Docker-in-Docker is working well enough, and it wasn't straightforward to get the certs injectect into Kaniko easily.