fixes, here we only assert the build no longer panics.
"TestCache/test_cache_Dockerfile_test_issue_mz793": {"--extra-ignore-files=data/"},
}

// output check to do when building with kaniko
Expand Down Expand Up @@ -485,7 +480,6 @@ func NewDockerFileBuilder() *DockerFileBuilder {
"Dockerfile_test_issue_mz774": {},
"Dockerfile_test_issue_mz775": {},
"Dockerfile_test_issue_mz782": {},
"Dockerfile_test_issue_mz793": {},
}
d.TestOCICacheDockerfiles = map[string]struct{}{
"Dockerfile_test_cache_oci": {},
Expand Down
66 changes: 1 addition & 65 deletions pkg/cache/cache.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,15 +21,13 @@ import (
"fmt"
"os"
"path"
"path/filepath"
"strings"
"time"

"github.com/google/go-containerregistry/pkg/name"
v1 "github.com/google/go-containerregistry/pkg/v1"
"github.com/google/go-containerregistry/pkg/v1/layout"
"github.com/google/go-containerregistry/pkg/v1/remote"
"github.com/google/go-containerregistry/pkg/v1/tarball"
"github.com/osscontainertools/kaniko/pkg/config"
"github.com/osscontainertools/kaniko/pkg/creds"
"github.com/osscontainertools/kaniko/pkg/util"
Expand Down Expand Up @@ -196,69 +194,7 @@ func LocalSource(opts *config.CacheOptions, cacheKey string) (v1.Image, error) {
}

logrus.Infof("Found %s in local cache", cacheKey)
if config.EnvBoolDefault("FF_KANIKO_OCI_WARMER", true) {
return ociCachedImageFromPath(path)
} else {
return cachedImageFromPath(path)
}
}

// cachedImage represents a v1.Tarball that is cached locally in a CAS.
// Computing the digest for a v1.Tarball is very expensive. If the tarball
// is named with the digest we can store this and return it directly rather
// than recompute it.
type cachedImage struct {
digest string
v1.Image
mfst *v1.Manifest
}

func (c *cachedImage) Digest() (v1.Hash, error) {
return v1.NewHash(c.digest)
}

func (c *cachedImage) Manifest() (*v1.Manifest, error) {
if config.EnvBool("FF_KANIKO_IGNORE_CACHED_MANIFEST") || c.mfst == nil {
return c.Image.Manifest()
}
return c.mfst, nil
}

func mfstFromPath(p string) (*v1.Manifest, error) {
f, err := util.FSys.Open(p)
if err != nil {
return nil, err
}
defer f.Close()
return v1.ParseManifest(f)
}

func cachedImageFromPath(p string) (v1.Image, error) {
imgTar, err := tarball.ImageFromPath(p, nil)
if err != nil {
return nil, fmt.Errorf("getting image from path: %w", err)
}

// Manifests may be present next to the tar, named with a ".json" suffix
mfstPath := p + ".json"

var mfst *v1.Manifest
if _, err := os.Stat(mfstPath); err != nil {
logrus.Debugf("Manifest does not exist at file: %s", mfstPath)
} else {
mfst, err = mfstFromPath(mfstPath)
if err != nil {
logrus.Debugf("Error parsing manifest from file: %s", mfstPath)
} else {
logrus.Infof("Found manifest at %s", mfstPath)
}
}

return &cachedImage{
digest: filepath.Base(p),
Image: imgTar,
mfst: mfst,
}, nil
return ociCachedImageFromPath(path)
}

func ociCachedImageFromPath(tarPath string) (v1.Image, error) {
Expand Down
7 changes: 2 additions & 5 deletions pkg/commands/env.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ package commands
import (
v1 "github.com/google/go-containerregistry/pkg/v1"
"github.com/moby/buildkit/frontend/dockerfile/instructions"
kConfig "github.com/osscontainertools/kaniko/pkg/config"
"github.com/osscontainertools/kaniko/pkg/dockerfile"
"github.com/osscontainertools/kaniko/pkg/util"
)
Expand All @@ -37,10 +36,8 @@ func (e *EnvCommand) ExecuteCommand(config *v1.Config, buildArgs *dockerfile.Bui
return err
}
// 3344: An ENV declared after an ARG of the same name overrides it.
if kConfig.EnvBoolDefault("FF_KANIKO_BUILDKIT_ARG_ENV_PRECEDENCE", true) {
for _, keyVal := range newEnvs {
buildArgs.RemoveArg(keyVal.Key)
}
for _, keyVal := range newEnvs {
buildArgs.RemoveArg(keyVal.Key)
}
return nil
}
Expand Down
6 changes: 2 additions & 4 deletions pkg/commands/run.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,6 @@ func (r *RunCommand) ExecuteCommand(config *v1.Config, buildArgs *dockerfile.Bui
}

