1buildah-bud(1) General Commands Manual buildah-bud(1)
2
6 buildah-bud - Build an image using instructions from Containerfiles
7
10 buildah build-using-dockerfile [options] [context]
11 buildah bud [options] [context]
14 bud is an alias for build-using-dockerfile.
17
20 Builds an image using instructions from one or more Containerfiles or
21 Dockerfiles and a specified build context directory. A Containerfile
22 uses the same syntax as a Dockerfile internally. For this document, a
23 file referred to as a Containerfile can be a file named either 'Con‐
24 tainerfile' or 'Dockerfile'.
25 The build context directory can be specified as the http(s) URL of an
28 archive, git repository or Containerfile.
29 If no context directory is specified, then Buildah will assume the cur‐
32 rent working directory as build context, which should contain a Con‐
33 tainerfile.
34 Containerfiles ending with a ".in" suffix will be preprocessed via
37 CPP(1). This can be useful to decompose Containerfiles into several
38 reusable parts that can be used via CPP's #include directive. Notice,
39 a Containerfile.in file can still be used by other tools when manually
40 preprocessing them via cpp -E.
41 When the URL is an archive, the contents of the URL is downloaded to a
44 temporary location and extracted before execution.
45 When the URL is a Containerfile, the file is downloaded to a temporary
48 location.
49 When a Git repository is set as the URL, the repository is cloned
52 locally and then set as the context.
53
56 --add-host=[]
57 Add a custom host-to-IP mapping (host:ip)
60 Add a line to /etc/hosts. The format is hostname:ip. The --add-host
63 option can be set multiple times.
64 --annotation annotation
67 Add an image annotation (e.g. annotation=value) to the image metadata.
70 Can be used multiple times.
71 Note: this information is not present in Docker image formats, so it is
74 discarded when writing images in Docker formats.
75 --arch="ARCH"
78 Set the ARCH of the image to be pulled to the provided value instead of
81 using the architecture of the host. (Examples: aarch64, arm, i686,
82 ppc64le, s390x, x86_64)
83 --authfile path
86 Path of the authentication file. Default is ${XDG_RUNTIME_DIR}/contain‐
89 ers/auth.json, which is set using buildah login. If the authorization
90 state is not found there, $HOME/.docker/config.json is checked, which
91 is set using docker login.
92 Note: You can also override the default path of the authentication file
95 by setting the REGISTRY_AUTH_FILE environment variable. export REG‐
96 ISTRY_AUTH_FILE=path
97 --build-arg arg=value
100 Specifies a build argument and its value, which will be interpolated in
103 instructions read from the Containerfiles in the same way that environ‐
104 ment variables are, but which will not be added to environment variable
105 list in the resulting image's configuration.
106 Please refer to the BUILD TIME VARIABLES ⟨#build-time-variables⟩ sec‐
109 tion for the list of variables that can be overridden within the Con‐
110 tainerfile at run time.
111 --cache-from
114 Images to utilise as potential cache sources. Buildah does not cur‐
117 rently support caching so this is a NOOP.
118 --cap-add=CAP_xxx
121 When executing RUN instructions, run the command specified in the
124 instruction with the specified capability added to its capability set.
125 Certain capabilities are granted by default; this option can be used to
126 add more.
127 --cap-drop=CAP_xxx
130 When executing RUN instructions, run the command specified in the
133 instruction with the specified capability removed from its capability
134 set. The CAP_AUDIT_WRITE, CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FOWNER,
135 CAP_FSETID, CAP_KILL, CAP_MKNOD, CAP_NET_BIND_SERVICE, CAP_SETFCAP,
136 CAP_SETGID, CAP_SETPCAP, CAP_SETUID, and CAP_SYS_CHROOT capabilities
137 are granted by default; this option can be used to remove them.
138 If a capability is specified to both the --cap-add and --cap-drop
141 options, it will be dropped, regardless of the order in which the
142 options were given.
143 --cert-dir path
146 Use certificates at path (*.crt, *.cert, *.key) to connect to the reg‐
149 istry. The default certificates directory is /etc/containers/certs.d.
150 --cgroup-parent=""
153 Path to cgroups under which the cgroup for the container will be cre‐
156 ated. If the path is not absolute, the path is considered to be rela‐
157 tive to the cgroups path of the init process. Cgroups will be created
158 if they do not already exist.
