<p>I trying to do a deployment through my k8s operator on openshift 3.11 cluster. When the kaniko job starts it gives me the following error.</p>

<pre><code>Error: error resolving dockerfile path: copying dockerfile: open /kaniko/Dockerfile: 
permission denied
</code></pre>

<p>Kaniko is being introduced as a tool to <a href="https://cloud.google.com/blog/products/gcp/introducing-kaniko-build-container-images-in-kubernetes-and-google-container-builder-even-without-root-access" rel="nofollow noreferrer">Build container images in Kubernetes and Google Container Builder without privileges</a>.</p>

<blockquote>
  <p>we’re excited to introduce <a href="https://github.com/GoogleCloudPlatform/kaniko" rel="nofollow noreferrer">kaniko</a>, an open-source tool for building container images from a Dockerfile even without privileged root access. With kaniko, we both build an image from a Dockerfile and push it to a registry. Since it doesn’t require any special privileges or permissions, you can run kaniko in a standard Kubernetes cluster, <a href="https://cloud.google.com/kubernetes-engine/" rel="nofollow noreferrer">Google Kubernetes Engine</a>, or in any environment that can’t have access to privileges or a Docker daemon.</p>
</blockquote>

<p>The issue you are experiencing was already mentioned at <a href="https://github.com/GoogleContainerTools/kaniko/issues/681" rel="nofollow noreferrer">GoogleContainerTools/kaniko</a> GitHub issue.</p>

<p>On January 11 this issue was tagged as <code>Won't Fix</code> so the only way is to run Kaniko as root using <code>securityContext: runAsUser: 0</code></p>

<p>This isn't secure as once would think, which is mentioned by <a href="https://kurtmadel.com/" rel="nofollow noreferrer">Kurt Madel</a> in his blog <a href="https://kurtmadel.com/posts/native-kubernetes-continuous-delivery/building-container-images-with-kubernetes" rel="nofollow noreferrer">Securely Building Container Images on Kubernetes</a>:</p>

<blockquote>
  <p>running as <code>root</code> is an attack vector that many consider to be an unacceptable security hole - but the use of Pod Security Policies will reduce the attack surface of the Kaniko container running as part of a K8s Pod and provides greater security than the Docker based approaches we have already dismissed.</p>
</blockquote>

<p>He also explains how one would use <a href="https://kurtmadel.com/posts/native-kubernetes-continuous-delivery/building-container-images-with-kubernetes/#kaniko-the-easy-way" rel="nofollow noreferrer">Kaniko the Easy Way</a></p>

<blockquote>
  <p>Jenkins X allows you to  <a href="https://jenkins-x.io/getting-started/create-cluster/#the-jx-create-cluster-gke-process" rel="nofollow noreferrer">enable Kaniko as the default way to build and push container images</a>  for all of your Jenkins X CD jobs and will be automatically configured to push to the default container registry of the cloud where you install Jenkins X and Kaniko caching is automatically set up for you - resulting in fast, secure container image builds that are pushed to your default Jenkins X container registry.</p>
  
  <p><strong>Important:</strong>  Jenkins X does not have OOTB support for Pod Security Policies as tracked by  <a href="https://github.com/jenkins-x/jx/issues/1074" rel="nofollow noreferrer">this GitHub issue</a>. In my next post we will take a look at using Pod Security Policies with Jenkins X - but not just for Kaniko, because once you enable Pod Security Policy every K8s  <code>Role</code>/<code>ClusterRole</code>  has to have a Pod Security Policy associated to it.</p>
  
  Drawbacks for Kaniko<a href="https://kurtmadel.com/posts/native-kubernetes-continuous-delivery/building-container-images-with-kubernetes/#drawbacks-for-kaniko" rel="nofollow noreferrer"></a>
  
  <ul>
  <li>Requires running the Kaniko container as  <code>ROOT</code>  to execute most container builds</li>
  <li>Doesn’t work with all  <code>Dockerfiles</code>  but keeps improving</li>
  <li>Is slightly more complicated to setup than the good old  <code>docker build</code></li>
  </ul>
</blockquote>
