1

Is it possible to build a container image as a simple user account on a system which does not have docker or podman installed? In other words, is there a user-space tool/application which can build an image that could run on a different system which supports OCI containers, such as AKS, etc.

1
  • Do you build a docker from your Dockerfile in a machine without docker?
    – JRichardsz
    May 28, 2022 at 17:17

2 Answers 2

3

An image is based on the OCI image-spec which consists of filesystem layers packaged as tar files, a config json, and a manifest. All of these are referenced with a content addressable digest. If you can create these tar and json files, then you can create an image without a runtime.

There are various tools that do this for specific cases. I think most are shipped as containers and designed to run in CI pipelines, but you can probably get standalone binaries. However, I don't think any of these work with a Dockerfile, so if you need something that supports that syntax, you'll need a container runtime. There are rootless runtimes, but they typically have prerequisites that need to be performed on the host by root in advance, and there's a performance hit from using them.

3
  • 1
    As far as I know, buildah bud is able to work with dockerfiles without a full container runtime environment.
    – Turing85
    Apr 22, 2022 at 19:54
  • @Turing85 for the RUN steps, I'm pretty sure you'll need a runtime. Running it outside of a container wouldn't be very reproducible (but then they use all kinds of host resources with that tool). What you can do is have that tool be rootless, and I think RHEL has been baking in the prereqs for that, along with other newer Linux distros.
    – BMitch
    Apr 22, 2022 at 20:06
  • I did find an interesting writeup based on ideas from your answer: developers.redhat.com/blog/2019/08/14/…
    – Plazgoth
    Jun 15, 2022 at 22:25
0

Podman and Buildah are userspace tools. They don't require root access. They can also build oci and docker images,

Recognized formats include oci (OCI image-spec v1.0, the default) and docker (version 2, using schema format 2 for the manifest).

Note while Buildah can build from a dockerfile, you really shouldn't ever create dockerfiles. The normal method of operation with buildah involves creating a shell script, which provides you amongst other things a path into the off-line mount point, shell expansion, and conditionals, and the ability to run things in the container before committing (great for initialization).

Here is a quick example without dockerfile, build_image.sh

#!/bin/bash

ctr=$(buildah from alpine:3)
mnt=$(buildah mount "$ctr")

mkdir "$mnt/rootleveldir"
cp ./localfile "$mnt/rootleveldir"

buildah run -v "$PWD:$PWD" -- sh $PWD/init.sh

buildah config --entrypoint "/rootleveldir" --cmd "run.sh";

buildah commit                 \
  --author "Evan Carroll"      \
  --rm                         \
  "$ctr" "localhost:myimage";

Create the image without root with buildah unshare ./build_image.sh

Podman can commit any online container to an image, and buildah can commit any offline container to an image.

7
  • Thanks for this info. Even though they are user space tools, they require the system they run on to be set up in a specific way by an administrator. Hence a user can't build or run podman/buildah on a system which is not set up for them to work already.
    – Plazgoth
    Jun 15, 2022 at 22:20
  • @Plazgoth I'm not sure what you mean. You can use mount without unshare, and unshare puts you in a namespace that has to be created (which requires root). But the rest afaik will run just fine with builldah opensource.com/article/19/3/tips-tricks-rootless-buildah Jun 15, 2022 at 22:28
  • @Plazgoth perhaps try it, get an error, ask with that error. Jun 15, 2022 at 22:28
  • I am not sure what you are suggesting I try. To build a buildah executable from source?
    – Plazgoth
    Jun 15, 2022 at 22:54
  • @Plazgoth Sure. that's one method. Or use your package manager to download it. Then extract it from the package and put it in ~/.locall/bin and add that to your path. Jun 15, 2022 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.