159 --compress
162 This option is added to be aligned with other containers CLIs. Buildah
165 doesn't send a copy of the context directory to a daemon or a remote
166 server. Thus, compressing the data before sending it is irrelevant to
167 Buildah.
168 --cni-config-dir=directory
171 Location of CNI configuration files which will dictate which plugins
174 will be used to configure network interfaces and routing for containers
175 created for handling RUN instructions, if those containers will be run
176 in their own network namespaces, and networking is not disabled.
177 --cni-plugin-path=directory[:directory[:directory[...]]]
180 List of directories in which the CNI plugins which will be used for
183 configuring network namespaces can be found.
184 --cpu-period=0
187 Set the CPU period for the Completely Fair Scheduler (CFS), which is a
190 duration in microseconds. Once the container's CPU quota is used up, it
191 will not be scheduled to run until the current period ends. Defaults to
192 100000 microseconds.
193 On some systems, changing the CPU limits may not be allowed for
196 non-root users. For more details, see https://github.com/contain‐
197 ers/podman/blob/master/troubleshooting.md#26-running-contain‐
198 ers-with-cpu-limits-fails-with-a-permissions-error
199 --cpu-quota=0
202 Limit the CPU CFS (Completely Fair Scheduler) quota
205 Limit the container's CPU usage. By default, containers run with the
208 full CPU resource. This flag tell the kernel to restrict the con‐
209 tainer's CPU usage to the quota you specify.
210 On some systems, changing the CPU limits may not be allowed for
213 non-root users. For more details, see https://github.com/contain‐
214 ers/podman/blob/master/troubleshooting.md#26-running-contain‐
215 ers-with-cpu-limits-fails-with-a-permissions-error
216 --cpu-shares, -c=0
219 CPU shares (relative weight)
222 By default, all containers get the same proportion of CPU cycles. This
225 proportion can be modified by changing the container's CPU share
226 weighting relative to the weighting of all other running containers.
227 To modify the proportion from the default of 1024, use the --cpu-shares
230 flag to set the weighting to 2 or higher.
231 The proportion will only apply when CPU-intensive processes are run‐
234 ning. When tasks in one container are idle, other containers can use
235 the left-over CPU time. The actual amount of CPU time will vary depend‐
236 ing on the number of containers running on the system.
237 For example, consider three containers, one has a cpu-share of 1024 and
240 two others have a cpu-share setting of 512. When processes in all three
241 containers attempt to use 100% of CPU, the first container would
242 receive 50% of the total CPU time. If you add a fourth container with a
243 cpu-share of 1024, the first container only gets 33% of the CPU. The
244 remaining containers receive 16.5%, 16.5% and 33% of the CPU.
245 On a multi-core system, the shares of CPU time are distributed over all
248 CPU cores. Even if a container is limited to less than 100% of CPU
249 time, it can use 100% of each individual CPU core.
250 For example, consider a system with more than three cores. If you start
253 one container {C0} with -c=512 running one process, and another con‐
254 tainer {C1} with -c=1024 running two processes, this can result in the
255 following division of CPU shares:
256 PID container CPU CPU share
259 100 {C0} 0 100% of CPU0
260 101 {C1} 1 100% of CPU1
261 102 {C1} 2 100% of CPU2
262 --cpuset-cpus=""
266 CPUs in which to allow execution (0-3, 0,1)
269 --cpuset-mems=""
272 Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effec‐
275 tive on NUMA systems.
276 If you have four memory nodes on your system (0-3), use
279 --cpuset-mems=0,1 then processes in your container will only use memory
280 from the first two memory nodes.
281 --creds creds
284 The [username[:password]] to use to authenticate with the registry if
287 required. If one or both values are not supplied, a command line
288 prompt will appear and the value can be entered. The password is
289 entered without echo.
290 --decryption-key key[:passphrase]
293 The [key[:passphrase]] to be used for decryption of images. Key can
296 point to keys and/or certificates. Decryption will be tried with all
297 keys. If the key is protected by a passphrase, it is required to be
298 passed in the argument and omitted otherwise.
299 --device=device
302 Add a host device to the container. Optional permissions parameter can
305 be used to specify device permissions, it is combination of r for read,
306 w for write, and m for mknod(2).
307 Example: --device=/dev/sdc:/dev/xvdc:rwm.
310 Note: if _hostdevice is a symbolic link then it will be resolved first.
313 The container will only store the major and minor numbers of the host
314 device.
315 Note: if the user only has access rights via a group, accessing the
318 device from inside a rootless container will fail. The crun(1) runtime
319 offers a workaround for this by adding the option --annotation
320 run.oci.keep_original_groups=1.
