buildah-commit(1)

1buildah-commit(1)           General Commands Manual          buildah-commit(1)
2
3
4

NAME

6       buildah-commit - Create an image from a working container.
7
8

SYNOPSIS

10       buildah commit [options] container [image]
11
12

DESCRIPTION

14       Writes a new image using the specified container's read-write layer and
15       if it is based on an image, the layers of that image.   If  image  does
16       not  begin  with  a registry name component, localhost will be added to
17       the name.  If image is not provided, the image will have no name.  When
18       an image has no name, the buildah images command will display <none> in
19       the REPOSITORY and TAG columns.
20
21

RETURN VALUE

23       The image ID of the image that was created.  On error,  1  is  returned
24       and errno is returned.
25
26

OPTIONS

28       --authfile path
29
30
31       Path  of  the  authentication file. Default is ${XDG_\RUNTIME_DIR}/con‐
32       tainers/auth.json. If  XDG_RUNTIME_DIR  is  not  set,  the  default  is
33       /run/containers/$UID/auth.json.  This file is created using buildah lo‐
34       gin.
35
36
37       If the authorization  state  is  not  found  there,  $HOME/.docker/con‐
38       fig.json is checked, which is set using docker login.
39
40
41       Note: You can also override the default path of the authentication file
42       by setting the REGISTRY_AUTH_FILE  environment  variable.  export  REG‐
43       ISTRY_AUTH_FILE=path
44
45
46       --cert-dir path
47
48
49       Use  certificates at path (*.crt, *.cert, *.key) to connect to the reg‐
50       istry.  The default certificates directory is /etc/containers/certs.d.
51
52
53       --creds creds
54
55
56       The [username[:password]] to use to authenticate with the  registry  if
57       required.   If  one  or  both  values  are not supplied, a command line
58       prompt will appear and the value can be entered.  The password  is  en‐
59       tered without echo.
60
61
62       --disable-compression, -D
63
64
65       Don't  compress  filesystem layers when building the image unless it is
66       required by the location where the image is being written.  This is the
67       default setting, because image layers are compressed automatically when
68       they are pushed to registries, and images being written to local  stor‐
69       age would only need to be decompressed again to be stored.  Compression
70       can be forced in all cases by specifying --disable-compression=false.
71
72
73       --encrypt-layer layer(s)
74
75
76       Layer(s) to encrypt: 0-indexed layer indices with support for  negative
77       indexing  (e.g. 0 is the first layer, -1 is the last layer). If not de‐
78       fined, will encrypt all layers if encryption-key flag is specified.
79
80
81       --encryption-key key
82
83
84       The [protocol:keyfile] specifies the encryption protocol, which can  be
85       JWE  (RFC7516), PGP (RFC4880), and PKCS7 (RFC2315) and the key material
86       required for image encryption. For  instance,  jwe:/path/to/key.pem  or
87       pgp:admin@example.com or pkcs7:/path/to/x509-file.
88
89
90       --format, -f [oci | docker]
91
92
93       Control the format for the image manifest and configuration data.  Rec‐
94       ognized formats include oci (OCI  image-spec  v1.0,  the  default)  and
95       docker (version 2, using schema format 2 for the manifest).
96
97
98       Note:  You  can  also  override the default format by setting the BUIL‐
99       DAH_FORMAT environment variable.  export BUILDAH\_FORMAT=docker
100
101
102       --identity-label bool-value
103
104
105       Adds default identity label io.buildah.version if set. (default true).
106
107
108       --iidfile ImageIDfile
109
110
111       Write the image ID to the file.
112
113
114       --manifest "listName"
115
116
117       Name of the manifest list to which the built image will be added.  Cre‐
118       ates  the manifest list if it does not exist. This option is useful for
119       building multi architecture images.
120
121
122       --quiet, -q
123
124
125       When writing the output image, suppress progress output.
126
127
128       --rm Remove the working container and its contents after  creating  the
129       image.  Default leaves the container and its content in place.
130
131
132       --sign-by fingerprint
133
134
135       Sign the new image using the GPG key that matches the specified finger‐
136       print.
137
138
139       --squash
140
141
142       Squash all of the new image's layers (including those inherited from  a
143       base image) into a single new layer.
144
145
146       --timestamp seconds
147
148
149       Set  the create timestamp to seconds since epoch to allow for determin‐
150       istic builds (defaults to current time).  By default, the created time‐
151       stamp is changed and written into the image manifest with every commit,
152       causing the image's sha256 hash to be different even if the sources are
153       exactly the same otherwise.  When --timestamp is set, the created time‐
154       stamp is always set to the time specified and  therefore  not  changed,
155       allowing  the image's sha256 to remain the same. All files committed to
156       the layers of the image will be created with the timestamp.
157
158
159       --tls-verify bool-value
160
161
162       Require HTTPS and verification of certificates  when  talking  to  con‐
163       tainer  registries (defaults to true).  TLS verification cannot be used
164       when talking to an insecure registry.
165
166
167       --unsetenv env
168
169
170       Unset environment variables from the final image.
171
172

