buildah

Build OCI and Docker container images without a daemon

TLDR

Build container from Containerfile/Dockerfile

$ buildah build -t [myimage] [.]

Create working container

$ buildah from [fedora]

Run command in container

$ buildah run [container-id] -- [dnf install -y httpd]

Copy files into container

$ buildah copy [container-id] [local/path] [/container/path]

Commit container to image

$ buildah commit [container-id] [myimage]

List local images

$ buildah images

Push image to a registry

$ buildah push [myimage] [docker://registry.example.com/myimage:tag]

buildah is a tool for building OCI and Docker container images without requiring a daemon. It provides fine-grained control over image layers and can build from Dockerfiles or through direct manipulation of containers.Unlike Docker, buildah does not require a background daemon process, making it well-suited for CI/CD pipelines and restricted environments. It supports rootless builds, where the entire build process runs without elevated privileges. As part of the Podman ecosystem, it shares storage and image formats with podman and skopeo, allowing seamless interoperation between the tools.

PARAMETERS

build (formerly bud)

Build image using Containerfile/Dockerfile

from image

Create working container

run container cmd

Run command in container

commit container image

Save container as image

push image destination

Push image to registry

pull image

Pull image from registry

images

List images

containers

List working containers

copy container src dest

Copy files into container

config [options] container

Set image configuration (cmd, entrypoint, env, labels, etc.)

rm container

Remove container

rmi image

Remove image

inspect container|image

Display detailed information

mount container

Mount container filesystem

umount container

Unmount container filesystem

CONFIGURATION

/etc/containers/registries.conf

Registry configuration including mirrors, insecure registries, and search order.

/etc/containers/storage.conf

Storage driver and location settings for images and containers.

/etc/containers/policy.json

Image signature verification policy.

BUILDING IMAGES

From Containerfile/Dockerfile:

$ buildah build -t myapp:latest .

Script-based:

$ # Create container
ctr=$(buildah from fedora)

# Install packages
buildah run $ctr dnf install -y nginx

# Copy files
buildah copy $ctr ./app /app

# Set config
buildah config --cmd "/app/start.sh" $ctr

# Commit
buildah commit $ctr myapp:latest

FEATURES

- Daemonless operation- Rootless builds- Dockerfile compatibility- Fine-grained layer control- OCI image format- Multiple storage backends- Script-friendly

INSTALL

sudo apt install buildah

sudo dnf install buildah

sudo pacman -S buildah

sudo apk add buildah

sudo zypper install buildah

nix profile install nixpkgs#buildah

CAVEATS

Different from Docker workflow (learning curve). Some Docker features not supported. Rootless mode has kernel and filesystem limitations. Storage configuration important. The bud subcommand is deprecated in favor of build.