321 --disable-compression, -D Don't compress filesystem layers when build‐
324 ing the image unless it is required by the location where the image is
325 being written. This is the default setting, because image layers are
326 compressed automatically when they are pushed to registries, and images
327 being written to local storage would only need to be decompressed again
328 to be stored. Compression can be forced in all cases by specifying
329 --disable-compression=false.
330 --disable-content-trust
333 This is a Docker specific option to disable image verification to a
336 Docker registry and is not supported by Buildah. This flag is a NOOP
337 and provided solely for scripting compatibility.
338 --dns=[]
341 Set custom DNS servers
344 This option can be used to override the DNS configuration passed to the
347 container. Typically this is necessary when the host DNS configuration
348 is invalid for the container (e.g., 127.0.0.1). When this is the case
349 the --dns flag is necessary for every run.
350 The special value none can be specified to disable creation of
353 /etc/resolv.conf in the container by Buildah. The /etc/resolv.conf file
354 in the image will be used without changes.
355 --dns-option=[]
358 Set custom DNS options
361 --dns-search=[]
364 Set custom DNS search domains
367 --file, -f Containerfile
370 Specifies a Containerfile which contains instructions for building the
373 image, either a local file or an http or https URL. If more than one
374 Containerfile is specified, FROM instructions will only be accepted
375 from the first specified file.
376 If a local file is specified as the Containerfile and it does not
379 exist, the context directory will be prepended to the local file value.
380 If you specify -f -, the Containerfile contents will be read from
383 stdin.
384 --force-rm bool-value
387 Always remove intermediate containers after a build, even if the build
390 fails (default false).
391 --format
394 Control the format for the built image's manifest and configuration
397 data. Recognized formats include oci (OCI image-spec v1.0, the
398 default) and docker (version 2, using schema format 2 for the mani‐
399 fest).
400 Note: You can also override the default format by setting the BUIL‐
403 DAH_FORMAT environment variable. export BUILDAH_FORMAT=docker
404 --from
407 Overrides the first FROM instruction within the Containerfile. If
410 there are multiple FROM instructions in a Containerfile, only the first
411 is changed.
412 -h, --help
415 Print usage statement
418 --http-proxy=true
421 By default proxy environment variables are passed into the container if
424 set for the buildah process. This can be disabled by setting the
425 --http-proxy option to false. The environment variables passed in
426 include http_proxy, https_proxy, ftp_proxy, no_proxy, and also the
427 upper case versions of those.
428 --iidfile ImageIDfile
431 Write the image ID to the file.
434 --ignorefile
437 Path to an alternative .dockerignore file.
440 --ipc how
443 Sets the configuration for IPC namespaces when handling RUN instruc‐
446 tions. The configured value can be "" (the empty string) or "con‐
447 tainer" to indicate that a new IPC namespace should be created, or it
448 can be "host" to indicate that the IPC namespace in which buildah
449 itself is being run should be reused, or it can be the path to an IPC
450 namespace which is already in use by another process.
451 --isolation type
454 Controls what type of isolation is used for running processes as part
457 of RUN instructions. Recognized types include oci (OCI-compatible run‐
458 time, the default), rootless (OCI-compatible runtime invoked using a
459 modified configuration, with --no-new-keyring added to its create invo‐
460 cation, with network and UTS namespaces disabled, and IPC, PID, and
461 user namespaces enabled; the default for unprivileged users), and
462 chroot (an internal wrapper that leans more toward chroot(1) than con‐
463 tainer technology).
464 Note: You can also override the default isolation type by setting the
467 BUILDAH_ISOLATION environment variable. export BUILDAH_ISOLATION=oci
468 --jobs N
471 Run up to N concurrent stages in parallel. If the number of jobs is
474 greater than 1, stdin will be read from /dev/null. If 0 is specified,
475 then there is no limit in the number of jobs that run in parallel.
476 --label label
479 Add an image label (e.g. label=value) to the image metadata. Can be
482 used multiple times.
483 Users can set a special LABEL io.containers.capabilities=CAP1,CAP2,CAP3
486 in a Containerfile that specified the list of Linux capabilities
487 required for the container to run properly. This label specified in a
488 container image tells container engines, like Podman, to run the con‐
489 tainer with just these capabilities. The container engine launches the
490 container with just the specified capabilities, as long as this list of
491 capabilities is a subset of the default list.
492 If the specified capabilities are not in the default set, container
495 engines should print an error message and will run the container with
496 the default capabilities.
497 --layers bool-value
500 Cache intermediate images during the build process (Default is false).
503 Note: You can also override the default value of layers by setting the
506 BUILDAH_LAYERS environment variable. export BUILDAH_LAYERS=true
507 --logfile filename
510 Log output which would be sent to standard output and standard error to
513 the specified file instead of to standard output and standard error.
