1buildah-commit(1)           General Commands Manual          buildah-commit(1)
2
3
4

NAME

6       buildah-commit - Create an image from a working container.
7
8

SYNOPSIS

10       buildah commit [options] container [image]
11
12

DESCRIPTION

14       Writes a new image using the specified container's read-write layer and
15       if it is based on an image, the layers of that image.   If  image  does
16       not  begin  with  a registry name component, localhost will be added to
17       the name.  If image is not provided, the image will have no name.  When
18       an image has no name, the buildah images command will display <none> in
19       the REPOSITORY and TAG columns.
20
21

RETURN VALUE

23       The image ID of the image that was created.  On error,  1  is  returned
24       and errno is returned.
25
26

OPTIONS

28       --authfile path
29
30
31       Path  of  the  authentication file. Default is ${XDG_\RUNTIME_DIR}/con‐
32       tainers/auth.json. If  XDG_RUNTIME_DIR  is  not  set,  the  default  is
33       /run/containers/$UID/auth.json.  This file is created using using buil‐
34       dah login.
35
36
37       If the authorization  state  is  not  found  there,  $HOME/.docker/con‐
38       fig.json is checked, which is set using docker login.
39
40
41       Note: You can also override the default path of the authentication file
42       by setting the REGISTRY_AUTH_FILE  environment  variable.  export  REG‐
43       ISTRY_AUTH_FILE=path
44
45
46       --cert-dir path
47
48
49       Use  certificates at path (*.crt, *.cert, *.key) to connect to the reg‐
50       istry.  The default certificates directory is /etc/containers/certs.d.
51
52
53       --creds creds
54
55
56       The [username[:password]] to use to authenticate with the  registry  if
57       required.   If  one  or  both  values  are not supplied, a command line
58       prompt will appear and the value can be entered.  The password  is  en‐
59       tered without echo.
60
61
62       --disable-compression, -D
63
64
65       Don't  compress  filesystem layers when building the image unless it is
66       required by the location where the image is being written.  This is the
67       default setting, because image layers are compressed automatically when
68       they are pushed to registries, and images being written to local  stor‐
69       age would only need to be decompressed again to be stored.  Compression
70       can be forced in all cases by specifying --disable-compression=false.
71
72
73       --encryption-key key
74
75
76       The [protocol:keyfile] specifies the encryption protocol, which can  be
77       JWE  (RFC7516), PGP (RFC4880), and PKCS7 (RFC2315) and the key material
78       required for image encryption. For  instance,  jwe:/path/to/key.pem  or
79       pgp:admin@example.com or pkcs7:/path/to/x509-file.
80
81
82       --encrypt-layer layer(s)
83
84
85       Layer(s)  to encrypt: 0-indexed layer indices with support for negative
86       indexing (e.g. 0 is the first layer, -1 is the last layer). If not  de‐
87       fined, will encrypt all layers if encryption-key flag is specified.
88
89
90       --format, -f [oci | docker]
91
92
93       Control the format for the image manifest and configuration data.  Rec‐
94       ognized formats include oci (OCI  image-spec  v1.0,  the  default)  and
95       docker (version 2, using schema format 2 for the manifest).
96
97
98       Note:  You  can  also  override the default format by setting the BUIL‐
99       DAH_FORMAT environment variable.  export BUILDAH\_FORMAT=docker
100
101
102       --iidfile ImageIDfile
103
104
105       Write the image ID to the file.
106
107
108       --manifest "listName"
109
110
111       Name of the manifest list to which the built image will be added.  Cre‐
112       ates  the manifest list if it does not exist. This option is useful for
113       building multi architecture images.
114
115
116       --quiet, -q
117
118
119       When writing the output image, suppress progress output.
120
121
122       --rm Remove the working container and its contents after  creating  the
123       image.  Default leaves the container and its content in place.
124
125
126       --sign-by fingerprint
127
128
129       Sign the new image using the GPG key that matches the specified finger‐
130       print.
131
132
133       --squash
134
135
136       Squash all of the new image's layers (including those inherited from  a
137       base image) into a single new layer.
138
139
140       --timestamp seconds
141
142
143       Set  the create timestamp to seconds since epoch to allow for determin‐
144       istic builds (defaults to current time).  By default, the created time‐
145       stamp is changed and written into the image manifest with every commit,
146       causing the image's sha256 hash to be different even if the sources are
147       exactly the same otherwise.  When --timestamp is set, the created time‐
148       stamp is always set to the time specified and  therefore  not  changed,
149       allowing  the image's sha256 to remain the same. All files committed to
150       the layers of the image will be created with the timestamp.
151
152
153       --tls-verify bool-value
154
155
156       Require HTTPS and verification of certificates  when  talking  to  con‐
157       tainer  registries (defaults to true).  TLS verification cannot be used
158       when talking to an insecure registry.
159
160

