The Complete Production SOP: How to Deploy and Run Buildah Scriptable Daemonless OCI Image Builds in Autonomous AI Agents

---
name: "buildah-oci-image-builder"
description: "Build lightweight, rootless OCI and Docker container images directly from Bash scripts."
metadata:
  author: "Containers"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "build image with buildah script"
  - "buildah bud dockerfile"
  - "commit buildah container"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: true
  net_access: true
---

# Buildah Scriptable Daemonless OCI Image Builds

## Execution SOP & Rules
1. Initialize builder: container=$(buildah from <base_image>).
2. Execute commands: buildah run $container -- <command>.
3. Copy artifacts: buildah copy $container <src> <dest>.
4. Commit and tag: buildah commit --rm $container <tag>.

#!/usr/bin/env bash
set -euo pipefail

# Fallback to vfs if native rootless overlay is not loaded
export BUILDAH_ISOLATION=${BUILDAH_ISOLATION:-chroot}

CTR=$(buildah from alpine:3.19)
buildah run "$CTR" -- apk add --no-cache ca-certificates tzdata
buildah copy "$CTR" ./bin/app /usr/local/bin/app
buildah config --entrypoint '["/usr/local/bin/app"]' "$CTR"
buildah commit --rm "$CTR" localhost/my-service:1.0.0

Please build image with buildah script for the Go binary in ./bin/server. 
Create a minimal alpine-based runtime container, copy the binary to /usr/local/bin/server, 
set the entrypoint, and commit the container as localhost/api-gateway:latest.

#!/usr/bin/env bash
set -euo pipefail

IMAGE_TAG="localhost/api-gateway:latest"

# Check if image exists in local storage
if ! buildah images -q "$IMAGE_TAG" > /dev/null; then
  echo "Error: Image $IMAGE_TAG was not found in Buildah storage." >&2
  exit 1
fi

# Validate Entrypoint configuration
ENTRYPOINT=$(buildah inspect -t image "$IMAGE_TAG" --format '{{.OCIv1.Config.Entrypoint}}')
echo "Verified image $IMAGE_TAG with Entrypoint: $ENTRYPOINT"