func runCommandWithFlags(config *v1.Config, buildArgs *dockerfile.BuildArgs, cmdRun *instructions.RunCommand, fileContext util.FileContext, secrets kConfig.SecretOptions) (reterr error) {
ff_bind := kConfig.EnvBoolDefault("FF_KANIKO_RUN_MOUNT_BIND", true)
for _, f := range cmdRun.FlagsUsed {
if f != "mount" {
logrus.Warnf("#969 kaniko does not support '--%s' flags in RUN statements - relying on unsupported flags can lead to invalid builds", f)
Expand Down Expand Up @@ -216,7 +215,7 @@ func runCommandWithFlags(config *v1.Config, buildArgs *dockerfile.BuildArgs, cmd
}
}
// https://docs.docker.com/reference/dockerfile/#run---mounttypebind
case m.Type == instructions.MountTypeBind && ff_bind:
case m.Type == instructions.MountTypeBind:
if m.From != "" && m.From != "context" {
logrus.Warnf("Kaniko does not support cross-stage bind mounts (from=%s) - skipping", m.From)
continue
Expand Down Expand Up @@ -529,8 +528,7 @@ func runCmdFilesUsedFromContext(
config *v1.Config, buildArgs *dockerfile.BuildArgs, cmd *instructions.RunCommand,
fileContext util.FileContext,
) ([]string, error) {
ff_bind := kConfig.EnvBoolDefault("FF_KANIKO_RUN_MOUNT_BIND", true)
if !ff_bind || len(cmd.FlagsUsed) == 0 {
if len(cmd.FlagsUsed) == 0 {
return []string{}, nil
}

Expand Down
14 changes: 0 additions & 14 deletions pkg/commands/volume.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,12 +17,8 @@ limitations under the License.
package commands

import (
"fmt"
"os"

v1 "github.com/google/go-containerregistry/pkg/v1"
"github.com/moby/buildkit/frontend/dockerfile/instructions"
kconfig "github.com/osscontainertools/kaniko/pkg/config"
"github.com/osscontainertools/kaniko/pkg/dockerfile"
"github.com/osscontainertools/kaniko/pkg/util"
"github.com/sirupsen/logrus"
Expand Down Expand Up @@ -50,16 +46,6 @@ func (v *VolumeCommand) ExecuteCommand(config *v1.Config, buildArgs *dockerfile.
var x struct{}
existingVolumes[volume] = x
util.AddVolumePathToIgnoreList(volume)

if !kconfig.EnvBoolDefault("FF_KANIKO_VOLUME_SKIP_MKDIR", true) {
// Only create and snapshot the dir if it didn't exist already
if _, err := os.Stat(volume); os.IsNotExist(err) {
logrus.Infof("Creating directory %s", volume)
if err := os.MkdirAll(volume, 0o755); err != nil {
return fmt.Errorf("could not create directory for volume %s: %w", volume, err)
}
}
}
}
config.Volumes = existingVolumes
util.Assert("volume.count-monotone", len(config.Volumes) >= prevVolumeCount, "VOLUME must not remove volumes: count went from %d to %d", prevVolumeCount, len(config.Volumes))
Expand Down
10 changes: 2 additions & 8 deletions pkg/dockerfile/buildargs.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@ import (

"github.com/containerd/platforms"
"github.com/moby/buildkit/frontend/dockerfile/instructions"
"github.com/osscontainertools/kaniko/pkg/config"
"github.com/osscontainertools/kaniko/pkg/util"
)

