Introduction
ko is a build tool designed specifically for Go applications. It compiles Go binaries and packages them into minimal OCI-compliant container images without requiring a Dockerfile, a local Docker daemon, or any build scripting.
What ko Does
- Compiles Go source code and produces OCI container images in one command
- Pushes images directly to any container registry
- Resolves image references in Kubernetes YAML manifests automatically
- Builds multi-platform images (linux/amd64, linux/arm64) natively
- Integrates with sigstore/cosign for image signing
Architecture Overview
ko uses the Go toolchain to cross-compile binaries, then layers them onto a base image (distroless by default) using the go-containerregistry library. The result is a minimal image containing only the compiled binary and its runtime dependencies, with no shell, package manager, or OS utilities. Images are pushed directly to a registry without touching a local Docker socket.
Self-Hosting & Configuration
- Install via Go, Homebrew, or download a release binary
- Set KO_DOCKER_REPO to your target registry (e.g., ghcr.io/user)
- Configure .ko.yaml for custom base images, build flags, and platform targets
- Use ko resolve to rewrite image references in Kubernetes manifests before applying
- Works in CI without Docker: only needs Go and network access to the registry
Key Features
- No Dockerfile required: Go source is the only input
- Distroless base images by default for a smaller attack surface
- Sub-second rebuilds by caching Go build artifacts
- Native multi-architecture image builds without emulation
- YAML-aware: replaces image references in-place for kubectl apply workflows
Comparison with Similar Tools
- Docker Build — requires a Dockerfile and running daemon; ko needs neither
- Buildpacks (pack) — auto-detects language but produces larger images; ko outputs minimal Go-specific images
- Kaniko — builds Dockerfiles inside Kubernetes without a daemon; ko skips Dockerfiles entirely
- Jib — similar Dockerfile-free approach but for Java/Gradle/Maven; ko is Go-specific
- GoReleaser — focuses on release packaging (tarballs, Homebrew); ko focuses on container images
FAQ
Q: Do I need Docker installed to use ko? A: No. ko compiles Go and pushes images directly to a registry using the Go toolchain only.
Q: Can ko build non-Go applications? A: No. ko is purpose-built for Go. For other languages, consider Buildpacks or a Dockerfile.
Q: How does ko handle dependencies like C libraries? A: By default ko uses static Go builds. For CGO dependencies, you can configure a custom base image with the required libraries.
Q: Does ko support private registries? A: Yes. ko uses standard Docker credential helpers and supports any OCI-compliant registry.