1buildah-bud(1) General Commands Manual buildah-bud(1)
2
6 buildah-bud - Build an image using instructions from Containerfiles
7
10 buildah build-using-dockerfile [options] [context]
11 buildah bud [options] [context]
14 bud is an alias for build-using-dockerfile.
17
20 Builds an image using instructions from one or more Containerfiles or
21 Dockerfiles and a specified build context directory. A Containerfile
22 uses the same syntax as a Dockerfile internally. For this document, a
23 file referred to as a Containerfile can be a file named either 'Con‐
24 tainerfile' or 'Dockerfile'.
25 The build context directory can be specified as the http(s) URL of an
28 archive, git repository or Containerfile.
29 If no context directory is specified, then Buildah will assume the cur‐
32 rent working directory as build context, which should contain a Con‐
33 tainerfile.
34 Containerfiles ending with a ".in" suffix will be preprocessed via
37 CPP(1). This can be useful to decompose Containerfiles into several
38 reusable parts that can be used via CPP's #include directive. Notice,
39 a Containerfile.in file can still be used by other tools when manually
40 preprocessing them via cpp -E.
41 When the URL is an archive, the contents of the URL is downloaded to a
44 temporary location and extracted before execution.
45 When the URL is a Containerfile, the file is downloaded to a temporary
48 location.
49 When a Git repository is set as the URL, the repository is cloned
52 locally and then set as the context.
53
56 --add-host=[]
57 Add a custom host-to-IP mapping (host:ip)
60 Add a line to /etc/hosts. The format is hostname:ip. The --add-host
63 option can be set multiple times.
64 --annotation annotation
67 Add an image annotation (e.g. annotation=value) to the image metadata.
70 Can be used multiple times.
71 Note: this information is not present in Docker image formats, so it is
74 discarded when writing images in Docker formats.
75 --authfile path
78 Path of the authentication file. Default is ${XDG_RUNTIME_DIR}/contain‐
81 ers/auth.json, which is set using buildah login. If the authorization
82 state is not found there, $HOME/.docker/config.json is checked, which
83 is set using docker login.
84 --build-arg arg=value
87 Specifies a build argument and its value, which will be interpolated in
90 instructions read from the Containerfiles in the same way that environ‐
91 ment variables are, but which will not be added to environment variable
92 list in the resulting image's configuration.
93 --cache-from
96 Images to utilise as potential cache sources. Buildah does not cur‐
99 rently support caching so this is a NOOP.
100 --cap-add=CAP_xxx
103 When executing RUN instructions, run the command specified in the
106 instruction with the specified capability added to its capability set.
107 Certain capabilities are granted by default; this option can be used to
108 add more.
109 --cap-drop=CAP_xxx
112 When executing RUN instructions, run the command specified in the
115 instruction with the specified capability removed from its capability
116 set. The CAP_AUDIT_WRITE, CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FOWNER,
117 CAP_FSETID, CAP_KILL, CAP_MKNOD, CAP_NET_BIND_SERVICE, CAP_SETFCAP,
118 CAP_SETGID, CAP_SETPCAP, CAP_SETUID, and CAP_SYS_CHROOT capabilities
119 are granted by default; this option can be used to remove them.
120 If a capability is specified to both the --cap-add and --cap-drop
123 options, it will be dropped, regardless of the order in which the
124 options were given.
125 --cert-dir path
128 Use certificates at path (*.crt, *.cert, *.key) to connect to the reg‐
131 istry. Default certificates directory is /etc/containers/certs.d.
132 --cgroup-parent=""
135 Path to cgroups under which the cgroup for the container will be cre‐
138 ated. If the path is not absolute, the path is considered to be rela‐
139 tive to the cgroups path of the init process. Cgroups will be created
140 if they do not already exist.
141 --compress
144 This option is added to be aligned with other containers CLIs. Buildah
147 doesn't send a copy of the context directory to a daemon or a remote
148 server. Thus, compressing the data before sending it is irrelevant to
149 Buildah.
150 --cni-config-dir=directory
153 Location of CNI configuration files which will dictate which plugins
156 will be used to configure network interfaces and routing for containers
157 created for handling RUN instructions, if those containers will be run
158 in their own network namespaces, and networking is not disabled.