514 --loglevel number
517 Adjust the logging level up or down. Valid option values range from -2
520 to 3, with 3 being roughly equivalent to using the global
521 --log-level=debug option, and values below 0 omitting even error mes‐
522 sages which accompany fatal errors.
523 --manifest "manifest"
526 Name of the manifest list to which the image will be added. Creates the
529 manifest list if it does not exist. This option is useful for building
530 multi architecture images.
531 --memory, -m=""
534 Memory limit (format: [], where unit = b, k, m or g)
537 Allows you to constrain the memory available to a container. If the
540 host supports swap memory, then the -m memory setting can be larger
541 than physical RAM. If a limit of 0 is specified (not using -m), the
542 container's memory is not limited. The actual limit may be rounded up
543 to a multiple of the operating system's page size (the value would be
544 very large, that's millions of trillions).
545 --memory-swap="LIMIT"
548 A limit value equal to memory plus swap. Must be used with the -m
551 (--memory) flag. The swap LIMIT should always be larger than -m (--mem‐
552 ory) value. By default, the swap LIMIT will be set to double the value
553 of --memory.
554 The format of LIMIT is <number>[<unit>]. Unit can be b (bytes), k
557 (kilobytes), m (megabytes), or g (gigabytes). If you don't specify a
558 unit, b is used. Set LIMIT to -1 to enable unlimited swap.
559 --network, --net=mode
562 Sets the configuration for network namespaces when handling RUN
565 instructions.
566 Valid mode values are:
569 · none: no networking;
572 · host: use the host network stack. Note: the host mode gives
574 the container full access to local system services such as
575 D-bus and is therefore considered insecure;
576 · ns:path: path to a network namespace to join;
578 · private: create a new namespace for the container (default)
580 --no-cache
584 Do not use existing cached images for the container build. Build from
587 the start with a new set of cached layers.
588 --os="OS"
591 Set the OS of the image to be pulled instead of using the current oper‐
594 ating system of the host.
595 --pid how
598 Sets the configuration for PID namespaces when handling RUN instruc‐
601 tions. The configured value can be "" (the empty string) or "private"
602 to indicate that a new PID namespace should be created, or it can be
603 "host" to indicate that the PID namespace in which buildah itself is
604 being run should be reused, or it can be the path to a PID namespace
605 which is already in use by another process.
606 --platform="OS/ARCH"
609 Set the OS/ARCH of the image to the provided value instead of using the
612 current operating system and architecture of the host (for example
613 linux/arm). If --platform is set, then the values of the --arch and
614 --os options will be overridden.
615 --pull
618 When the flag is enabled, attempt to pull the latest image from the
621 registries listed in registries.conf if a local image does not exist or
622 the image is newer than the one in storage. Raise an error if the image
623 is not in any listed registry and is not present locally.
624 If the flag is disabled (with --pull=false), do not pull the image from
627 the registry, unless there is no local image. Raise an error if the
628 image is not in any registry and is not present locally.
629 Defaults to true.
632 --pull-always
635 Pull the image from the first registry it is found in as listed in reg‐
638 istries.conf. Raise an error if not found in the registries, even if
639 the image is present locally.
640 --pull-never
643 Do not pull the image from the registry, use only the local version.
646 Raise an error if the image is not present locally.
647 --quiet, -q
650 Suppress output messages which indicate which instruction is being pro‐
653 cessed, and of progress when pulling images from a registry, and when
654 writing the output image.
655 --rm bool-value
658 Remove intermediate containers after a successful build (default true).
661 --runtime path
664 The path to an alternate OCI-compatible runtime, which will be used to
667 run commands specified by the RUN instruction. Default is runc, or crun
668 when machine is configured to use cgroups V2.
669 Note: You can also override the default runtime by setting the BUIL‐
672 DAH_RUNTIME environment variable. export BUILDAH_RUNTIME=/usr/bin/crun
673 --runtime-flag flag
676 Adds global flags for the container rutime. To list the supported
679 flags, please consult the manpages of the selected container runtime.
680 Note: Do not pass the leading -- to the flag. To pass the runc flag
683 --log-format json to buildah bud, the option given would be --run‐
684 time-flag log-format=json.
