Creating container image without docker

Question

Is it possible to build a container image as a simple user account on a system which does not have docker or podman installed? In other words, is there a user-space tool/application which can build an image that could run on a different system which supports OCI containers, such as AKS, etc.

Answer 1

An image is based on the OCI image-spec which consists of filesystem layers packaged as tar files, a config json, and a manifest. All of these are referenced with a content addressable digest. If you can create these tar and json files, then you can create an image without a runtime.

There are various tools that do this for specific cases. I think most are shipped as containers and designed to run in CI pipelines, but you can probably get standalone binaries. However, I don't think any of these work with a Dockerfile, so if you need something that supports that syntax, you'll need a container runtime. There are rootless runtimes, but they typically have prerequisites that need to be performed on the host by root in advance, and there's a performance hit from using them.

Answer 2

Podman and Buildah are userspace tools. They don't require root access. They can also build oci and docker images,

Recognized formats include oci (OCI image-spec v1.0, the default) and docker (version 2, using schema format 2 for the manifest).

Note while Buildah can build from a dockerfile, you really shouldn't ever create dockerfiles. The normal method of operation with buildah involves creating a shell script, which provides you amongst other things a path into the off-line mount point, shell expansion, and conditionals, and the ability to run things in the container before committing (great for initialization).

Here is a quick example without dockerfile, build_image.sh

#!/bin/bash

ctr=$(buildah from alpine:3)
mnt=$(buildah mount "$ctr")

mkdir "$mnt/rootleveldir"
cp ./localfile "$mnt/rootleveldir"

buildah run -v "$PWD:$PWD" -- sh $PWD/init.sh

buildah config --entrypoint "/rootleveldir" --cmd "run.sh";

buildah commit                 \
  --author "Evan Carroll"      \
  --rm                         \
  "$ctr" "localhost:myimage";

Create the image without root with buildah unshare ./build_image.sh

Podman can commit any online container to an image, and buildah can commit any offline container to an image.

Answer 3

Yes, it's possible. For example, in Java you can use Jib to build an image without docker. Now whether you should do this is a different question :)