Kaniko "unpacking rootfs ... operation not permitted" in CI

Kaniko unpacks the base image layers onto the container filesystem to build. When the pod securityContext strips the capabilities Kaniko needs (for example via a restrictive Pod Security Standard), the extraction fails with operation not permitted.

What this error means

Kaniko fails during setup with "error building image: unpacking rootfs: ... operation not permitted" while extracting the base image.

kaniko

error building image: error building stage: failed to get filesystem from image:
extracting fs from image: chown /var/cache: operation not permitted

Common causes

A restrictive securityContext removes needed capabilities

Dropping all capabilities or enforcing a restricted Pod Security Standard prevents Kaniko from performing chown and other filesystem operations during unpack.

A read-only root filesystem or no-new-privileges

readOnlyRootFilesystem or an environment that blocks the operations Kaniko needs to write the extracted layers causes the failure.

How to fix it

Grant the Kaniko container the capabilities it needs

Run Kaniko in a namespace or with a securityContext that permits the filesystem operations it performs during unpack.

pod.yaml

securityContext:
  runAsUser: 0
  capabilities:
    add: ["CHOWN", "SETUID", "SETGID", "FOWNER", "DAC_OVERRIDE"]

Place the job in a namespace that allows it

If Pod Security Standards are enforced restricted cluster-wide, run Kaniko builds in a namespace labeled to allow the baseline it needs.

namespace.yaml

metadata:
  labels:
    pod-security.kubernetes.io/enforce: baseline

How to prevent it

Run Kaniko builds in a namespace whose Pod Security Standard permits the unpack operations.
Do not drop all capabilities on the Kaniko container.
Keep readOnlyRootFilesystem off for the build container.