685 --security-opt=[]
688 Security Options
691 "apparmor=unconfined" : Turn off apparmor confinement for the container
694 "apparmor=your-profile" : Set the apparmor confinement profile for
695 the container
696 "label=user:USER" : Set the label user for the container
699 "label=role:ROLE" : Set the label role for the container
700 "label=type:TYPE" : Set the label type for the container
701 "label=level:LEVEL" : Set the label level for the container
702 "label=disable" : Turn off label confinement for the container
703 "no-new-privileges" : Not supported
704 "seccomp=unconfined" : Turn off seccomp confinement for the container
707 "seccomp=profile.json : White listed syscalls seccomp Json file to
708 be used as a seccomp filter
709 --shm-size=""
712 Size of /dev/shm. The format is <number><unit>. number must be greater
715 than 0. Unit is optional and can be b (bytes), k (kilobytes),
716 m(megabytes), or g (gigabytes). If you omit the unit, the system uses
717 bytes. If you omit the size entirely, the system uses 64m.
718 --sign-by fingerprint
721 Sign the built image using the GPG key that matches the specified fin‐
724 gerprint.
725 --squash
728 Squash all of the image's new layers into a single new layer; any pre‐
731 existing layers are not squashed.
732 --stdin
735 Pass stdin into the RUN containers. Sometime commands being RUN within
738 a Containerfile want to request information from the user. For example
739 apt asking for a confirmation for install. Use --stdin to be able to
740 interact from the terminal during the build.
741 --tag, -t imageName
744 Specifies the name which will be assigned to the resulting image if the
747 build process completes successfully. If imageName does not include a
748 registry name, the registry name localhost will be prepended to the
749 image name.
750 --target stageName
753 Set the target build stage to build. When building a Containerfile
756 with multiple build stages, --target can be used to specify an interme‐
757 diate build stage by name as the final stage for the resulting image.
758 Commands after the target stage will be skipped.
759 --timestamp seconds
762 Set the create timestamp to seconds since epoch to allow for determin‐
765 istic builds (defaults to current time). By default, the created time‐
766 stamp is changed and written into the image manifest with every commit,
767 causing the image's sha256 hash to be different even if the sources are
768 exactly the same otherwise. When --timestamp is set, the created time‐
769 stamp is always set to the time specified and therefore not changed,
770 allowing the image's sha256 to remain the same. All files committed to
771 the layers of the image will be created with the timestamp.
772 --tls-verify bool-value
775 Require HTTPS and verification of certificates when talking to con‐
778 tainer registries (defaults to true). TLS verification cannot be used
779 when talking to an insecure registry.
780 --ulimit type=soft-limit[:hard-limit]
783 Specifies resource limits to apply to processes launched when process‐
786 ing RUN instructions. This option can be specified multiple times.
787 Recognized resource types include:
788 "core": maximum core dump size (ulimit -c)
789 "cpu": maximum CPU time (ulimit -t)
790 "data": maximum size of a process's data segment (ulimit -d)
791 "fsize": maximum size of new files (ulimit -f)
792 "locks": maximum number of file locks (ulimit -x)
793 "memlock": maximum amount of locked memory (ulimit -l)
794 "msgqueue": maximum amount of data in message queues (ulimit -q)
795 "nice": niceness adjustment (nice -n, ulimit -e)
796 "nofile": maximum number of open files (ulimit -n)
797 "nofile": maximum number of open files (1048576); when run by root
798 "nproc": maximum number of processes (ulimit -u)
799 "nproc": maximum number of processes (1048576); when run by root
800 "rss": maximum size of a process's (ulimit -m)
801 "rtprio": maximum real-time scheduling priority (ulimit -r)
802 "rttime": maximum amount of real-time execution between blocking
803 syscalls
804 "sigpending": maximum number of pending signals (ulimit -i)
805 "stack": maximum stack size (ulimit -s)
806 --userns how
809 Sets the configuration for user namespaces when handling RUN instruc‐
812 tions. The configured value can be "" (the empty string) or "private"
813 to indicate that a new user namespace should be created, it can be
814 "host" to indicate that the user namespace in which buildah itself is
815 being run should be reused, or it can be the path to an user namespace
816 which is already in use by another process.
817 --userns-uid-map-user user
820 Specifies that a UID mapping which should be used to set ownership, at
823 the filesystem level, on the working container's contents, can be found
824 in entries in the /etc/subuid file which correspond to the specified
825 user. Commands run when handling RUN instructions will default to
826 being run in their own user namespaces, configured using the UID and
827 GID maps. If --userns-gid-map-group is specified, but
828 --userns-uid-map-user is not specified, buildah will assume that the
829 specified group name is also a suitable user name to use as the default
830 setting for this option.
