- We've published libraries to interact with the registry without docker or the docker CLI, which we use in these projects https://github.com/google/go-contain

- We've published libraries to interact with the registry without docker or the docker CLI, which we use in these projects https://github.com/google/go-containerregistry https://github.com/google/go-containerregistry https://github.com/google/containerregistry https://github.com/google/containerregistry - Our team has built something exactly like you're describing https://github.com/GoogleCloudPlatform/distroless https://github.com/GoogleCloudPlatform/distroless Dockerfiles without RUN commands are technically more correct: reproducible, much easier to inspect. However, its quite limiting for the existing corpus of Dockerfiles. I like to think of kaniko as the (pull) + build + push decoupling of the docker monolith. Other tools, like cri-o, have implemented the complement (pull + run). Disclaimer: I work on kaniko and some of these other tools at Google