159 --cni-plugin-path=directory[:directory[:directory[...]]]
162 List of directories in which the CNI plugins which will be used for
165 configuring network namespaces can be found.
166 --cpu-period=0
169 Limit the CPU CFS (Completely Fair Scheduler) period
172 Limit the container's CPU usage. This flag tell the kernel to restrict
175 the container's CPU usage to the period you specify.
176 --cpu-quota=0
179 Limit the CPU CFS (Completely Fair Scheduler) quota
182 Limit the container's CPU usage. By default, containers run with the
185 full CPU resource. This flag tell the kernel to restrict the con‐
186 tainer's CPU usage to the quota you specify.
187 --cpu-shares, -c=0
190 CPU shares (relative weight)
193 By default, all containers get the same proportion of CPU cycles. This
196 proportion can be modified by changing the container's CPU share
197 weighting relative to the weighting of all other running containers.
198 To modify the proportion from the default of 1024, use the --cpu-shares
201 flag to set the weighting to 2 or higher.
202 The proportion will only apply when CPU-intensive processes are run‐
205 ning. When tasks in one container are idle, other containers can use
206 the left-over CPU time. The actual amount of CPU time will vary depend‐
207 ing on the number of containers running on the system.
208 For example, consider three containers, one has a cpu-share of 1024 and
211 two others have a cpu-share setting of 512. When processes in all three
212 containers attempt to use 100% of CPU, the first container would
213 receive 50% of the total CPU time. If you add a fourth container with a
214 cpu-share of 1024, the first container only gets 33% of the CPU. The
215 remaining containers receive 16.5%, 16.5% and 33% of the CPU.
216 On a multi-core system, the shares of CPU time are distributed over all
219 CPU cores. Even if a container is limited to less than 100% of CPU
220 time, it can use 100% of each individual CPU core.
221 For example, consider a system with more than three cores. If you start
224 one container {C0} with -c=512 running one process, and another con‐
225 tainer {C1} with -c=1024 running two processes, this can result in the
226 following division of CPU shares:
227 PID container CPU CPU share
230 100 {C0} 0 100% of CPU0
231 101 {C1} 1 100% of CPU1
232 102 {C1} 2 100% of CPU2
233 --cpuset-cpus=""
237 CPUs in which to allow execution (0-3, 0,1)
240 --cpuset-mems=""
243 Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effec‐
246 tive on NUMA systems.
247 If you have four memory nodes on your system (0-3), use
250 --cpuset-mems=0,1 then processes in your container will only use memory
251 from the first two memory nodes.
252 --creds creds
255 The [username[:password]] to use to authenticate with the registry if
258 required. If one or both values are not supplied, a command line
259 prompt will appear and the value can be entered. The password is
260 entered without echo.
261 --device=device
264 Add a host device or devices under a directory to the container. The
267 format is <device-on-host>[:<device-on-container>][:<permissions>]
268 (e.g. --device=/dev/sdc:/dev/xvdc:rwm)
269 --disable-compression, -D Don't compress filesystem layers when build‐
272 ing the image unless it is required by the location where the image is
273 being written. This is the default setting, because image layers are
274 compressed automatically when they are pushed to registries, and images
275 being written to local storage would only need to be decompressed again
276 to be stored. Compression can be forced in all cases by specifying
277 --disable-compression=false.
278 --disable-content-trust
281 This is a Docker specific option to disable image verification to a
284 Docker registry and is not supported by Buildah. This flag is a NOOP
285 and provided solely for scripting compatibility.
286 --dns=[]
289 Set custom DNS servers
292 This option can be used to override the DNS configuration passed to the
295 container. Typically this is necessary when the host DNS configuration
296 is invalid for the container (e.g., 127.0.0.1). When this is the case
297 the --dns flag is necessary for every run.
298 The special value none can be specified to disable creation of
301 /etc/resolv.conf in the container by Buildah. The /etc/resolv.conf file
302 in the image will be used without changes.