EXAMPLE

174       This example saves an image based on the container.
175        buildah commit containerID newImageName
176
177
178       This example saves an image named newImageName based on the container.
179        buildah commit --rm containerID newImageName
180
181
182       This example saves an image with no  name,  removes  the  working  con‐
183       tainer, and creates a new container using the image's ID.
184        buildah from $(buildah commit --rm containerID)
185
186
187       This  example  saves an image based on the container disabling compres‐
188       sion.
189        buildah commit --disable-compression containerID
190
191
192       This example saves an image named newImageName based on  the  container
193       disabling compression.
194        buildah commit --disable-compression containerID newImageName
195
196
197       This  example  commits the container to the image on the local registry
198       while turning off tls verification.
199        buildah   commit   --tls-verify=false   containerID    docker://local‐
200       host:5000/imageId
201
202
203       This  example  commits the container to the image on the local registry
204       using credentials and certificates for authentication.
205        buildah  commit  --cert-dir  ~/auth   --tls-verify=true  --creds=user‐
206       name:password containerID docker://localhost:5000/imageId
207
208
209       This  example  commits the container to the image on the local registry
210       using credentials from the /tmp/auths/myauths.json  file  and  certifi‐
211       cates for authentication.
212        buildah  commit  --authfile  /tmp/auths/myauths.json --cert-dir ~/auth
213       --tls-verify=true --creds=username:password containerID docker://local‐
214       host:5000/imageName
215
216
217       This  example  saves  an image based on the container, but stores dates
218       based on epoch time.  buildah commit --timestamp=0 containerID  newIma‐
219       geName
220
221
222   Building  an multi-architecture image using the --manifest option (requires
223       emulation software)
224              #!/bin/sh
225              build() {
226                   ctr=$(./bin/buildah from --arch $1 ubi8)
227                   ./bin/buildah run $ctr dnf install -y iputils
228                   ./bin/buildah commit --manifest ubi8ping $ctr
229              }
230              build arm
231              build amd64
232              build s390x
233
234
235

ENVIRONMENT

237       BUILD_REGISTRY_SOURCES
238
239
240       BUILD_REGISTRY_SOURCES, if set, is treated as a JSON object which  con‐
241       tains  lists  of  registry  names  under  the  keys insecureRegistries,
242       blockedRegistries, and allowedRegistries.
243
244
245       When committing an image, if the image is to be given a name, the  por‐
246       tion  of  the  name  that  corresponds to a registry is compared to the
247       items in the blockedRegistries list, and if it matches any of them, the
248       commit  attempt  is denied.  If there are registries in the allowedReg‐
249       istries list, and the portion of the name that corresponds to the  reg‐
250       istry is not in the list, the commit attempt is denied.
251
252
253       TMPDIR The TMPDIR environment variable allows the user to specify where
254       temporary files are stored while pulling and pushing images.   Defaults
255       to '/var/tmp'.
256
257

FILES

259       registries.conf (/etc/containers/registries.conf)
260
261
262       registries.conf  is  the  configuration file which specifies which con‐
263       tainer registries should be consulted when completing image names which
264       do not include a registry or domain portion.
265
266
267       policy.json (/etc/containers/policy.json)
268
269
270       Signature policy file.  This defines the trust policy for container im‐
271       ages.  Controls which container registries can be used for  image,  and
272       whether or not the tool should trust the images.
273
274