Support pushing a pre-built tarball

[cmellazchy]

Use Case

A common security workflow is to scan a container image for vulnerabilities before pushing it to a registry, especially when registry policies (e.g., Harbor) block actions on images with known high/critical CVEs.

Kaniko already supports this halfway: you can build with --tarPath=/tmp/image.tar --no-push, scan the tarball with a tool like Trivy, and then push if the scan passes. The problem is that last step: kaniko has no way to push a pre-built tarball, so you need an external tool like crane to do it.

Workaround Today

# 1. Build to tarball
/kaniko/executor --tarPath=/tmp/image.tar --no-push ...

# 2. Scan
trivy image --input /tmp/image.tar --exit-code 1

# 3. Push with crane (separate binary)
crane push /tmp/image.tar registry.example.com/myapp:latest

This works, but it means downloading, verifying, and installing crane as an additional binary — even though kaniko already depends on github.com/google/go-containerregistry, which is the exact same library that crane wraps.

Proposal

Add a --push-from-tar flag to supplement the existing --tarPath:

/kaniko/executor --push-from-tar=/tmp/image.tar --destination=registry.example.com/myapp:latest

When --push-from-tar is set, the executor skips the build entirely and pushes the specified tarball to --destination.

The full workflow becomes:

# 1. Build to tarball
/kaniko/executor --tarPath=/tmp/image.tar --no-push ...

# 2. Scan
trivy image --input /tmp/image.tar --exit-code 1

# 3. Push (same binary, no extra tooling)
/kaniko/executor --push-from-tar=/tmp/image.tar --destination=registry.example.com/myapp:latest

Looking at the codebase, all the building blocks already seem to exist.

Prior Discussion

GoogleContainerTools/kaniko#1638 discussed a similar use case (hooking between build and push). The --push-from-tar flag is a simpler and more focused solution than the general-purpose hook system discussed there.

---

Does this make sense as a feature request?

I write a lot of code and CI but not Go. That said, I'd love to try contributing this with some guidance and AI Agent blessings, since the scope seems well-defined and the building blocks are all in place.

[mzihlmann]

suggestion: integrate scanner into kaniko

[cmellazchy]

Can you help elaborate your suggestion? Do you mean like a post build hook command / callback for a generic scanner binary as discussed in the issue I referenced in OP or actually completely packaging a specific scanner with kaniko?

[mzihlmann]

Please feel free to give it a go, we're always looking for contributors with good ideas #304. Go is simple enough that you can pick it up on an afternoon.

From the design I'd probably make it a subcommand similar to executor login, so executor push or something. Thank you for the suggestion.

[cmellazchy]

From the design I'd probably make it a subcommand similar to executor login, so executor push or something.

I initially considered this but quickly dropped the idea and am now leaning towards implementing a flag. My rationale is that the default behavior and thereby user expectation for the executor binary is already to build + push in one-shot. Introducing a new push sub-command might make it easy to get confused without reading the detailed documentation. Thoughts?

[mzihlmann]

I dont think there is much potential for confusion there. From my point of view adding a new command push is clearer than adding a flag --no-build, but I'm open to both approaches. I think there will be only limited overlap in the other flags, things like proxy and stuff might come in akward, but to give a clear answer I would need to see concrete implementation.

[cmellazchy]

Noted. Thanks for checking.