Is it possible to build a container image as a simple user account on a system which does not have docker or podman installed? In other words, is there a user-space tool/application which can build an image that could run on a different system which supports OCI containers, such as AKS, etc.
An image is based on the OCI image-spec which consists of filesystem layers packaged as tar files, a config json, and a manifest. All of these are referenced with a content addressable digest. If you can create these tar and json files, then you can create an image without a runtime.
There are various tools that do this for specific cases. I think most are shipped as containers and designed to run in CI pipelines, but you can probably get standalone binaries. However, I don't think any of these work with a Dockerfile, so if you need something that supports that syntax, you'll need a container runtime. There are rootless runtimes, but they typically have prerequisites that need to be performed on the host by root in advance, and there's a performance hit from using them.
Podman and Buildah are userspace tools. They don't require root access. They can also build
Recognized formats include oci (OCI image-spec v1.0, the default) and docker (version 2, using schema format 2 for the manifest).
Note while Buildah can build from a dockerfile, you really shouldn't ever create dockerfiles. The normal method of operation with buildah involves creating a shell script, which provides you amongst other things a path into the off-line mount point, shell expansion, and conditionals, and the ability to run things in the container before committing (great for initialization).
Here is a quick example without dockerfile,
#!/bin/bash ctr=$(buildah from alpine:3) mnt=$(buildah mount "$ctr") mkdir "$mnt/rootleveldir" cp ./localfile "$mnt/rootleveldir" buildah run -v "$PWD:$PWD" -- sh $PWD/init.sh buildah config --entrypoint "/rootleveldir" --cmd "run.sh"; buildah commit \ --author "Evan Carroll" \ --rm \ "$ctr" "localhost:myimage";
Create the image without root with
buildah unshare ./build_image.sh
Podman can commit any online container to an image, and buildah can commit any offline container to an image.