Docker Build and Push

Daemonless Docker image build using Kaniko (root, used when Buildah is not a fit).

Reference: loha/docker-build@v1

Category: build

Runtime: gcr.io/kaniko-project/executor:v1.23.2-debug (root, digest-pinned)

License: Apache-2.0

When to use

Use this step for Docker-style builds where Buildah's rootless mode causes friction, e.g. images that depend on overlay-fs features or specific Docker semantics. Otherwise prefer buildah-build for the safer rootless path.

Parameters

Parameter	Type	Default	Required	Description
IMAGE	string	—	Yes	Full image reference including tag (e.g., registry.example.com/org/app:v1.0.0).
DOCKERFILE	string	./Dockerfile	No	Path to Dockerfile relative to CONTEXT directory.
CONTEXT	string	.	No	Docker build context directory, relative to workspace root.
BUILD_ARGS	string	""	No	Docker build arguments as comma-separated KEY=VALUE pairs (e.g., NODE_ENV=production,NEXT_TELEMETRY_DISABLED=1).
TARGET	string	""	No	Multi-stage build target. Leave empty to build the final stage.
CACHE	enum: true, false	true	No	Enable Kaniko layer caching.
SKIP_PUSH	enum: true, false	false	No	Build the image but skip pushing to registry. Useful for validation-only builds.

Workspaces

• source (required): bound from pipeline workspace source
• dockerconfig (optional): bound from pipeline workspace docker-credentials

Results

Result	Description
IMAGE_DIGEST	Digest (sha256:...) of the built image
IMAGE_URL	Full URL of the pushed image including digest

How it works

Runs gcr.io/kaniko-project/executor against your Dockerfile. Kaniko is daemonless but does run as root (required to manipulate image layers); the elevated context is contained to this step and does not grant host access. Layer caching is enabled by default and stored in the registry. Registry credentials come from the dockerconfig workspace, which Loha populates automatically from the registries you configure under Settings → Registries. You do not create or bind it yourself.

Examples

Standard build + push

steps:
  - name: build-image
    uses: loha/docker-build@v1
    with:
      IMAGE: 'registry.example.com/my-org/my-app:${COMMIT_SHA}'
      CONTEXT: '.'
      DOCKERFILE: './apps/dashboard/Dockerfile'
      BUILD_ARGS: 'NODE_ENV=production,NEXT_TELEMETRY_DISABLED=1'

Multi-stage build targeting the production stage

steps:
  - name: build-image
    uses: loha/docker-build@v1
    with:
      IMAGE: 'registry.example.com/my-org/api:latest'
      CONTEXT: '.'
      TARGET: 'production'

Build, scan, then push

Build with SKIP_PUSH, scan the local image, push only if the scan passes.

steps:
  - name: build-image
    uses: loha/docker-build@v1
    with:
      IMAGE: 'registry.example.com/my-org/app:${COMMIT_SHA}'
      SKIP_PUSH: 'true'

  - name: scan-image
    uses: loha/trivy-scan@v1
    with:
      SCAN_TYPE: 'image'
      SCAN_TARGET: 'registry.example.com/my-org/app:${COMMIT_SHA}'

  - name: push-image
    uses: loha/docker-build@v1
    with:
      IMAGE: 'registry.example.com/my-org/app:${COMMIT_SHA}'
      CACHE: 'false'

Troubleshooting

Problem: COPY failed: no source files were specified.

Solution: Verify CONTEXT points at a directory containing the files referenced by COPY. Paths are relative to the workspace root, not the Dockerfile location.

---

Problem: Slow builds or timeouts.

Solution: Keep CACHE: "true" (default), order Dockerfile commands by churn (frequently-changed lines last), and trim the build context with a .dockerignore.

Notes

Runs as root inside its own container: required for Kaniko to manipulate image layers. The privilege is contained to the step pod and does not grant host access. If your security policy disallows this, use buildah-build instead.