---
name: "buildah-oci-image-builder"
description: "Build lightweight, rootless OCI and Docker container images directly from Bash scripts."
metadata:
  author: "Containers"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "build image with buildah script"
  - "buildah bud dockerfile"
  - "commit buildah container"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Buildah Scriptable Daemonless OCI Image Builds

Builds container images using Buildah: scriptable container creation (buildah from, buildah run, buildah copy), inspecting working containers, committing image layers, and building without running a container daemon.

## When to Invoke
Invoke this skill whenever you need to:
- build image with buildah script
- buildah bud dockerfile
- commit buildah container

## Execution SOP & Rules
1. Initialize builder: container=$(buildah from alpine:latest).
2. Execute commands: buildah run $container -- apk add --no-cache ca-certificates.
3. Copy artifacts: buildah copy $container ./bin/server /usr/local/bin/server.
4. Commit and tag: buildah commit --rm $container myapp:latest.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.