3 ms·
Does Buildah build images in a completely unprivileged environment? There are other tools like Kaniko which have few gotchas like although they don't need docke
by tirumaraiselvan 8y ago
Does Buildah build images in a completely unprivileged environment? There are other tools like Kaniko which have few gotchas like although they don't need docker daemon but they still need ROOT access which does not make it truly secure.
- Conan_Kudo 8y agoBuildah (1.5+) and Podman (1.0+) will work in an unprivileged environment on Linux systems with Linux kernel 4.18+ or kernels with the relevant changes to userns backported (I believe the latest RHEL 7 kernels qualifies here). [To note, I don't work for Red Hat]
- Qerub 8y agoThere's some userspace tooling needed as well. E.g. Buildah can't build images as non-rooot on RHEL 7.6 yet because newuidmap/newgidmap is missing. This will get fixed any day now: https://bugzilla.redhat.com/show_bug.cgi?id=1498628 https://bugzilla.redhat.com/show_bug.cgi?id=1498628
- rhatdan 8y agoLook for a backported shadow-utils in RHEL7.7, which is scheduled for the summer. RHEL8.Beta currently supports rootless podman 1.0.
- nijave 8y agoYep, works perfectly on Fedora 29 with podman from the default repos