buildah

The rootless image builder as a module (novox/hq ADR 0487, issue 1702).

The only module that declares the package buildah (checks/toolchains), and the only one that provides rootless-image-build (checks/imagebuild; docker never does).
Provides rootless-image-build with the machine's reach: mesh-build-image requires it, so it composes only on a machine where this module is assigned, and a node without it is refused at resolution naming buildah.
No account and no subordinate-id word. The node-engine makes every user account with useradd, which allocates the account 65536 subordinate uids and gids; mesh-build-image's own account gets its ranges that way and its health proves them (it reads /etc/subuid and /etc/subgid).
The helpers (an OCI runtime, passt, containers-common) come as buildah's package dependencies.
Holds no long-running resource, so it adds nothing to health-undeclared.