831 Users can specify the maps directly using --userns-uid-map described in
834 the buildah(1) man page.
835 --userns-gid-map-group group
838 Specifies that a GID mapping which should be used to set ownership, at
841 the filesystem level, on the working container's contents, can be found
842 in entries in the /etc/subgid file which correspond to the specified
843 group. Commands run when handling RUN instructions will default to
844 being run in their own user namespaces, configured using the UID and
845 GID maps. If --userns-uid-map-user is specified, but
846 --userns-gid-map-group is not specified, buildah will assume that the
847 specified user name is also a suitable group name to use as the default
848 setting for this option.
849 Users can specify the maps directly using --userns-gid-map described in
852 the buildah(1) man page.
853 --uts how
856 Sets the configuration for UTS namespaces when the handling RUN
859 instructions. The configured value can be "" (the empty string) or
860 "container" to indicate that a new UTS namespace should be created, or
861 it can be "host" to indicate that the UTS namespace in which buildah
862 itself is being run should be reused, or it can be the path to a UTS
863 namespace which is already in use by another process.
864 --variant=""
867 Set the architecture variant of the image to be pulled.
870 --volume, -v[=[HOST-DIR:CONTAINER-DIR[:OPTIONS]]]
873 Create a bind mount. If you specify, -v /HOST-DIR:/CONTAINER-DIR, Buil‐
876 dah
877 bind mounts /HOST-DIR in the host to /CONTAINER-DIR in the Buildah
878 container. The OPTIONS are a comma delimited list and can be: [1]
879 ⟨#Footnote1⟩
880 · [rw|ro]
883 · [U]
885 · [z|Z|O]
887 · [[r]shared|[r]slave|[r]private]
889 The CONTAINER-DIR must be an absolute path such as /src/docs. The
893 HOST-DIR must be an absolute path as well. Buildah bind-mounts the
894 HOST-DIR to the path you specify. For example, if you supply /foo as
895 the host path, Buildah copies the contents of /foo to the container
896 filesystem on the host and bind mounts that into the container.
897 You can specify multiple -v options to mount one or more mounts to a
900 container.
901 Write Protected Volume Mounts
904 You can add the :ro or :rw suffix to a volume to mount it read-only or
907 read-write mode, respectively. By default, the volumes are mounted
908 read-write. See examples.
909 Chowning Volume Mounts
912 By default, Buildah does not change the owner and group of source vol‐
915 ume directories mounted into containers. If a container is created in a
916 new user namespace, the UID and GID in the container may correspond to
917 another UID and GID on the host.
918 The :U suffix tells Buildah to use the correct host UID and GID based
921 on the UID and GID within the container, to change the owner and group
922 of the source volume.
923 Labeling Volume Mounts
926 Labeling systems like SELinux require that proper labels are placed on
929 volume content mounted into a container. Without a label, the security
930 system might prevent the processes running inside the container from
931 using the content. By default, Buildah does not change the labels set
932 by the OS.
933 To change a label in the container context, you can add either of two
936 suffixes :z or :Z to the volume mount. These suffixes tell Buildah to
937 relabel file objects on the shared volumes. The z option tells Buildah
938 that two containers share the volume content. As a result, Buildah
939 labels the content with a shared content label. Shared volume labels
940 allow all containers to read/write content. The Z option tells Buildah
941 to label the content with a private unshared label. Only the current
942 container can use a private volume.
943 Overlay Volume Mounts
946 The :O flag tells Buildah to mount the directory from the host as a
949 temporary storage using the Overlay file system. The RUN command con‐
950 tainers are allowed to modify contents within the mountpoint and are
951 stored in the container storage in a separate directory. In Overlay FS
952 terms the source directory will be the lower, and the container storage
953 directory will be the upper. Modifications to the mount point are
954 destroyed when the RUN command finishes executing, similar to a tmpfs
955 mount point.
956 Any subsequent execution of RUN commands sees the original source
959 directory content, any changes from previous RUN commands no longer
960 exists.
961 One use case of the overlay mount is sharing the package cache from the
964 host into the container to allow speeding up builds.
965 Note:
968 - The `O` flag is not allowed to be specified with the `Z` or `z` flags. Content mounted into the container is labeled with the private label.
971 On SELinux systems, labels in the source directory needs to be readable by the container label. If not, SELinux container separation must be disabled for the container to work.
972 - Modification of the directory volume mounted into the container with an overlay mount can cause unexpected failures. It is recommended that you do not modify the directory until the container finishes running.