EXAMPLE

162       This example saves an image based on the container.
163        buildah commit containerID newImageName
164
165
166       This example saves an image named newImageName based on the container.
167        buildah commit --rm containerID newImageName
168
169
170       This example saves an image with no  name,  removes  the  working  con‐
171       tainer, and creates a new container using the image's ID.
172        buildah from $(buildah commit --rm containerID)
173
174
175       This  example  saves an image based on the container disabling compres‐
176       sion.
177        buildah commit --disable-compression containerID
178
179
180       This example saves an image named newImageName based on  the  container
181       disabling compression.
182        buildah commit --disable-compression containerID newImageName
183
184
185       This  example  commits the container to the image on the local registry
186       while turning off tls verification.
187        buildah   commit   --tls-verify=false   containerID    docker://local‐
188       host:5000/imageId
189
190
191       This  example  commits the container to the image on the local registry
192       using credentials and certificates for authentication.
193        buildah  commit  --cert-dir  ~/auth   --tls-verify=true  --creds=user‐
194       name:password containerID docker://localhost:5000/imageId
195
196
197       This  example  commits the container to the image on the local registry
198       using credentials from the /tmp/auths/myauths.json  file  and  certifi‐
199       cates for authentication.
200        buildah  commit  --authfile  /tmp/auths/myauths.json --cert-dir ~/auth
201       --tls-verify=true --creds=username:password containerID docker://local‐
202       host:5000/imageName
203
204
205       This  example  saves  an image based on the container, but stores dates
206       based on epoch time.  buildah commit --timestamp=0 containerID  newIma‐
207       geName
208
209
210   Building  an multi-architecture image using the --manifest option (requires
211       emulation software)
212              #!/bin/sh
213              build() {
214                   ctr=$(./bin/buildah from --arch $1 ubi8)
215                   ./bin/buildah run $ctr dnf install -y iputils
216                   ./bin/buildah commit --manifest ubi8ping $ctr
217              }
218              build arm
219              build amd64
220              build s390x
221
222
223

ENVIRONMENT

225       BUILD_REGISTRY_SOURCES
226
227
228       BUILD_REGISTRY_SOURCES, if set, is treated as a JSON object which  con‐
229       tains  lists  of  registry  names  under  the  keys insecureRegistries,
230       blockedRegistries, and allowedRegistries.
231
232
233       When committing an image, if the image is to be given a name, the  por‐
234       tion  of  the  name  that  corresponds to a registry is compared to the
235       items in the blockedRegistries list, and if it matches any of them, the
236       commit  attempt  is denied.  If there are registries in the allowedReg‐
237       istries list, and the portion of the name that corresponds to the  reg‐
238       istry is not in the list, the commit attempt is denied.
239
240
241       TMPDIR The TMPDIR environment variable allows the user to specify where
242       temporary files are stored while pulling and pushing images.   Defaults
243       to '/var/tmp'.
244
245

FILES

247       registries.conf (/etc/containers/registries.conf)
248
249
250       registries.conf  is  the  configuration file which specifies which con‐
251       tainer registries should be consulted when completing image names which
252       do not include a registry or domain portion.
253
254
255       policy.json (/etc/containers/policy.json)
256
257
258       Signature policy file.  This defines the trust policy for container im‐
259       ages.  Controls which container registries can be used for  image,  and
260       whether or not the tool should trust the images.
261
262

SEE ALSO

264       buildah(1),  buildah-images(1),  containers-policy.json(5), containers-
265       registries.conf(5)
266
267
268
269buildah                           March 2017                 buildah-commit(1)
Impressum