kine

packaged by Chainguard

Chainguard Container for kine

Kine is an etcd shim that lets you run Kubernetes on MySQL, Postgres, sqlite, or NATS instead of etcd

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/kine:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

Chainguard's kine image is comparable to the upstream Kine image published at ghcr.io/k3s-io/kine. It keeps the upstream /bin/kine entrypoint, the / working directory, the /db volume, and the nobody runtime user (UID 65534).

The image differs from upstream in the following ways:

• It contains no shell or package manager. Use the -dev variant when you need a shell for debugging.
• Image tags do not carry the v prefix that upstream tags use. For example, upstream v<version> corresponds to <version> here.
• The upstream ARCH build-time environment variable is not set, because Kine does not read it at runtime.

Getting Started

Kine is an etcd shim written in Go. It serves the etcd v3 gRPC API and translates those calls into operations on sqlite, PostgreSQL, MySQL or MariaDB, or NATS JetStream, so a Kubernetes API server can store its state in one of those backends instead of etcd. Kine is licensed under the Apache License 2.0.

Create a Docker network so that clients can reach Kine by name:

docker network create kine-net

Start Kine with its default embedded sqlite backend. With no flags, Kine listens on 0.0.0.0:2379 and writes its database to /db/state.db, which this command persists in a named volume:

docker run -d --name kine --network kine-net -v kine-db:/db \
  cgr.dev/ORGANIZATION/kine:latest

Write and read a key with etcdctl from the etcd image:

docker run --rm --network kine-net cgr.dev/ORGANIZATION/etcd:latest \
  etcdctl --endpoints=http://kine:2379 put /foo hello-kine
docker run --rm --network kine-net cgr.dev/ORGANIZATION/etcd:latest \
  etcdctl --endpoints=http://kine:2379 get /foo

OK
/foo
hello-kine

To back Kine with PostgreSQL, pass the database DSN with --endpoint. The following example assumes a PostgreSQL server named postgres on the same network:

docker run -d --name kine-pg --network kine-net \
  cgr.dev/ORGANIZATION/kine:latest \
  --endpoint "postgres://postgres:password@postgres:5432/kine?sslmode=disable"

Point a Kubernetes API server at Kine with --etcd-servers=http://kine:2379.

Configuration

Kine is configured with command-line flags, and each flag has a matching KINE_* environment variable. For example, --endpoint maps to KINE_ENDPOINT. Print the full list of flags with the following command:

docker run --rm cgr.dev/ORGANIZATION/kine:latest --help

The following example serves the etcd API over TLS with a certificate and key mounted from the host. The files must be readable by UID 65534:

docker run -d --name kine-tls --network kine-net -v "$PWD/certs:/certs:ro" \
  cgr.dev/ORGANIZATION/kine:latest \
  --server-cert-file /certs/server.crt \
  --server-key-file /certs/server.key

Kine also uses the following defaults:

• Port 2379/tcp serves the etcd v3 API.
• Port 8080/tcp serves Prometheus metrics at /metrics. Change it with --metrics-bind-address, or set it to 0 to disable metrics.
• /db holds the default sqlite database. The image creates it owned by the nobody user (UID 65534). Named volumes inherit this ownership. If you bind-mount a host directory instead, make sure UID 65534 can write to it.

Documentation and Resources

• Kine on GitHub
• Kine examples
• Chainguard Academy

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.