Kubernetes v1.37.1 build recipe

github.com/kubernetes/kubernetes (v1.37.1) at f78e722310e50bcaca9276be22276d9e91d91308

Also built from source:

• github.com/containerd/containerd (v2.4.2) at b7a25261e029d68978bbf290df0a62fc819b3c51
• github.com/opencontainers/runc (v1.5.2) at 29dd3dc2b13b4123162e5fe132504bb4b15569f1
• github.com/containernetworking/plugins (v1.9.1) at adc3e6b5b581638afbd194cf2e9319ecbb0151a1
• github.com/kubernetes-sigs/cri-tools (v1.37.0) at 13496db06e3f6636a0855977dd86344698dfc501
• github.com/etcd-io/etcd (v3.7.2) at 68c065e562994b89e333e77b039ad066f933c586
• github.com/coredns/coredns (v1.15.0) at a6fde3fe339c6ec848447e11cc9796be8c97b4e0

Fetched once, with the network on, by the vendor step (Dockerfile.vendor) when the kit was made; the offline build uses the kit's vendored copies:

• git https://github.com/kubernetes/kubernetes.git v1.37.1
• git https://github.com/containerd/containerd.git v2.4.2
• git https://github.com/opencontainers/runc.git v1.5.2
• git https://github.com/containernetworking/plugins.git v1.9.1
• git https://github.com/kubernetes-sigs/cri-tools.git v1.37.0
• git https://github.com/etcd-io/etcd.git v3.7.2
• git https://github.com/coredns/coredns.git v1.15.0

• Base imagegolang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af
• Base imageubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c
• BuildKitmoby/buildkit:v0.31.2
  sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0
• Build methodsource-rebuild-go
• SOURCE_DATE_EPOCH1790183182 (2026-09-23T17:06:22Z)
• Target digest (linux/amd64)sha256:fd30476fb8e96b42deaaafcb7ba25e0437b57c83ceeac7c6ae42572559ca20e7
• Target config digestsha256:5e10dc285aac70e4edc7e61b0a6806dec85a18141c356bf6c019acbd1b5a0394
• Checksummed kit files92,986 (CHECKSUMS.sha256)

# =====================================================================
# Kubernetes v1.37.1 L-009 HERMETIC OFFLINE BUILD — the canonical, attestation-producing build. build_kit runs
#   docker buildx build --builder readystack-builder-max --network=none
#     --attest type=provenance,mode=max --attest type=sbom --push <git-context>
# Pinned-public-base + vendored model: golang 1.26.10 + ubuntu 24.04 pinned BY DIGEST (BASE_IMAGE_DIGESTS.lock);
# vendored/*-src are fully vendored Go trees (GOPROXY=off, vendor/), every binary compiled here on the one pinned Go;
# vendored/debs is the apt closure, vendored/seccomp-debs Debian's libseccomp-dev for runc, both dpkg offline.
# Dockerfile and Dockerfile.offline are byte copies of this file (the repo-wide convention).
#
# SHAPE: one container, two ways to run it (kube-entrypoint.sh):
#   default (USER 999 kube, no extra privileges): the control plane — etcd, kube-apiserver, kube-controller-manager,
#     kube-scheduler. A Kubernetes API with no node.
#   --privileged --user 0: a single-node cluster — the same control plane, still run as kube, plus containerd,
#     kubelet and kube-proxy as root, CoreDNS and a ptp CNI network, so Pods run inside this container.
# =====================================================================

# --- kubernetes: the seven binaries, plus the pause container image built from upstream's pause.c ---------------------
FROM golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af AS kubernetes-build
ARG SOURCE_DATE_EPOCH=1790183182
WORKDIR /k8s
COPY vendored/kubernetes-src/ .
ENV CGO_ENABLED=0 GOTOOLCHAIN=local GOFLAGS=-buildvcs=false GOPROXY=off
# upstream hack/lib/golang.sh + version.sh: tags selinux,notest,grpcnotrace; -trimpath -s -w; gitVersion/gitCommit/
# gitTreeState/gitMajor/gitMinor/buildDate stamped into both version packages; buildDate from SOURCE_DATE_EPOCH (the tag

Continues: 153 more lines. Create a free account to read the rest, or sign in.

#!/usr/bin/env bash
# =============================================================================
# ReadyStack — offline reproducible rebuild.
#
# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access
# of any kind, and prints the resulting linux/amd64 image-manifest digest.
# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.
#
# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.
# No git, no registry access, no additional tooling.
#
#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)
#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI
#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,
#                                     isolated build platform and sign that provenance with a key the build cannot
#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image
#                                     digest is the same either way.
# =============================================================================
set -euo pipefail
PROVENANCE=0
for arg in "$@"; do
  case "$arg" in
    --provenance) PROVENANCE=1 ;;
    -h|--help) sed -n '2,20p' "$0"; exit 0 ;;

Continues: 101 more lines. Create a free account to read the rest, or sign in.