We have had success with rotless buildx instances in k8s (they don't need to run in privileged containers) and kaniko (which might not fit your usecase)