303 --dns-option=[]
306 Set custom DNS options
309 --dns-search=[]
312 Set custom DNS search domains
315 --file, -f Containerfile
318 Specifies a Containerfile which contains instructions for building the
321 image, either a local file or an http or https URL. If more than one
322 Containerfile is specified, FROM instructions will only be accepted
323 from the first specified file.
324 If a local file is specified as the Containerfile and it does not
327 exist, the context directory will be prepended to the local file value.
328 If you specify -f -, the Containerfile contents will be read from
331 stdin.
332 --force-rm bool-value
335 Always remove intermediate containers after a build, even if the build
338 fails (default false).
339 --format
342 Control the format for the built image's manifest and configuration
345 data. Recognized formats include oci (OCI image-spec v1.0, the
346 default) and docker (version 2, using schema format 2 for the mani‐
347 fest).
348 Note: You can also override the default format by setting the BUIL‐
351 DAH_FORMAT environment variable. export BUILDAH_FORMAT=docker
352 --http-proxy
355 By default proxy environment variables are passed into the container if
358 set for the buildah process. This can be disabled by setting the
359 --http-proxy option to false. The environment variables passed in
360 include http_proxy, https_proxy, ftp_proxy, no_proxy, and also the
361 upper case versions of those.
362 Defaults to true
365 --iidfile ImageIDfile
368 Write the image ID to the file.
371 --ipc how
374 Sets the configuration for IPC namespaces when handling RUN instruc‐
377 tions. The configured value can be "" (the empty string) or "con‐
378 tainer" to indicate that a new IPC namespace should be created, or it
379 can be "host" to indicate that the IPC namespace in which buildah
380 itself is being run should be reused, or it can be the path to an IPC
381 namespace which is already in use by another process.
382 --isolation type
385 Controls what type of isolation is used for running processes as part
388 of RUN instructions. Recognized types include oci (OCI-compatible run‐
389 time, the default), rootless (OCI-compatible runtime invoked using a
390 modified configuration, with --no-new-keyring added to its create invo‐
391 cation, with network and UTS namespaces disabled, and IPC, PID, and
392 user namespaces enabled; the default for unprivileged users), and
393 chroot (an internal wrapper that leans more toward chroot(1) than con‐
394 tainer technology).
395 Note: You can also override the default isolation type by setting the
398 BUILDAH_ISOLATION environment variable. export BUILDAH_ISOLATION=oci
399 --label label
402 Add an image label (e.g. label=value) to the image metadata. Can be
405 used multiple times.
406 --loglevel number
409 Adjust the logging level up or down. Valid option values range from -2
412 to 3, with 3 being roughly equivalent to using the global
413 --log-level=debug option, and values below 0 omitting even error mes‐
414 sages which accompany fatal errors.
415 --layers bool-value
418 Cache intermediate images during the build process (Default is false).
421 Note: You can also override the default value of layers by setting the
424 BUILDAH_LAYERS environment variable. export BUILDAH_LAYERS=true
425 --logfile filename
428 Log output which would be sent to standard output and standard error to
431 the specified file instead of to standard output and standard error.
432 --memory, -m=""
435 Memory limit (format: [], where unit = b, k, m or g)
438 Allows you to constrain the memory available to a container. If the
441 host supports swap memory, then the -m memory setting can be larger
442 than physical RAM. If a limit of 0 is specified (not using -m), the
443 container's memory is not limited. The actual limit may be rounded up
444 to a multiple of the operating system's page size (the value would be
445 very large, that's millions of trillions).
446 --memory-swap="LIMIT"
449 A limit value equal to memory plus swap. Must be used with the -m
452 (--memory) flag. The swap LIMIT should always be larger than -m (--mem‐
453 ory) value. By default, the swap LIMIT will be set to double the value
454 of --memory.
455 The format of LIMIT is <number>[<unit>]. Unit can be b (bytes), k
458 (kilobytes), m (megabytes), or g (gigabytes). If you don't specify a
459 unit, b is used. Set LIMIT to -1 to enable unlimited swap.
460 --net how --network how
463 Sets the configuration for network namespaces when handling RUN
466 instructions. The configured value can be "" (the empty string) or
467 "container" to indicate that a new network namespace should be created,
468 or it can be "host" to indicate that the network namespace in which
469 buildah itself is being run should be reused, or it can be the path to
470 a network namespace which is already in use by another process.