Expand Down Expand Up @@ -93,13 +92,8 @@ func (b *BuildArgs) ReplacementEnvs(envs []string) []string {
nenvs := len(merged)
args := b.GetAllAllowed()
for key, val := range args {
if config.EnvBoolDefault("FF_KANIKO_BUILDKIT_ARG_ENV_PRECEDENCE", true) {
// 3344: args always override envs
merged[key] = &val
} else if _, exists := merged[key]; !exists {
// 3344: legacy behaviour, envs always override args
merged[key] = &val
}
// 3344: args always override envs
merged[key] = &val
}
result := make([]string, 0, len(merged))
for key, val := range merged {
Expand Down
47 changes: 10 additions & 37 deletions pkg/executor/build.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,7 +240,7 @@ func populateCompositeKey(command commands.DockerCommand, files []string, compos
// Add the next command to the cache key.
keyString := command.String()
resolver, ok := command.(commands.CacheKeyResolver)
if ok && config.EnvBool("FF_KANIKO_RESOLVE_CACHE_KEY") {
if ok && config.EnvBoolDefault("FF_KANIKO_RESOLVE_CACHE_KEY", true) {
resolved, err := resolver.CacheKey(replacementEnvs)
if err != nil {
return compositeKey, fmt.Errorf("resolving cache key: %w", err)
Expand Down Expand Up @@ -336,7 +336,7 @@ func (s *stageBuilder) optimize(compositeKeyPtr *CompositeCache, cfg v1.Config,
copyCmd, isCopy := commands.CastAbstractCopyCommand(command)
if !hasContext && isCopy && copyCmd.From() != "" {
inferred := false
if config.EnvBool("FF_KANIKO_INFER_CROSS_STAGE_CACHE_KEY") && opts.CacheCopyLayers {
if config.EnvBoolDefault("FF_KANIKO_INFER_CROSS_STAGE_CACHE_KEY", true) && opts.CacheCopyLayers {
inferredKey, err := populateCompositeKey(command, nil, compositeKey, args, cfg.Env, fileContext, stageFinalCacheKeys, externalImageDigests)
if err == nil {
inferredCK, err := inferredKey.Hash()
Expand Down Expand Up @@ -374,7 +374,7 @@ func (s *stageBuilder) optimize(compositeKeyPtr *CompositeCache, cfg v1.Config,
}

// mz334: assert the inferred key pointer resolves to the same content key.
if config.EnvBool("FF_KANIKO_INFER_CROSS_STAGE_CACHE_KEY") && opts.CacheCopyLayers {
if config.EnvBoolDefault("FF_KANIKO_INFER_CROSS_STAGE_CACHE_KEY", true) && opts.CacheCopyLayers {
inferredKey, err := populateCompositeKey(command, nil, prevCompositeKey, args, cfg.Env, fileContext, stageFinalCacheKeys, externalImageDigests)
if err == nil {
inferredCK, err := inferredKey.Hash()
Expand Down Expand Up @@ -531,7 +531,7 @@ func (s *stageBuilder) build(compositeKey CompositeCache, opts *config.KanikoOpt
return err
}
// mz334: also compute the inferred key so we can push a pointer below.
if config.EnvBool("FF_KANIKO_INFER_CROSS_STAGE_CACHE_KEY") && opts.CacheCopyLayers {
if config.EnvBoolDefault("FF_KANIKO_INFER_CROSS_STAGE_CACHE_KEY", true) && opts.CacheCopyLayers {
inferredKey, err := populateCompositeKey(command, nil, prevCompositeKey, s.args, s.cf.Config.Env, fileContext, stageFinalCacheKeys, externalImageDigests)
if err == nil {
inferredCacheKey, err = inferredKey.Hash()
Expand Down Expand Up @@ -599,9 +599,7 @@ func (s *stageBuilder) build(compositeKey CompositeCache, opts *config.KanikoOpt
// So the only case where we don't need a filesystem is if all commands are MetadataOnly.
util.Assert("executor.build.metadata-only", command.MetadataOnly(), "build: non-MetadataOnly command %q ran without unpacked filesystem in stage %d", command.String(), s.index)
}
_, isVolume := command.(*commands.VolumeCommand)
volumeCreatesFiles := isVolume && !config.EnvBool("FF_KANIKO_VOLUME_SKIP_MKDIR")
if command.MetadataOnly() && !opts.SingleSnapshot && !volumeCreatesFiles {
if command.MetadataOnly() && !opts.SingleSnapshot {
// MetadataOnly commands must not change or even need the filesystem.
util.Assert("executor.build.without-fs", snapshotted == 0, "build: MetadataOnly command %q snapshotted %d file(s)", command.String(), snapshotted)
}
Expand Down Expand Up @@ -659,10 +657,6 @@ func takeSnapshot(files []string, shdDelete bool, opts *config.KanikoOptions, sn
if files == nil || opts.SingleSnapshot {
snapshot, snapshotted, err = snapshotter.TakeSnapshotFS()
} else {
if !config.EnvBool("FF_KANIKO_VOLUME_SKIP_MKDIR") {
// Volumes are very weird. They get snapshotted in the next command.
files = append(files, util.Volumes()...)
}
snapshot, snapshotted, err = snapshotter.TakeSnapshot(files, shdDelete)
}
timing.DefaultRun.Stop(t)
Expand Down Expand Up @@ -816,7 +810,7 @@ func convertLayerMediaType(layer v1.Layer, image v1.Image, opts *config.KanikoOp
if targetMediaType != "" {
srcCompression := layerCompression(layerMediaType)
dstCompression := layerCompression(targetMediaType)
if config.EnvBool("FF_KANIKO_SKIP_RELABEL_RECOMPRESS") && srcCompression != "" && srcCompression == dstCompression {
if config.EnvBoolDefault("FF_KANIKO_SKIP_RELABEL_RECOMPRESS", true) && srcCompression != "" && srcCompression == dstCompression {
relabeled, err := tarball.LayerFromOpener(layer.Compressed, layerOpts...)
if err != nil {
return nil, err
Expand Down Expand Up @@ -974,7 +968,7 @@ func RenderStages(stages []config.KanikoStage, cacheInfo []*stageCacheInfo, opts
printf("UNPACK %s\n", s.BaseName)
}
for jdx, c := range s.Commands {
if opts.Cache && opts.CacheCopyLayers && config.EnvBool("FF_KANIKO_INFER_CROSS_STAGE_CACHE_KEY") && config.EnvBool("FF_KANIKO_CACHE_LOOKAHEAD") {
if opts.Cache && opts.CacheCopyLayers && config.EnvBoolDefault("FF_KANIKO_INFER_CROSS_STAGE_CACHE_KEY", true) && config.EnvBool("FF_KANIKO_CACHE_LOOKAHEAD") {
if copyCmd, ok := c.(*instructions.CopyCommand); ok && copyCmd.From != "" {
ci := cacheInfo[s.Index]
if ck := ci.redirectKeys[jdx]; ck != "" {
Expand Down Expand Up @@ -1022,11 +1016,6 @@ func RenderStages(stages []config.KanikoStage, cacheInfo []*stageCacheInfo, opts
printf("SAVE FILES %v %s%d\n", filesToSave, config.KanikoInterStageDepsDir, s.Index)
}
printf("CLEAN\n\n")
if !config.EnvBoolDefault("FF_KANIKO_DEPRECATE_INTER_STAGE_RESTORE", true) {
if opts.PreserveContext && !opts.PreCleanup {
printf("RESTORE CONTEXT\n\n")
}
}
}
util.Unreachable("we should always have a final stage")
return retErr
Expand Down Expand Up @@ -1089,9 +1078,7 @@ func DoBuild(opts *config.KanikoOptions) (image v1.Image, retErr error) {
return nil, fmt.Errorf("precompute: failed to get baseImage: %w", err)
}
}
if config.EnvBoolDefault("FF_KANIKO_NO_PROPAGATE_ANNOTATIONS", true) {
baseImage = image_util.WithoutAnnotations(baseImage)
}
baseImage = image_util.WithoutAnnotations(baseImage)
args := baseArgs
if stage.BaseImageStoredLocally {
args = stageArgs[stage.BaseImageIndex]
Expand Down Expand Up @@ -1195,9 +1182,7 @@ func DoBuild(opts *config.KanikoOptions) (image v1.Image, retErr error) {
if err != nil {
return nil, fmt.Errorf("failed to get baseImage: %w", err)
}
if config.EnvBoolDefault("FF_KANIKO_NO_PROPAGATE_ANNOTATIONS", true) {
baseImage = image_util.WithoutAnnotations(baseImage)
}
baseImage = image_util.WithoutAnnotations(baseImage)

