.ko.yaml

defaultBaseImage: gcr.io/distroless/static:nonroot
baseImageOverrides:
  # These base images run as root, which is needed for how they handle SSH credentials.
  # They are produced from ./images/Dockerfile
  github.com/tektoncd/pipeline/cmd/creds-init: gcr.io/tekton-nightly/github.com/tektoncd/pipeline/build-base:latest
  github.com/tektoncd/pipeline/cmd/git-init: gcr.io/tekton-nightly/github.com/tektoncd/pipeline/build-base:latest

  # GCS fetcher needs root due to workspace permissions
  github.com/tektoncd/pipeline/vendor/github.com/GoogleCloudPlatform/cloud-builders/gcs-fetcher/cmd/gcs-fetcher: gcr.io/distroless/static:latest
  # PullRequest resource needs root because in output mode it needs to access pr.json
  # which might have been copied or written with any level of permissions.
  github.com/tektoncd/pipeline/cmd/pullrequest-init: gcr.io/distroless/static:latest