---
id: w1/m5/t001
title: Build via BuildKit/kpack Job → push to Zot
worker: worker1
status: done
estimate: 30m
depends_on: []
---

## Objective

Replace the operator's `docker build` shell-out with an in-cluster build: launch a BuildKit (or kpack) Job when `App.spec.repo` is set → build (Dockerfile or CNB) → push to Zot.

## Context

- `lego/operator/internal/build/build.go` (current docker-shell path); `BEX_REGISTRY` / `BEX_CNB_BUILDER` already carry the registry + CNB builder config — keep the contract, replace the execution.
- Zot already deployed in-cluster (`deploy/gitops` zot, StatefulSet `zot-0`); nodes pull from it.

## Files

- `lego/operator/internal/build/build.go` (+ Job manifest generation)

## Acceptance criteria

- [ ] Setting `App.repo` launches a build Job that pushes an image to Zot (no docker daemon required).

## Out of scope

- End-to-end run verification (t002); webhook (t003).
