Buildah on EKS for CI/CD with Karpenter nkdes

[avmehta768]

Hi All, we Have eks cluster running with Karpenter to provision instances based on gitlab ci/cd jobs.

We are currently using Docker in Docker to build images using ci cd and push them to gitlab container registry or ECr based on use case.

As DinD required privilege access, can we use Buildah rootless for building images and push them to gitlab/ECR.

Can someone please help with setup required like whether base buildah image will work fine or we need to customize to set uid/gid and what all other settings required at runner level to make it work.
If custom images required,please share custom docker file and also provide if any special permssion uid etc. needed at runner level to make it work.
Thanks.

[nalind]

I don't know that it can be run without any privileges at all, but the quay.io/buildah/stable image is a reasonable starting point. It does require some privileges which your execution environment might not provide, since being able to do things that look kind of like running containers generally requires more privileges than is often given to containers. Among them:

• using the unshare() syscall
• CAP_SETFCAP if started as UID 0 without CAP_SYS_ADMIN
• CAP_SETUID/CAP_SETGID if started as not UID 0
• /dev/fuse unless you build a derived image that prefers kernel-native overlay instead of fuse-overlay
  Those are the ones I know off the top of my head.

I can't spare you the trial-and-error here.