471 --no-cache
474 Do not use existing cached images for the container build. Build from
477 the start with a new set of cached layers.
478 --pid how
481 Sets the configuration for PID namespaces when handling RUN instruc‐
484 tions. The configured value can be "" (the empty string) or "con‐
485 tainer" to indicate that a new PID namespace should be created, or it
486 can be "host" to indicate that the PID namespace in which buildah
487 itself is being run should be reused, or it can be the path to a PID
488 namespace which is already in use by another process.
489 --platform="Linux"
492 This option has no effect on the build. Other container engines use
495 this option to control the execution platform for the build (e.g., Win‐
496 dows, Linux) which is not required for Buildah as it supports only
497 Linux.
498 --pull
501 When the flag is enabled, attempt to pull the latest image from the
504 registries listed in registries.conf if a local image does not exist or
505 the image is newer than the one in storage. Raise an error if the image
506 is not in any listed registry and is not present locally.
507 If the flag is disabled (with --pull=false), do not pull the image from
510 the registry, unless there is no local image. Raise an error if the
511 image is not in any registry and is not present locally.
512 Defaults to true.
515 --pull-always
518 Pull the image from the first registry it is found in as listed in reg‐
521 istries.conf. Raise an error if not found in the registries, even if
522 the image is present locally.
523 --pull-never
526 Do not pull the image from the registry, use only the local version.
529 Raise an error if the image is not present locally.
530 --quiet, -q
533 Suppress output messages which indicate which instruction is being pro‐
536 cessed, and of progress when pulling images from a registry, and when
537 writing the output image.
538 --rm bool-value
541 Remove intermediate containers after a successful build (default true).
544 --runtime path
547 The path to an alternate OCI-compatible runtime, which will be used to
550 run commands specified by the RUN instruction. Default is runc, or crun
551 when machine is configured to use cgroups V2.
552 Note: You can also override the default runtime by setting the BUIL‐
555 DAH_RUNTIME environment variable. export BUILDAH_RUNTIME=/usr/bin/crun
556 --runtime-flag flag
559 Adds global flags for the container rutime. To list the supported
562 flags, please consult the manpages of the selected container runtime.
563 Note: Do not pass the leading -- to the flag. To pass the runc flag
566 --log-format json to buildah bud, the option given would be --run‐
567 time-flag log-format=json.
568 --security-opt=[]
571 Security Options
574 "label=user:USER" : Set the label user for the container
577 "label=role:ROLE" : Set the label role for the container
578 "label=type:TYPE" : Set the label type for the container
579 "label=level:LEVEL" : Set the label level for the container
580 "label=disable" : Turn off label confinement for the container
581 "no-new-privileges" : Not supported
582 "seccomp=unconfined" : Turn off seccomp confinement for the container
585 "seccomp=profile.json : White listed syscalls seccomp Json file to
586 be used as a seccomp filter
587 "apparmor=unconfined" : Turn off apparmor confinement for the container
590 "apparmor=your-profile" : Set the apparmor confinement profile for
591 the container
592 --shm-size=""
595 Size of /dev/shm. The format is <number><unit>. number must be greater
598 than 0. Unit is optional and can be b (bytes), k (kilobytes),
599 m(megabytes), or g (gigabytes). If you omit the unit, the system uses
600 bytes. If you omit the size entirely, the system uses 64m.
601 --squash
604 Squash all of the new image's layers (including those inherited from a
607 base image) into a single new layer.
608 --tag, -t imageName
611 Specifies the name which will be assigned to the resulting image if the
614 build process completes successfully. If imageName does not include a
615 registry name, the registry name localhost will be prepended to the
616 image name.
617 --target stageName
620 Set the target build stage to build. When building a Containerfile
623 with multiple build stages, --target can be used to specify an interme‐
624 diate build stage by name as the final stage for the resulting image.
625 Commands after the target stage will be skipped.
626 --tls-verify bool-value
629 Require HTTPS and verify certificates when talking to container reg‐
632 istries (defaults to true).
633 --ulimit type=soft-limit[:hard-limit]
636 Specifies resource limits to apply to processes launched when process‐
639 ing RUN instructions. This option can be specified multiple times.