973 By default bind mounted volumes are private. That means any mounts done
977 inside container will not be visible on the host and vice versa. This
978 behavior can be changed by specifying a volume mount propagation prop‐
979 erty.
980 When the mount propagation policy is set to shared, any mounts com‐
983 pleted inside the container on that volume will be visible to both the
984 host and container. When the mount propagation policy is set to slave,
985 one way mount propagation is enabled and any mounts completed on the
986 host for that volume will be visible only inside of the container. To
987 control the mount propagation property of the volume use the
988 :[r]shared, :[r]slave or :[r]private propagation flag. The propagation
989 property can be specified only for bind mounted volumes and not for
990 internal volumes or named volumes. For mount propagation to work on the
991 source mount point (the mount point where source dir is mounted on) it
992 has to have the right propagation properties. For shared volumes, the
993 source mount point has to be shared. And for slave volumes, the source
994 mount has to be either shared or slave. [1] ⟨#Footnote1⟩
995 Use df <source-dir> to determine the source mount and then use findmnt
998 -o TARGET,PROPAGATION <source-mount-dir> to determine propagation prop‐
999 erties of source mount, if findmnt utility is not available, the source
1000 mount point can be determined by looking at the mount entry in
1001 /proc/self/mountinfo. Look at optional fields and see if any propaga‐
1002 tion properties are specified. shared:X means the mount is shared,
1003 master:X means the mount is slave and if nothing is there that means
1004 the mount is private. [1] ⟨#Footnote1⟩
1005 To change propagation properties of a mount point use the mount com‐
1008 mand. For example, to bind mount the source directory /foo do mount
1009 --bind /foo /foo and mount --make-private --make-shared /foo. This will
1010 convert /foo into a shared mount point. The propagation properties of
1011 the source mount can be changed directly. For instance if / is the
1012 source mount for /foo, then use mount --make-shared / to convert / into
1013 a shared mount.
1014
1017 The ENV instruction in a Containerfile can be used to define variable
1018 values. When the image is built, the values will persist in the con‐
1019 tainer image. At times it is more convenient to change the values in
1020 the Containerfile via a command-line option rather than changing the
1021 values within the Containerfile itself.
1022 The following variables can be used in conjunction with the --build-arg
1025 option to override the corresponding values set in the Containerfile
1026 using the ENV instruction.
1027 · HTTP_PROXY
1030 · HTTPS_PROXY
1032 · FTP_PROXY
1034 · NO_PROXY
1036 Please refer to the Using Build Time Variables ⟨#using-build-time-vari‐
1040 ables⟩ section of the Examples.
1041
1044 Build an image using local Containerfiles
1045 buildah bud .
1046 buildah bud -f Containerfile .
1049 cat ~/Dockerfile | buildah bud -f - .
1052 buildah bud -f Dockerfile.simple -f Dockerfile.notsosimple .
1055 buildah bud --timestamp=$(date '+%s') -t imageName .
1058 buildah bud -t imageName .
1061 buildah bud --tls-verify=true -t imageName -f Dockerfile.simple .
1064 buildah bud --tls-verify=false -t imageName .
1067 buildah bud --runtime-flag log-format=json .
1070 buildah bud -f Containerfile --runtime-flag debug .
1073 buildah bud --authfile /tmp/auths/myauths.json --cert-dir ~/auth
1076 --tls-verify=true --creds=username:password -t imageName -f Docker‐
1077 file.simple .
1078 buildah bud --memory 40m --cpu-period 10000 --cpu-quota 50000 --ulimit
1081 nofile=1024:1028 -t imageName .
1082 buildah bud --security-opt label=level:s0:c100,c200 --cgroup-parent
1085 /path/to/cgroup/parent -t imageName .
1086 buildah bud --arch=arm --variant v7 -t imageName .
1089 buildah bud --volume /home/test:/myvol:ro,Z -t imageName .
1092 buildah bud -v /home/test:/myvol:z,U -t imageName .
1095 buildah bud -v /var/lib/dnf:/var/lib/dnf:O -t imageName .
1098 buildah bud --layers -t imageName .
1101 buildah bud --no-cache -t imageName .
1104 buildah bud -f Containerfile --layers --force-rm -t imageName .
1107 buildah bud --no-cache --rm=false -t imageName .
1110 buildah bud --dns-search=example.com --dns=223.5.5.5
1113 --dns-option=use-vc .
