Kaniko latest tag breaking Alpine-based builds with symlink errors (regression between v1.25.9 and latest)

[haroonniazi]

Name and Version

public.ecr.aws/bitnami/kaniko:latest

What steps will reproduce the bug?

Bitnami's Kaniko latest tag was updated between February 27 and March 2, 2026, introducing a breaking change that causes Alpine-based Docker builds to fail with symlink errors.

Environment:

• Image: public.ecr.aws/bitnami/kaniko:latest
• Working version: public.ecr.aws/bitnami/kaniko:1.25.9
• Base image in Dockerfile: python:alpine3.23
• Build tool: GitLab CI/CD

Timeline:

• February 27, 2026: Builds successful with kaniko:latest
• March 2, 2026: Same builds failing with kaniko:latest
• March 2, 2026: Pinning to 1.25.9 resolves the issue

Error observed:
ERRO[0036] Couldn't eval /etc/dpkg/origins/debian with link /etc/dpkg/origins/debian

Steps to reproduce:

1. Use Dockerfile with Alpine base image (e.g., python:alpine3.23)
2. Build with public.ecr.aws/bitnami/kaniko:latest
3. Observe symlink-related errors during build

Workaround:
Pin to version 1.25.9: public.ecr.aws/bitnami/kaniko:1.25.9

Request:

1. Document what changed between v1.25.9 and current latest
2. Provide release notes for latest tag updates
3. Consider semantic versioning for breaking changes

What is the expected behavior?

The latest tag should maintain backward compatibility or clearly document breaking changes.

What do you see instead?

Alpine-based builds that worked with v1.25.9 fail with the current latest tag.

ERRO[0036] Couldn't eval /etc/dpkg/origins/debian with link /etc/dpkg/origins/debian

The build completes but the resulting Docker image is incomplete - some symlinked files are missing from the final image. This causes the Alpine-based Python application to fail when deployed.

Specifically:

1. Kaniko logs show symlink evaluation errors during the build
2. The build appears to complete but with errors
3. The pushed image is missing expected files/symlinks
4. The same Dockerfile that worked with kaniko:1.25.9 now fails with kaniko:latest

This regression occurred between February 27 and March 2, 2026, when the latest tag was updated.

Additional information

No response

[carrodher]

Thanks for reporting this and for the detailed timeline; that’s very helpful.

Between February 27 and March 3, several new upstream releases of Kaniko were published in the chainguard-forks/kaniko project. As usual, our Bitnami container images track upstream releases, and new image tags were automatically published reflecting those version bumps.

The updates on our side were strictly version bumps; no additional changes were introduced in the Bitnami container other than updating the embedded Kaniko version. The relevant updates were:

• March 3rd: [bitnami/kaniko] Release 1.25.11-debian-12-r0 #91204
• February 27th: [bitnami/kaniko] Release 1.25.10-debian-12-r0 #91160
• February 26th: [bitnami/kaniko] Release 1.25.9-debian-12-r0 #91127

Internally, these changes only update the upstream Kaniko binary. There were no modifications to symlink handling or filesystem logic on our side.

This strongly suggests the issue was introduced upstream between 1.25.9 and 1.25.10.

We recommend:

• Continuing to pin to 1.25.9 for now.
• Reporting the regression upstream in the chainguard-forks/kaniko repository if not already done

Regarding semantic versioning: the latest tag always tracks the newest upstream release and does not guarantee backward compatibility. For production systems, we strongly recommend pinning to a specific minor/patch version to avoid unexpected regressions like this.

[github-actions]

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.

[github-actions]

Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Issue. Do not hesitate to reopen it later if necessary.