640 Recognized resource types include:
641 "core": maximum core dump size (ulimit -c)
642 "cpu": maximum CPU time (ulimit -t)
643 "data": maximum size of a process's data segment (ulimit -d)
644 "fsize": maximum size of new files (ulimit -f)
645 "locks": maximum number of file locks (ulimit -x)
646 "memlock": maximum amount of locked memory (ulimit -l)
647 "msgqueue": maximum amount of data in message queues (ulimit -q)
648 "nice": niceness adjustment (nice -n, ulimit -e)
649 "nofile": maximum number of open files (ulimit -n)
650 "nofile": maximum number of open files (1048576); when run by root
651 "nproc": maximum number of processes (ulimit -u)
652 "nproc": maximum number of processes (1048576); when run by root
653 "rss": maximum size of a process's (ulimit -m)
654 "rtprio": maximum real-time scheduling priority (ulimit -r)
655 "rttime": maximum amount of real-time execution between blocking
656 syscalls
657 "sigpending": maximum number of pending signals (ulimit -i)
658 "stack": maximum stack size (ulimit -s)
659 --userns how
662 Sets the configuration for user namespaces when handling RUN instruc‐
665 tions. The configured value can be "" (the empty string) or "con‐
666 tainer" to indicate that a new user namespace should be created, it can
667 be "host" to indicate that the user namespace in which buildah itself
668 is being run should be reused, or it can be the path to an user names‐
669 pace which is already in use by another process.
670 --userns-uid-map mapping
673 Directly specifies a UID mapping which should be used to set ownership,
676 at the filesystem level, on the working container's contents. Commands
677 run when handling RUN instructions will default to being run in their
678 own user namespaces, configured using the UID and GID maps.
679 Entries in this map take the form of one or more triples of a starting
682 in-container UID, a corresponding starting host-level UID, and the num‐
683 ber of consecutive IDs which the map entry represents.
684 This option overrides the remap-uids setting in the options section of
687 /etc/containers/storage.conf.
688 If this option is not specified, but a global --userns-uid-map setting
691 is supplied, settings from the global option will be used.
692 If none of --userns-uid-map-user, --userns-gid-map-group, or
695 --userns-uid-map are specified, but --userns-gid-map is specified, the
696 UID map will be set to use the same numeric values as the GID map.
697 --userns-gid-map mapping
700 Directly specifies a GID mapping which should be used to set ownership,
703 at the filesystem level, on the working container's contents. Commands
704 run when handling RUN instructions will default to being run in their
705 own user namespaces, configured using the UID and GID maps.
706 Entries in this map take the form of one or more triples of a starting
709 in-container GID, a corresponding starting host-level GID, and the num‐
710 ber of consecutive IDs which the map entry represents.
711 This option overrides the remap-gids setting in the options section of
714 /etc/containers/storage.conf.
715 If this option is not specified, but a global --userns-gid-map setting
718 is supplied, settings from the global option will be used.
719 If none of --userns-uid-map-user, --userns-gid-map-group, or
722 --userns-gid-map are specified, but --userns-uid-map is specified, the
723 GID map will be set to use the same numeric values as the UID map.
724 --userns-uid-map-user user
727 Specifies that a UID mapping which should be used to set ownership, at
730 the filesystem level, on the working container's contents, can be found
731 in entries in the /etc/subuid file which correspond to the specified
732 user. Commands run when handling RUN instructions will default to
733 being run in their own user namespaces, configured using the UID and
734 GID maps. If --userns-gid-map-group is specified, but
735 --userns-uid-map-user is not specified, buildah will assume that the
736 specified group name is also a suitable user name to use as the default
737 setting for this option.
738 --userns-gid-map-group group
741 Specifies that a GID mapping which should be used to set ownership, at
744 the filesystem level, on the working container's contents, can be found
745 in entries in the /etc/subgid file which correspond to the specified
746 group. Commands run when handling RUN instructions will default to
747 being run in their own user namespaces, configured using the UID and
748 GID maps. If --userns-uid-map-user is specified, but
749 --userns-gid-map-group is not specified, buildah will assume that the
750 specified user name is also a suitable group name to use as the default
751 setting for this option.
