tdeutsch/buildah_rootless repository overview

⁠buildah_rootless

buildah⁠ prepared for rootless image builds inside a pod, e.g. on OpenShift, following the upstream tutorial⁠.

⁠Usage

kubectl run buildah --image=ghcr.io/tuxpeople/buildah_rootless:latest
kubectl exec -it buildah -- buildah bud -t example:dev .

The container keeps running (sleep infinity) so you can exec into it.

⁠Configuration

⁠Image

• Based on quay.io/buildah/stable (Fedora), pinned by digest
• Image version = buildah version from the FROM tag (1.43.5, 1.43, 1, latest); Renovate updates the tag
• Previously the container ran python3 -m http.server just to keep running; it uses sleep infinity now

⁠Testing

Goss checks the build user, the subordinate IDs, the buildah binary and that the rootless settings apply to every process. An actual build is not tested: rootless buildah needs user namespaces, which Docker's default seccomp profile (and therefore CI) does not allow.

docker build -t buildah_rootless:test .
GOSS_FILE=goss.yaml dgoss run buildah_rootless:test

⁠Links

• buildah⁠
• GitHub Repository⁠
• Image Registry (GHCR)⁠
• Image Registry (Docker Hub)⁠