args := baseArgs
if stage.BaseImageStoredLocally {
Expand Down Expand Up @@ -1296,7 +1281,7 @@ func DoBuild(opts *config.KanikoOptions) (image v1.Image, retErr error) {
if err != nil {
return nil, err
}
if config.EnvBool("FF_KANIKO_REPRODUCIBLE_PRESERVE_BASE_LAYERS") {
if config.EnvBoolDefault("FF_KANIKO_REPRODUCIBLE_PRESERVE_BASE_LAYERS", true) {
sourceImage, err = image_util.ReplaceBase(sourceImage, baseImage)
if err != nil {
return nil, err
Expand Down Expand Up @@ -1341,18 +1326,6 @@ func DoBuild(opts *config.KanikoOptions) (image v1.Image, retErr error) {
if err := util.DeleteFilesystem(); err != nil {
return nil, fmt.Errorf("deleting file system after stage %d: %w", stage.Index, err)
}
if !config.EnvBoolDefault("FF_KANIKO_DEPRECATE_INTER_STAGE_RESTORE", true) {
if opts.PreserveContext && !opts.PreCleanup {
if tarball == "" {
return nil, errors.New("context snapshot is missing")
}
_, err := util.UnpackLocalTarArchive(tarball, config.RootDir)
if err != nil {
return nil, fmt.Errorf("failed to unpack context snapshot: %w", err)
}
logrus.Info("Context restored")
}
}
}

util.Unreachable("we should always have a final stage")
Expand Down
Loading
Loading