752 --uts how
755 Sets the configuration for UTS namespaces when the handling RUN
758 instructions. The configured value can be "" (the empty string) or
759 "container" to indicate that a new UTS namespace should be created, or
760 it can be "host" to indicate that the UTS namespace in which buildah
761 itself is being run should be reused, or it can be the path to a UTS
762 namespace which is already in use by another process.
763 --volume, -v[=[HOST-DIR:CONTAINER-DIR[:OPTIONS]]]
766 Create a bind mount. If you specify, -v /HOST-DIR:/CONTAINER-DIR, Buil‐
769 dah
770 bind mounts /HOST-DIR in the host to /CONTAINER-DIR in the Buildah
771 container. The OPTIONS are a comma delimited list and can be:
772 · [rw|ro]
775 · [z|Z|O]
777 · [[r]shared|[r]slave|[r]private]
779 The CONTAINER-DIR must be an absolute path such as /src/docs. The
783 HOST-DIR must be an absolute path as well. Buildah bind-mounts the
784 HOST-DIR to the path you specify. For example, if you supply /foo as
785 the host path, Buildah copies the contents of /foo to the container
786 filesystem on the host and bind mounts that into the container.
787 You can specify multiple -v options to mount one or more mounts to a
790 container.
791 You can add the :ro or :rw suffix to a volume to mount it read-only or
794 read-write mode, respectively. By default, the volumes are mounted
795 read-write. See examples.
796 Labeling Volume Mounts
799 Labeling systems like SELinux require that proper labels are placed on
802 volume content mounted into a container. Without a label, the security
803 system might prevent the processes running inside the container from
804 using the content. By default, Buildah does not change the labels set
805 by the OS.
806 To change a label in the container context, you can add either of two
809 suffixes :z or :Z to the volume mount. These suffixes tell Buildah to
810 relabel file objects on the shared volumes. The z option tells Buildah
811 that two containers share the volume content. As a result, Buildah
812 labels the content with a shared content label. Shared volume labels
813 allow all containers to read/write content. The Z option tells Buildah
814 to label the content with a private unshared label. Only the current
815 container can use a private volume.
816 Overlay Volume Mounts
819 The :O flag tells Buildah to mount the directory from the host as a
822 temporary storage using the Overlay file system. The RUN command con‐
823 tainers are allowed to modify contents within the mountpoint and are
824 stored in the container storage in a separate directory. In Ovelay FS
825 terms the source directory will be the lower, and the container storage
826 directory will be the upper. Modifications to the mount point are
827 destroyed when the RUN command finishes executing, similar to a tmpfs
828 mount point.
829 Any subsequent execution of RUN commands sees the original source
832 directory content, any changes from previous RUN commands no longer
833 exists.
834 One use case of the overlay mount is sharing the package cache from the
837 host into the container to allow speeding up builds.
838 Note:
841 - Overlay mounts are not currently supported in rootless mode.
844 - The `O` flag is not allowed to be specified with the `Z` or `z` flags. Content mounted into the container is labeled with the private label.
845 On SELinux systems, labels in the source directory needs to be readable by the container label. If not, SELinux container separation must be disabled for the container to work.
846 - Modification of the directory volume mounted into the container with an overlay mount can cause unexpected failures. It is recommended that you do not modify the directory until the container finishes running.
847 By default bind mounted volumes are private. That means any mounts done
851 inside container will not be visible on the host and vice versa. This
852 behavior can be changed by specifying a volume mount propagation prop‐
853 erty.
854 When the mount propagation policy is set to shared, any mounts com‐
857 pleted inside the container on that volume will be visible to both the
858 host and container. When the mount propagation policy is set to slave,
859 one way mount propagation is enabled and any mounts completed on the
860 host for that volume will be visible only inside of the container. To
861 control the mount propagation property of the volume use the
862 :[r]shared, :[r]slave or :[r]private propagation flag. The propagation
863 property can be specified only for bind mounted volumes and not for
864 internal volumes or named volumes. For mount propagation to work on the
865 source mount point (the mount point where source dir is mounted on) it
866 has to have the right propagation properties. For shared volumes, the
867 source mount point has to be shared. And for slave volumes, the source
868 mount has to be either shared or slave.
