What are Kaniko and Buildah, and why would you use them instead of standard docker build in CI?

Both build OCI-compliant images without requiring a running Docker daemon at all (daemonless), and without needing privileged container mode — Kaniko runs entirely inside a single container executing build steps directly against the filesystem, and Buildah similarly builds images using unprivileged user namespaces. This matters most on shared/multi-tenant CI infrastructure where granting Docker-in-Docker or socket access to every job would be an unacceptable security exposure.