containers/buildah
Buildah
Buildah is a tool for creating OCI-compliant container images without requiring a background daemon process. It functions as a daemonless image constructor and distribution tool, allowing users to build, push, and pull images between local storage and remote registries.
The project distinguishes itself by supporting unprivileged image building through the use of user namespaces and rootless mode. It enables direct modification of container root filesystems by mounting them to the host, allowing images to be treated as directories that can be manipulated via standard shell commands or scripts.
The build engine supports both Dockerfile emulation and scripted image construction to generate compliant artifacts. Additional capabilities include containerized build isolation, build cache acceleration for increased speed, and the production of reproducible, bit-for-bit identical images.
The toolset also includes utilities for managing working containers, committing container state, and inspecting image metadata.
Features
- Daemonless Container Engines - Operates as a daemonless image constructor that avoids the security risks of a privileged background process.
- Rootfs Manipulation - Enables direct modification of container root filesystems by mounting them to the host as directories.
- Content Injection - Allows adding local files or remote content directly into a container filesystem during image construction.
- OCI-Compliant Packaging - Produces artifacts that adhere to Open Container Initiative standards for filesystem layout and metadata.
- Container Image Builders - Constructs OCI-compliant container images from scratch or Dockerfiles without a background daemon.
- Unprivileged Builders - Constructs container images in environments without root access using user namespaces and rootless mode.
- Container Image Management - Provides utilities to manage the lifecycle of temporary working containers used during the build process.
- Image Generation - Generates compliant images using build files or scripts to define the filesystem and configuration.
- State Committing - Captures the filesystem state of a running container to commit it as a new reusable image.
- Container Image Distribution - Handles pushing and pulling OCI-compliant images between local storage and remote registries.
- Image Construction - Builds container images directly on the host filesystem without requiring a background daemon process.
- Daemonless Execution - Builds container images from standard Dockerfiles without needing a background daemon running on the host system.
- Dockerfile Emulation - Emulates standard build file processes to create images without requiring a background daemon.
- OCI Container Engines - Ensures created images follow Open Container Initiative standards for compatibility across different runtimes.
- Scripted Image Construction - Provides the ability to construct container images via general purpose scripts rather than static Dockerfiles.
- Unprivileged Image Building - Creates container images without requiring root access or administrative privileges to increase security.
- Unprivileged Image Construction - Supports building OCI-compliant images in rootless mode using Linux user namespaces.
- Rootless Execution - Enables image creation without root privileges by utilizing user namespaces and rootless mode.
- Container Filesystem Manipulation - Modifies container contents directly by mounting the root filesystem or using scripts instead of static build files.
- Rootfs Manipulation - Treats container images as directories on disk that can be modified using standard shell commands and scripting.
- Build Layer Caching - Implements mechanisms for caching container image layers to increase build speed and efficiency.
- Containerized Build Systems - Supports executing the image construction process within isolated containers to protect the host system.
- Host-to-Layer Mounting - Mounts container root filesystems to the host to allow direct manipulation of files before committing them as layers.
- Rootfs Manipulators - Provides a tool for mounting and modifying container root filesystems directly to commit changes as new layers.
- Reproducible Builds - Produces bit-for-bit identical container artifacts from the same source to ensure build determinism.
- Container Management - Container image building tool.
- Image Builders - Facilitates building OCI-compliant container images.