869 Use df <source-dir> to determine the source mount and then use findmnt
872 -o TARGET,PROPAGATION <source-mount-dir> to determine propagation prop‐
873 erties of source mount, if findmnt utility is not available, the source
874 mount point can be determined by looking at the mount entry in
875 /proc/self/mountinfo. Look at optional fields and see if any propagaion
876 properties are specified. shared:X means the mount is shared, master:X
877 means the mount is slave and if nothing is there that means the mount
878 is private.
879 To change propagation properties of a mount point use the mount com‐
882 mand. For example, to bind mount the source directory /foo do mount
883 --bind /foo /foo and mount --make-private --make-shared /foo. This will
884 convert /foo into a shared mount point. The propagation properties of
885 the source mount can be changed directly. For instance if / is the
886 source mount for /foo, then use mount --make-shared / to convert / into
887 a shared mount.
888
891 Build an image using local Containerfiles
892 buildah bud .
893 buildah bud -f Containerfile .
896 cat /Dockerfile | buildah bud -f - .
899 buildah bud -f Dockerfile.simple -f Dockerfile.notsosimple .
902 buildah bud -t imageName .
905 buildah bud --tls-verify=true -t imageName -f Dockerfile.simple .
908 buildah bud --tls-verify=false -t imageName .
911 buildah bud --runtime-flag log-format=json .
914 buildah bud -f Containerfile --runtime-flag debug .
917 buildah bud --authfile /tmp/auths/myauths.json --cert-dir /auth
920 --tls-verify=true --creds=username:password -t imageName -f Docker‐
921 file.simple .
922 buildah bud --memory 40m --cpu-period 10000 --cpu-quota 50000 --ulimit
925 nofile=1024:1028 -t imageName .
926 buildah bud --security-opt label=level:s0:c100,c200 --cgroup-parent
929 /path/to/cgroup/parent -t imageName .
930 buildah bud --volume /home/test:/myvol:ro,Z -t imageName .
933 buildah bud -v /var/lib/dnf:/var/lib/dnf:O -t imageName .
936 buildah bud --layers -t imageName .
939 buildah bud --no-cache -t imageName .
942 buildah bud -f Containerfile --layers --force-rm -t imageName .
945 buildah bud --no-cache --rm=false -t imageName .
948 buildah bud --dns-search=example.com --dns=223.5.5.5
951 --dns-option=use-vc .
952 Building an image using a URL
955 This will clone the specified GitHub repository from the URL and use it
956 as context. The Containerfile or Dockerfile at the root of the reposi‐
957 tory is used as the context of the build. This only works if the GitHub
958 repository is a dedicated repository.
959 buildah bud github.com/scollier/purpletest
962 Note: You can set an arbitrary Git repository via the git:// scheme.
965 Building an image using a URL to a tarball'ed context
968 Buildah will fetch the tarball archive, decompress it and use its con‐
969 tents as the build context. The Containerfile or Dockerfile at the
970 root of the archive and the rest of the archive will get used as the
971 context of the build. If you pass an -f PATH/Containerfile option as
972 well, the system will look for that file inside the contents of the
973 tarball.
974 buildah bud -f dev/Containerfile https://10.10.10.1/docker/con‐
977 text.tar.gz
978 Note: supported compression formats are 'xz', 'bzip2', 'gzip' and
981 'identity' (no compression).
982
985 registries.conf (/etc/containers/registries.conf)
986 registries.conf is the configuration file which specifies which con‐
989 tainer registries should be consulted when completing image names which
990 do not include a registry or domain portion.
991 policy.json (/etc/containers/policy.json)
994 Signature policy file. This defines the trust policy for container
997 images. Controls which container registries can be used for image, and
998 whether or not the tool should trust the images.
999
1002 buildah(1), CPP(1), buildah-login(1), docker-login(1), namespaces(7),
1003 pid_namespaces(7), policy.json(5), registries.conf(5), user_names‐
1004 paces(7), crun(1), runc(8)
1005buildah April 2017 buildah-bud(1)