Ko

Go programs built into container images by ko, https://ko.build: no Dockerfile, no container daemon, one image per main package, pushed to a registry, loaded into the local daemon, or written to a tarball. One model type, @dataverket/ko/module, a Go module. describe records what ko works with: module path, Go and ko versions, the config file and base image in effect, every main package. build builds the commands named (paths or patterns, each checked to be a main package with go list), one ko run per command, and records every image with its reference and digest, plus the build record, also as a JSON file for an attestation to carry. resolve builds and publishes the ko:// references in a set of manifests and records the rendered manifests as a file, every image pinned by digest in them with whether it was built here, and every image not pinned. Images are named / by default. A base image pinned by digest and a cache directory make a build need the network only once. Three workflows, each bringing its own model and ending in an assertion: @dataverket/ko-verify proves every command builds, without a registry; @dataverket/ko-images builds and pushes, or loads into the daemon; and @dataverket/ko-manifests renders manifests with every image pinned by digest, for kubectl, flux or kustomize to take further. A skill, ko, says which to run for what. ko and go run as subprocesses in the module's directory with argv arrays, never through a shell; registry credentials come from the container config, never from an argument. Written against ko 0.19.1.