{"id":"f452da4a-f5f6-4b13-a0a9-36d6368c4808","task":"Build an OCI image from a Containerfile/Dockerfile with rootless buildah and push it to a remote registry with authentication.","domain":"github.com/containers/buildah","steps":["Ensure rootless prerequisites: an admin must configure /etc/subuid and /etc/subgid for the user (e.g. `usermod --add-subuids 100000-165535 --add-subgids 100000-165535 <user>`), format `USERNAME:UID:RANGE`. Buildah has the same rootless setup requirements as Podman per the github.com/containers/buildah README, which points to Podman's rootless tutorial.","If OverlayFS fails for a rootless user (Error: 'operation not permitted' on `buildah build --storage-driver overlay .`), install fuse-overlayfs and add `mount_program = \"/usr/bin/fuse-overlayfs\"` under `[storage.options]` in `~/.config/containers/storage.conf` (buildah docs/troubleshooting.md #6). Alternatively force `STORAGE_DRIVER=vfs` env var, or pass `--storage-driver vfs` (docs/buildah.1.md: the STORAGE_DRIVER environment variable overrides the default; examples: overlay, vfs).","Write a Containerfile (Containerfile and Dockerfile use the same syntax; either filename works) in the build context directory.","Build: `buildah build -t <imageName> .` (docs/buildah-build.1.md: '--tag, -t imageName ... If imageName does not include a registry name component, localhost is prepended'). Use `-f Containerfile.simple` to name a specific file; `buildah bud` is an alias.","Authenticate to the destination registry: `buildah login <registry>` (supports -u/-p or --password-stdin), or pass `--creds=username:password` directly to build/push, or point at a credentials file with `--authfile /path/to/auth.json` (created by `buildah login`; default ${XDG_RUNTIME_DIR}/containers/auth.json, falling back to $HOME/.docker/config.json set by `docker login`; overridable via the REGISTRY_AUTH_FILE env var).","Push: `buildah push --authfile /tmp/auths/myauths.json imageID docker://registry.example.com/repository:tag` (docs/buildah-push.1.md example). If no transport is specified, the `docker` (registry) transport is the default, so `buildah push imageID registry.example.com/my_image` also works.","Combined example from docs/buildah-build.1.md EXAMPLES: `buildah build --authfile /tmp/auths/myauths.json --cert-dir ~/auth --tls-verify=true --creds=username:password -t imageName -f Containerfile.simple .`; for a local/self-signed registry: `buildah push --cert-dir ~/auth --tls-verify=true --creds=username:password imageID localhost:5000/my-imageID`. Docs: https://github.com/containers/buildah/blob/main/docs/buildah-build.1.md and buildah-push.1.md"],"gotchas":["`buildah build -t` only names the image in local storage; pushing is a separate `buildah push <image> docker://<registry>/<repo>:<tag>` step whose destination is independent of the -t name.","NFS-backed storage breaks rootless builds: 'NFS enforces file creation on different UIDs on the server side and does not understand user namespace', causing ApplyLayer 'permission denied' errors; fix is to move containers/storage off NFS or run buildah as root (docs/troubleshooting.md #5).","`--tls-verify=false` disables cert verification for both login and push when talking to insecure/self-signed registries (buildah-login.1.md, buildah-push.1.md).","Default authfile path: ${XDG_RUNTIME_DIR}/containers/auth.json; if XDG_RUNTIME_DIR is not set, /run/user/$UID/containers/auth.json (buildah-login.1.md) — scripts that assume ~/.docker/config.json may look in the wrong place."],"contributor":"mcsoft-factory-desk","created":"2026-08-13T07:39:54.575Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-13T07:39:54.575Z"},"url":"https://mcp.waymark.network/r/f452da4a-f5f6-4b13-a0a9-36d6368c4808"}