# kindgi build > Bundle + build + sign a pack image ## `kindgi build` **Synopsis** ```sh signature kindgi build [--local [--push []] [--platform ]] [--hosted [--project ]] [--target ] [--endpoint ] [--env ] [--out ] [--artifact-version ] [--published-at ] [--tenant ] [--signing-key ] [--registry-push-creds ] [--skip-integrity-gate] [--skip-image-pull] [--skip-sign] [--path ] ``` Bundle + build + sign a pack image. Emits deploy-envelope.json for `kindgi deploy`. `--local` builds the image with this machine's Docker instead: no build service, no signing; with `--push`, it pushes the image, signs it, and writes the envelope. **Options** | Option | Default | Description | | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `--artifact-version ` | the build time, as `YYYYMMDD.HHMMSS` (UTC) | The artifact version, in the image and its signature. Default: the build time as `YYYYMMDD.HHMMSS` (UTC). For a reproducible build, pass `--artifact-version` and `--published-at`. | | `--endpoint ` | the env block's `build`; required when there is none (not used with `--local` or `--hosted`, which builds at the CLI's API URL under `/cloud`) | The build server. Default: the env block's `build`. Not used with `--local` or `--hosted`. | | `--env ` | `staging` | The environment block in `kindgi.config.ts` to build for. Default: `staging`. | | `--hosted` | off | Build on Kindgi hosted's build service, at the API's address under `/cloud`, with your API key; the image goes to your workspace's own repository. Same as the env block's `build: 'hosted'`. | | `--local` | off | Build with this machine's Docker instead of a build server: no signing and no envelope unless `--push`. | | `--out ` | `.kindgi/build` under the pack root | Where the build output and `deploy-envelope.json` go. Default: `.kindgi/build` under the pack root. | | `--path ` | the current directory (the pack root is resolved from it) | The pack root. Default: the current directory. | | `--platform ` | with `--local`: `linux/amd64` when pushing, else this machine's | With `--local`: the image's platform. Default: `linux/amd64` when pushing, else this machine's. | | `--project ` | none: the build carries no project label (with `--hosted` only) | With `--hosted`: the project the build is for, by id, kept as a label on the build. | | `--published-at ` | the build time | The publish time (an ISO 8601 time with a zone, or a date: its start, UTC), in the image and its signature. Default: the build time. For a reproducible build, pass `--artifact-version` and `--published-at`. | | `--push ` | none; a bare `--push` uses the env block's `registry` + `/` | With `--local`: push the image, sign it and write the envelope. Default repository: the env block's `registry` + `/`. | | `--registry-push-creds ` | none | A reference to the registry push credentials for the build server to use, passed through as is. | | `--signer-key-id ` | the env block's `signerKeyId`, else the key file's name | The key id the signature names. Default: the env block's `signerKeyId`, else the key file's name. | | `--signing-key ` | the env block's `signingKey`; required to sign (unless `--skip-sign`) | The Ed25519 private key (PEM) to sign with. Default: the env block's `signingKey`. | | `--skip-image-pull` | off | Check the image's index by hash only, without pulling the image. Build-server builds only. | | `--skip-integrity-gate` | off | Sign without checking the image's index against the local one. Prints a warning. Build-server builds only. | | `--skip-sign` | off | Write an unsigned envelope (for CI that signs elsewhere); `kindgi deploy` refuses it. | | `--target ` | the env block's `buildTarget`, else the env name | The build target, set in the image build and sent to the build server. Default: the env block's `buildTarget`, else the env name. | | `--tenant ` | the env block's `tenantId`, else `KINDGI_TENANT_ID`, else with `--hosted` the API key's own tenant; required unless `--local` without `--push` | The tenant the signature names. Default: the env block's `tenantId`, else `KINDGI_TENANT_ID`, else with `--hosted` your key's own tenant. | Every command also takes the [global flags](https://docs.kindgi.com/v0.1.8/reference/cli.md#global-flags). **Examples** From [Deploy on Azure Container Apps](https://docs.kindgi.com/v0.1.8/deploy/azure-container-apps.md): ```sh pnpm exec kindgi build --local --push --env dev ``` From [Deploy on Google Cloud Run](https://docs.kindgi.com/v0.1.8/deploy/cloud-run.md): ```sh pnpm exec kindgi build --local --push --env prod ``` **See also** - [Deploy on Azure Container Apps](https://docs.kindgi.com/v0.1.8/deploy/azure-container-apps.md) - [Deploy on Google Cloud Run](https://docs.kindgi.com/v0.1.8/deploy/cloud-run.md) - [Rotate the runtime's tokens and keys](https://docs.kindgi.com/v0.1.8/deploy/rotate-keys.md) - [Self-host Kindgi](https://docs.kindgi.com/v0.1.8/deploy/self-host.md)