Run buildah inside an unprivileged CI container (Docker-in-Docker alternative) where nested user namespaces or overlay mounts are unavailable, using --isolation chroot and a fallback storage driver.

Documented steps

1. Set isolation to chroot for RUN-instruction execution: `buildah build --isolation chroot -t imageName .` or `buildah run --isolation chroot $container ...`. Per docs/buildah-build.1.md: chroot is 'an internal wrapper that leans more toward chroot(1) than container technology, reusing the host's control group, network, IPC, and PID namespaces, and creating private mount and UTS namespaces, and creating user namespaces only when they're required for ID mapping.' This avoids requiring a full OCI runtime with nested namespace support inside restricted CI containers.
2. Isolation can also be set session-wide via env var: `export BUILDAH_ISOLATION=chroot` (documented in buildah-build.1.md / buildah-run.1.md).
3. Other isolation values: `oci` (default; full OCI-compatible runtime) and `rootless` (OCI runtime invoked with --no-new-keyring, reusing host network/UTS namespaces while creating private IPC/PID/mount/user namespaces — the default for unprivileged users).
4. If the CI container's filesystem doesn't support overlay whiteouts rootless (symptom: `buildah build --storage-driver overlay .` fails with 'Error processing tar file(exit status 1): operation not permitted', docs/troubleshooting.md #6), fall back to vfs: `export STORAGE_DRIVER=vfs` or `buildah build --storage-driver vfs -t imageName .`. Alternative fix: install fuse-overlayfs and set `mount_program = "/usr/bin/fuse-overlayfs"` under [storage.options] in storage.conf.
5. Rootless prerequisite still applies inside the CI container: the account buildah runs as needs subuid/subgid ranges configured (see the Podman rootless tutorial linked from buildah's README) unless running fully privileged. Docs: https://github.com/containers/buildah/blob/main/docs/buildah-build.1.md