Add Kimia (Kubernetes-Native OCI Image Builder) Task

[vdemeester]

Summary

Kimia is a Kubernetes-native OCI image builder that uses BuildKit under the hood. It is an actively maintained alternative to Kaniko with features like reproducible builds, SBOM/provenance attestation, and Cosign signing built-in.

Motivation

The catalog currently has a kaniko task but Kaniko has had limited maintenance activity. Kimia provides a modern alternative with:

• BuildKit-based — supports all Dockerfile features including multi-stage builds
• Rootless — runs as UID 1000 with minimal capabilities (SETUID/SETGID only for user namespace operations)
• Reproducible builds — native support for supply chain security
• Attestation & signing — built-in SBOM, provenance, and Cosign integration
• Cache support — registry and local caching

Implementation Notes

A working Tekton Task has been prototyped and tested on kind. Key workarounds needed:

1. /tmp/run directory — BuildKit rootless requires this; solved with an emptyDir volume at /tmp and a prepare step running mkdir -p /tmp/run
2. Context path validation — Kimia validates the build context is under /home/kimia; solved by copying the source workspace into /home/kimia/build via a prepare step
3. Security context — requires allowPrivilegeEscalation: true with SETUID/SETGID capabilities and Unconfined AppArmor/seccomp profiles for user namespace operations

Proposed Task interface

params:
  - IMAGE         # destination image reference
  - DOCKERFILE    # path to Dockerfile (default: Dockerfile)
  - CONTEXT       # build context relative to workspace (default: .)
  - EXTRA_ARGS    # extra kimia flags (array)
  - BUILDER_IMAGE # kimia image (default: ghcr.io/rapidfort/kimia:latest)
workspaces:
  - source        # build context with Dockerfile
  - dockerconfig  # optional registry auth
results:
  - IMAGE_DIGEST
  - IMAGE_URL

Related

• Kimia repo: https://github.com/rapidfort/kimia
• Existing kaniko task: https://github.com/tektoncd/catalog/tree/main/task/kaniko

[vdemeester]

OpenShift / OpenShift Pipelines Compatibility

Current Status: Won't work out-of-the-box on OpenShift

The default kimia image (ghcr.io/rapidfort/kimia:latest) uses BuildKit and requires:

• allowPrivilegeEscalation: true (for user namespace operations)
• SETUID / SETGID capabilities
• Unconfined AppArmor and seccomp profiles

These are blocked by OpenShift's default restricted and pipelines-scc Security Context Constraints. A custom SCC bound to the pipeline ServiceAccount would be required (cluster-admin operation).

Additional OCP concerns:

• SELinux (RHCOS uses SELinux, not AppArmor) — BuildKit's user namespace operations may be denied
• UID mapping — OCP assigns random UIDs from namespace ranges, not necessarily UID 1000
• User namespaces — depends on OCP version and UserNamespacesSupport feature gate

Potential: Buildah backend

Kimia has a Buildah backend (Dockerfile.buildah in the repo) that auto-detects at runtime. If RapidFort published a ghcr.io/rapidfort/kimia:buildah image, it could potentially work with OCP's existing pipelines-scc since OpenShift Pipelines already supports buildah-based tasks with appropriate SCCs. However, this image is not currently published.

Recommendation

• For vanilla Kubernetes: the kimia (BuildKit) task works well
• For OpenShift: document as unsupported without custom SCC, or wait for a published buildah variant
• Consider opening an issue on rapidfort/kimia requesting a published buildah image tag