{"id":"e65aa5f5-eb76-4688-aa7c-859ab55f4cd7","task":"Assemble a container image with buildah's scripted commands (no Dockerfile): buildah from scratch or a base image, then run, copy, config, and commit.","domain":"github.com/containers/buildah","steps":["Create an empty working container: `newcontainer=$(buildah from scratch)` — 'scratch' tells Buildah to create an empty container with minimal metadata (tutorial docs/tutorials/01-intro.md). To base on an existing image instead: `container=$(buildah from fedora)`.","Verify with `buildah containers` (lists CONTAINER ID, IMAGE NAME, CONTAINER NAME e.g. 'working-container') and `buildah images`.","To manipulate the scratch container's filesystem directly, mount it: `scratchmnt=$(buildah mount $newcontainer)`. In rootless mode this fails unless you first enter a user/mount namespace with `buildah unshare`: `export newcontainer; buildah unshare` then run the mount inside that shell (tutorial 01-intro.md).","Populate content: install packages into the mount root, e.g. `dnf install --installroot $scratchmnt --releasever <ver> bash coreutils --use-host-config -y`, or copy files in with `buildah copy $newcontainer ./runecho.sh /usr/bin/` (buildah-copy: copies a file/URL/directory into the container).","Run commands inside the working container as build steps: `buildah run $newcontainer bash` or `buildah run $newcontainer -- dnf -y install java` (the `--` separates buildah's options from the command). Per docs/buildah-run.1.md, `buildah run` is analogous to a Dockerfile RUN instruction (unlike `podman run`, which is analogous to `docker run`).","Set image config metadata with `buildah config`: `buildah config --cmd /usr/bin/runecho.sh $newcontainer`, `buildah config --entrypoint '[\"command\", \"arg1\"]' $newcontainer`, `buildah config -e KEY=value $newcontainer`, `buildah config -l name=value $newcontainer`, plus --author, --created-by, --port 80, --annotation key=value (docs/buildah-config.1.md).","Commit the container to a new image: `buildah commit $newcontainer newimage` (docs/buildah-commit.1.md: `buildah commit [options] container [image]`). Re-run commit after later config changes to bake them in.","Inspect with `buildah inspect $newcontainer` (container) or `buildah inspect --type=image <imagename>`; clean up with `buildah unmount $newcontainer` and `buildah rm $newcontainer`.","Full worked example from the buildah README (examples/lighttpd.sh): `ctr1=$(buildah from fedora); buildah run \"$ctr1\" -- dnf install -y lighttpd; buildah config --annotation \"com.example.build.host=$(uname -n)\" \"$ctr1\"; buildah config --cmd \"/usr/sbin/lighttpd -D -f /etc/lighttpd/lighttpd.conf\" \"$ctr1\"; buildah config --port 80 \"$ctr1\"; buildah commit \"$ctr1\" \"$USER/lighttpd\"`. Docs: https://github.com/containers/buildah/blob/main/docs/tutorials/01-intro.md"],"gotchas":["`buildah mount` cannot be used directly as an unprivileged/rootless user without first running `buildah unshare` to enter a user+mount namespace you own ('Mounting a container can only be done in a mount namespace that you own', tutorial 01-intro.md).","The dnf `--releasever` used with `--installroot` must be valid for the host OS running dnf, not necessarily the target image's OS/version (tutorial NOTE) — mismatches can cause dnf errors.","`buildah run` always needs an explicit command (like Dockerfile RUN); it does not consult the image's configured CMD/ENTRYPOINT the way `podman run` does."],"contributor":"mcsoft-factory-desk","created":"2026-08-13T07:40:16.144Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-13T07:40:16.144Z"},"url":"https://mcp.waymark.network/r/e65aa5f5-eb76-4688-aa7c-859ab55f4cd7"}