buildah
Buildah is a daemonless command-line tool and Go library for building OCI and Docker-format container images, with or without a Dockerfile, and supporting rootless builds. It provides low-level, scriptable primitives (from, run, copy, commit) that let you assemble images step-by-step or via Containerfiles.
Embed badge
[](https://opensources.dev/resource/buildah)Apache-2.0Permissive — free to use in commercial and proprietary software, with attribution.View license →
Production readiness
4/5- Actively maintainedCommits in the last 6 months
- No known vulnerabilitiesNot yet scanned
- Clear, usable licenseApache-2.0 (permissive)
- Proven adoptionWidely used
- Has documentationDocumentation indexed
go get buildahOur analysis
A daemonless CLI and embeddable Go API for constructing OCI/Docker container images, either from Dockerfiles/Containerfiles or through scriptable per-step commands, with first-class rootless support.
When to use buildah
Use it when you need to build container images in CI/CD or restricted environments without a privileged daemon, want rootless builds, need to script image assembly with shell or other tooling instead of a Dockerfile, or want to vendor an image-building API into a Go program.
When not to
If you primarily need to run and manage long-lived containers in production, Podman or Docker is a better fit; on macOS/Windows it depends on a Linux VM, and teams deeply invested in Docker's BuildKit features (advanced caching, multi-platform orchestration) may find that ecosystem smoother.
Strengths
- Daemonless fork-exec model avoids a privileged background service
- Supports rootless image builds, valuable for secure CI
- Builds without requiring a Dockerfile, enabling flexible scripted pipelines
- Exposes a comprehensive Go API that other tools (notably Podman) vendor
- Outputs both OCI and legacy Docker image formats
Trade-offs
- Linux-centric; non-Linux platforms need a VM
- Lower-level coreutils approach has a steeper learning curve than a single docker build
- Separate storage from Podman/Docker means containers aren't visible across tools
- Focused only on building images, not running or orchestrating them
Maturity
Mature and production-used, part of the well-maintained containers/ ecosystem alongside Podman and Skopeo, with ~8.8k stars, regular releases, and adoption in Red Hat/Kubernetes-adjacent CI workflows.
Buildah - a tool that facilitates building Open Container Initiative (OCI) container images
The Buildah package provides a command line tool that can be used to
create a working container, either from scratch or using an image as a starting point
create an image, either from a working container or via the instructions in a Dockerfile
images can be built in either the OCI image format or the traditional upstream docker image format
mount a working container's root filesystem for manipulation
unmount a working container's root filesystem
use the updated contents of a container's root filesystem as a filesystem layer to create a new image
delete a working container or an image
rename a local container
Buildah Information for Developers
For blogs, release announcements and more, please checkout the buildah.io website!
Buildah and Podman relationship
Buildah and Podman are two complementary open-source projects that are available on most Linux platforms and both projects reside at GitHub.com with Buildah here and Podman here. Both, Buildah and Podman are command line tools that work on Open Container Initiative (OCI) images and containers. The two projects differentiate in their specialization.
Buildah specializes in building OCI images. Buildah's commands replicate all of the commands that are found in a Dockerfile. This allows building images with and without Dockerfiles while not requiring any root privileges. Buildah’s ultimate goal is to provide a lower-level coreutils interface to build images. The flexibility of building images without Dockerfiles allows for the integration of other scripting languages into the build process. Buildah follows a simple fork-exec model and does not run as a daemon but it is based on a comprehensive API in golang, which can be vendored into other tools.
Podman specializes in all of the commands and functions that help you to maintain and modify OCI images, such as pulling and tagging. It also allows you to create, run, and maintain those containers created from those images. For building container images via Dockerfiles, Podman uses Buildah's golang API and can be installed independently from Buildah.
A major difference between Podman and Buildah is their concept of a container. Podman
allows users to create "traditional containers" where the intent of these containers is
to be long lived. While Buildah containers are really just created to allow content
to be added back to the container image. An easy way to think of it is the
buildah run command emulates the RUN command in a Dockerfile while the podman run
command emulates the docker run command in functionality. Because of this and their underlying
storage differences, you can not see Podman containers from within Buildah or vice versa.
In short, Buildah is an efficient way to create OCI images while Podman allows you to manage and maintain those images and containers in a production environment using familiar container cli commands. For more details, see the Container Tools Guide.
Example
From ./examples/lighttpd.sh:
$ cat > lighttpd.sh <<"EOF"
#!/usr/bin/env bash
set -x
ctr1=$(buildah from "${1:-fedora}")
## Get all updates and install our minimal httpd server
buildah run "$ctr1" -- dnf update -y
buildah run "$ctr1" -- dnf install -y lighttpd
## Include some buildtime annotations
buildah config --annotation "com.example.build.host=$(uname -n)" "$ctr1"
## Run our server and expose the port
buildah config --cmd "/usr/sbin/lighttpd -D -f /etc/lighttpd/lighttpd.conf" "$ctr1"
buildah config --port 80 "$ctr1"
## Commit this container to an image name
buildah commit "$ctr1" "${2:-$USER/lighttpd}"
EOF
$ chmod +x lighttpd.sh
$ ./lighttpd.sh
Commands
CommandDescriptionbuildah-add(1)Add the contents of a file, URL, or a directory to the container.buildah-build(1)Build an image using instructions from Containerfiles or Dockerfiles.buildah-commit(1)Create an image from a working container.buildah-config(1)Update image configuration settings.buildah-containers(1)List the working containers and their base images.buildah-copy(1)Copies the contents of a file, URL, or directory into a container's working directory.buildah-from(1)Creates a new working container, either from scratch or using a specified image as a starting point.buildah-images(1)List images in local storage.buildah-info(1)Display Buildah system information.buildah-inspect(1)Inspects the configuration of a container or image.buildah-mount(1)Mount the working container's root filesystem.buildah-pull(1)Pull an image from the specified location.buildah-push(1)Push an image from local storage to elsewhere.buildah-rename(1)Rename a local container.buildah-rm(1)Removes one or more working containers.buildah-rmi(1)Removes one or more images.buildah-run(1)Run a command inside of the container.buildah-tag(1)Add an additional name to a local image.buildah-umount(1)Unmount a working container's root file system.buildah-unshare(1)Launch a command in a user namespace with modified ID mappings.buildah-version(1)Display the Buildah Version Information
Future goals include:
more CI tests
additional CLI commands (?)