1114 Building an multi-architecture image using a --manifest option (Requires
1117 emulation software)
1118 buildah bud --arch arm --manifest myimage /tmp/mysrc buildah bud --arch
1119 amd64 --manifest myimage /tmp/mysrc buildah bud --arch s390x --manifest
1120 myimage /tmp/mysrc
1121 Building an image using a URL
1124 This will clone the specified GitHub repository from the URL and use it
1125 as context. The Containerfile or Dockerfile at the root of the reposi‐
1126 tory is used as the context of the build. This only works if the GitHub
1127 repository is a dedicated repository.
1128 buildah bud github.com/scollier/purpletest
1131 Note: You can set an arbitrary Git repository via the git:// scheme.
1134 Building an image using a URL to a tarball'ed context
1137 Buildah will fetch the tarball archive, decompress it and use its con‐
1138 tents as the build context. The Containerfile or Dockerfile at the
1139 root of the archive and the rest of the archive will get used as the
1140 context of the build. If you pass an -f PATH/Containerfile option as
1141 well, the system will look for that file inside the contents of the
1142 tarball.
1143 buildah bud -f dev/Containerfile https://10.10.10.1/docker/con‐
1146 text.tar.gz
1147 Note: supported compression formats are 'xz', 'bzip2', 'gzip' and
1150 'identity' (no compression).
1151 Using Build Time Variables
1154 Replace the value set for the HTTP_PROXY environment variable within the
1155 Containerfile.
1156 buildah bud --build-arg=HTTP_PROXY="http://127.0.0.1:8321"
1157
1160 BUILD_REGISTRY_SOURCES
1161 BUILD_REGISTRY_SOURCES, if set, is treated as a JSON object which con‐
1164 tains lists of registry names under the keys insecureRegistries,
1165 blockedRegistries, and allowedRegistries.
1166 When pulling an image from a registry, if the name of the registry
1169 matches any of the items in the blockedRegistries list, the image pull
1170 attempt is denied. If there are registries in the allowedRegistries
1171 list, and the registry's name is not in the list, the pull attempt is
1172 denied.
1173 TMPDIR The TMPDIR environment variable allows the user to specify where
1176 temporary files are stored while pulling and pushing images. Defaults
1177 to '/var/tmp'.
1178
1181 .dockerignore
1182 If the file .dockerignore exists in the context directory, buildah copy
1183 reads its contents. Use --ignorefile flag to override .dockerignore
1184 path location. Buildah uses the content to exclude files and directo‐
1185 ries from the context directory, when executing COPY and ADD directives
1186 in the Containerfile/Dockerfile
1187 Users can specify a series of Unix shell globals in a .dockerignore
1190 file to identify files/directories to exclude.
1191 Buildah supports a special wildcard string ** which matches any number
1194 of directories (including zero). For example, */.go will exclude all
1195 files that end with .go that are found in all directories.
1196 Example .dockerignore file:
1199 # exclude this content for image
1202 */*.c
1203 **/output*
1204 src
1205 */*.c Excludes files and directories whose names ends with .c in any
1209 top level subdirectory. For example, the source file include/root‐
1210 less.c.
1211 **/output* Excludes files and directories starting with output from any
1214 directory.
1215 src Excludes files named src and the directory src as well as any con‐
1218 tent in it.
1219 Lines starting with ! (exclamation mark) can be used to make exceptions
1222 to exclusions. The following is an example .dockerignore file that uses
1223 this mechanism:
1224 *.doc
1227 !Help.doc
1228 Exclude all doc files except Help.doc from the image.
1232 This functionality is compatible with the handling of .dockerignore
1235 files described here:
1236 https://docs.docker.com/engine/reference/builder/#dockerignore-file
1239 registries.conf (/etc/containers/registries.conf)
1242 registries.conf is the configuration file which specifies which con‐
1245 tainer registries should be consulted when completing image names which
1246 do not include a registry or domain portion.
1247 policy.json (/etc/containers/policy.json)
1250 Signature policy file. This defines the trust policy for container
1253 images. Controls which container registries can be used for image, and
1254 whether or not the tool should trust the images.
1255
1258 buildah(1), CPP(1), buildah-login(1), docker-login(1), namespaces(7),
1259 pid_namespaces(7), containers-policy.json(5), containers-reg‐
1260 istries.conf(5), user_namespaces(7), crun(1), runc(8)
1261
1264 1: The Buildah project is committed to inclusivity, a core value of
1265 open source. The master and slave mount propagation terminology used
1266 here is problematic and divisive, and should be changed. However, these
1267 terms are currently used within the Linux kernel and must be used as-is
1268 at this time. When the kernel maintainers rectify this usage, Buildah
1269 will follow suit immediately.
1270buildah April 2017 buildah-bud(1)