buildah

For the package management, it depends on the package manager, but most have some mechanism for installing into a root other than the currently running system. Even without explicit support in the pacakage manager, you could also roll your own solution by running the package manager in a chroot environment, which would then need to be seeded with the package manager's own dependencies, of course (and use user-mode qemu to run pre- and post-installation scripts within the chroot in the case of cross-architecture builds). Whether this yields a minimal container when pointed at a repository intended to be used to deploy a full OS is another question, but using a package manager to build a root filesystem offline isn't hard to pull off. As for how to do this in the context of building an OCI container, tools like Buildah[1] exist to support c

> https://github.com/containers/buildah/issues/6460 This was just fixed today :)

I’ve encountered this one: https://github.com/containers/buildah/issues/6460 Also, there’s Podman’s decision to drop CNI support. Sure, I get that they want to support the full stack, but netavark is really not especially capable, and CNI allows all kinds of interesting (and frequently overcomplicated) things.

No worries. And your reply caused me to re-remember the --network container:id podman feature, which I might actually try using. (I generally dislike podman because of stuff like this: https://github.com/containers/buildah/issues/6460#issuecomme... Podman is absolutely nicer than Docker in that it integrates better with systemd (if that’s your cup of tea) and it’s less painful to use for non-root development purposes.)

That sucks, I never had any problem running a Dockerfile in podman. I don't know what I do differently, but I would as a principle filter out any container that messes with stuff like docker in docker. Podman doesn't need these kind of shenegians. Also the Docker Compose tool is a well-know exception to the compatibility story. (There is some unofficial podman compose tool, but that is not feature complete and quadlets are better anyway.) I agree with approaching podman as its own thing though. Yes, you can build a Dockerfile, but buildah lets you build an efficient OCI image from scratch without needing root. For those interested, this document¹ explains how buildah compares to podman and docker. 1. https://github.com/containers/buildah/tree/main/docs/contain...

Haven't tested this yet, but --link support was just added: https://github.com/containers/buildah/issues/4325#issuecomme...

Yes, since 2021 they also support the same syntax natively: https://github.com/containers/buildah/pull/3133 While also supporting building Dockerfiles with buildah: https://github.com/containers/buildah/blob/main/docs/tutoria...

Dockerfile is one of the worst parts of docker — it's a primitive shell-like DSL that didn't have to exist and that feels like it was designed by a person with a couple of hours of experience in writing shell scripts. Instead of providing a set of separate tools to be glued together with a proper shell or a full programming language, they designed this nonsense that can't even do 1/10th of what busybox is able to do, and have been in the business of adding the missing pieces (like `COPY --chmod`) for the past 10+ years. It has taken them about a decade to add HEREDOC support, for example. Most dockerfiles still use RUN foo && \ bar && \ baz instead of RUN <<END set -eu foo bar baz END I avoid dockerfiles and prefer using buildah for building containers. Since they're all using the same specification, it

> I prefer to use virtual machines. They’re slower to set up, and start up a little slower too, but they’re convenient for me, and I understand them well. They also behave more like a real Linux system running on bare metal hardware than containers do. There are fewer limitations that get in my way. > This blog post is not a request for you try to explain Docker, Podman, or containers to me, or for you to tell me how I can learn more about them. I am not interested. Then I will simply tell you don't understand virtual machines well either, like you said you did. I was going to explain Podman to you, but I won't. I might not understand virtual machines well either FWIW, but I haven't claimed that I do. For anyone else reading this, Podman has a nice, clean design, that unlike Docker is free from a required daemon or something like Docker H

If $PROGRAMMING_LANGUAGE = go, you might be looking for https://github.com/containers/storage which can create layers, images, and so on. I think `Store` is the main entry: https://pkg.go.dev/github.com/containers/storage#Store Buildah uses it: https://github.com/containers/buildah/blob/main/go.mod#L27C2... Edit: buildkit seems to be the same, used by docker, but needs a daemon?

Like wayland, podman was one of those things that took a lot of "I'll give it another shot? Nope, not ready" before I could switch. Lately the only real incompatibility I run in to with podman is that the handling of `RUN --mount=type=secret` in a Containerfile/Dockerfile is a bit broken (https://github.com/containers/buildah/issues/5282).

I wish we would rather get rid of Dockerfile in favor of what something like buildah does: https://github.com/containers/buildah/blob/main/examples/lig... Since Dockerfile is a rather limited and (IMHO) poorly executed re-implementation of a shell script, why not use shell directly? Not even bash with coreutils is necessary: even posix sh with busybox can do much more than Dockerfile, and you can use something else (like Python) and take it very far indeed.

You do realize that, under the hood, buildah uses a container engine (runc by default)? See https://github.com/containers/buildah/blob/main/docs/buildah...

When I saw the title I thought it was going to be about `buildah` [1][2] Which allows you to create images using the command line to build them up step-by-step. [1] https://buildah.io/ [2] https://github.com/containers/buildah