# buildah

The rootless image builder as a module (novox/hq ADR 0487, issue 1702).

- **The only module that declares the package `buildah`** (`checks/toolchains`), and the only one that provides
  `rootless-image-build` (`checks/imagebuild`; docker never does).
- **Provides `rootless-image-build` with the machine's reach**: mesh-build-image requires it, so it composes only on a
  machine where this module is assigned, and a node without it is refused at resolution naming `buildah`.
- **No account and no subordinate-id word.** The node-engine makes every `user` account with `useradd`, which
  allocates the account 65536 subordinate uids and gids; mesh-build-image's own account gets its ranges that way and
  its health proves them (it reads /etc/subuid and /etc/subgid).
- The helpers (an OCI runtime, passt, containers-common) come as buildah's package dependencies.
- Holds no long-running resource, so it adds nothing to `health-undeclared`.