Red Hat Summit Red Hat SummitSuporteConsoleDesenvolvedoresComeçar um testeContato

Este conteúdo não está disponível no idioma selecionado.

Chapter 12. Using buildah-ns Tekton task

The buildah-ns Tekton task builds Open Container Initiative (OCI) images without requiring a container runtime daemon, such as the Docker daemon. The task uses buildah and applies user namespace isolation to provide enhanced security.

After a successful build, the task produces the following results:

  • The fully qualified image name
  • The SHA256 digest of the image

The buildah-ns task is functionally the same as the standard buildah Tekton task, but applies additional security mechanisms to improve container isolation at the kernel level.

12.1. Differences between buildah and buildah-ns tasks
Copiar o link

The buildah-ns task extends the standard buildah task with the following security-focused changes:

  • Task name: The task name is buildah-ns instead of buildah.

  • Annotations: The task includes security annotations that enable automatic user namespace mapping: 

    io.kubernetes.cri-o.userns-mode: "auto"
io.openshift.builder: "true"
  • Security model: User namespace separation improves privilege isolation. This limits the impact of container escape vulnerabilities.

12.2. Security model of the buildah-ns task
Copiar o link

The buildah-ns task uses user namespace isolation to separate privileges between containers and the host system.

When the task runs with namespace annotations, the system maps user IDs (UIDs) as follows:

  • Inside the container: Processes run as UID 0, which is displayed as the root user.
  • Outside the container: The same processes run as a nonzero UID on the host system.

This mapping lets container processes behave as root while restricting their host-level privileges.

User namespace isolation provides the following security advantages:

  • kernel-level isolation: Adds an extra isolation boundary between containers.
  • Reduced privilege exposure: Limits the impact of compromised workloads by running them as non-root users on the host.
  • Container escape protection: Helps mitigate potential vulnerabilities that allow escaping from the container runtime environment.

12.3. Workspaces, parameters, and results for the buildah-ns task
Copiar o link

The buildah-ns task requires a workspace and accepts several parameters to customize image builds. The task results contain information about the built image.

12.3.1. Workspace
Copiar o link

Expand
NameRequiredDescription

source

Yes

The build context for the container image. Typically has application source code and a Containerfile or Dockerfile.

12.3.2. Parameters
Copiar o link

Expand
NameTypeDefaultDescription

IMAGE

string

Required

Fully qualified name of the image to build, including tag.

CONTAINERFILE_PATH

string

Containerfile

Path to the container build file relative to the source workspace.

TLS_VERIFY

string

true

Verify TLS when pushing images. Red Hat recommends true.

VERBOSE

string

false

Enables verbose build output.

SUBDIRECTORY

string

.

Subdirectory in the workspace to use as the build context.

STORAGE_DRIVER

string

overlay

Storage driver for Buildah. Align with the cluster node configuration.

BUILD_EXTRA_ARGS

string

Empty

Additional flags for the Buildah build command.

PUSH_EXTRA_ARGS

string

Empty

Additional flags for the Buildah push command.

SKIP_PUSH

string

false

Set to true to skip pushing the image to the registry.

12.3.3. Results
Copiar o link

Expand
NameDescription

IMAGE_URL

Fully qualified name of the built image.

IMAGE_DIGEST

SHA256 digest of the built image.

12.4. Running the buildah-ns task
Copiar o link

You can run the buildah-ns task as part of a PipelineRun resource.

Procedure

  1. Create a YAML file that defines PipelineRun object:

    Example pipeline-run.yaml file

    apiVersion: tekton.dev/v1
kind: PipelineRun
metadata: {}
spec:
  pipelineRef:
    name: task-buildah-ns
  params:
    - name: IMAGE
      value: your-image-name
    - name: TLS_VERIFY
      value: true
    - name: VERBOSE
      value: false
  workspaces:
    - name: source
      persistentVolumeClaim:
        claimName: your-pvc-name

    value
    Replace your-image-name with the full name of the container image that you want to build.
    claimName

    Replace your-pvc-name with the name of the PersistentVolumeClaim (PVC) that stores the application source code.

    Note

    If the target container registry requires authentication, configure a Kubernetes secret for registry access and link it to the service account that runs the TaskRun or PipelineRun resources.

  2. Create the PipelineRun resource by applying the YAML file: 

    $ oc apply -f pipeline-run.yaml
Red Hat logoGithubredditYoutubeTwitter

Aprender

Experimente, compre e venda

Comunidades

Sobre a documentação da Red Hat

Ajudamos os usuários da Red Hat a inovar e atingir seus objetivos com nossos produtos e serviços com conteúdo em que podem confiar. Explore nossas atualizações recentes.

Tornando o open source mais inclusivo

A Red Hat está comprometida em substituir a linguagem problemática em nosso código, documentação e propriedades da web. Para mais detalhes veja o Blog da Red Hat.

Sobre a Red Hat

Fornecemos soluções robustas que facilitam o trabalho das empresas em plataformas e ambientes, desde o data center principal até a borda da rede.

Theme

© 2026 Red HatVoltar ao topo