Buildah — Daemonless OCI Image Builder

What it is

Buildah is a command-line tool for building OCI-compliant container images. Unlike Docker, Buildah does not require a running daemon and can build images without root privileges. It supports standard Dockerfiles but also offers an imperative scripting mode where you build images step-by-step using shell commands.

Buildah targets container developers and CI/CD pipelines that need secure, daemonless image builds. It pairs with Podman (for running containers) and Skopeo (for moving images between registries) as part of the container tools ecosystem maintained by Red Hat.

How it saves time or tokens

Buildah's imperative mode lets you build images with fine-grained control. Instead of writing a Dockerfile with workarounds for caching and multi-stage builds, you script the build directly. This is useful for complex build processes that are awkward to express in Dockerfile syntax.

Daemonless, rootless builds mean you can run Buildah in CI environments without privileged containers, simplifying security compliance.

How to use

1. Build from a Dockerfile:

buildah bud -t myapp:latest .

1. Build imperatively without a Dockerfile:

ctr=$(buildah from ubuntu:22.04)
buildah run $ctr -- apt-get update
buildah run $ctr -- apt-get install -y python3
buildah copy $ctr ./app /opt/app
buildah config --cmd '/opt/app/start.sh' $ctr
buildah commit $ctr myapp:latest

1. Push to a registry:

buildah push myapp:latest docker://registry.example.com/myapp:latest

Example

A CI-friendly build script with caching:

#!/bin/bash
set -e

# Create working container from base
ctr=$(buildah from golang:1.22)

# Copy source and build
buildah copy $ctr . /src
buildah run $ctr -- sh -c 'cd /src && go build -o /app'

# Create minimal runtime image
runtime=$(buildah from gcr.io/distroless/static:latest)
buildah copy --from $ctr $runtime /app /app
buildah config --entrypoint '["app"]' $runtime
buildah commit $runtime myapp:latest

This achieves a multi-stage build without Dockerfile syntax.

Related on TokRepo

• AI tools for DevOps -- Container and infrastructure tools
• AI tools for automation -- Build automation for CI/CD pipelines

Common pitfalls

• Forgetting to clean up working containers. Each buildah from creates a working container. Use buildah rm --all to clean up after builds.
• Not using --layers for Dockerfile builds. Without layer caching, every build starts from scratch. Use buildah bud --layers to enable Docker-style layer caching.
• Mixing Buildah and Docker image stores. Buildah and Docker use separate image stores by default. Use Skopeo to copy images between them if needed.