Running Buildah in GitLab CI Without seccomp:unconfined (2026)

As organizations transition away from Kaniko for container builds in CI/CD pipelines, Buildah emerges as a promising alternative. This tutorial will guide you through running Buildah in GitLab CI without relying on seccomp:unconfined, ensuring a more secure and efficient build process. Understanding how to configure Buildah correctly in your GitLab pipelines enhances security and aligns with modern DevOps practices.

Key Takeaways

• Understand why Buildah is a viable alternative to Kaniko.
• Configure GitLab CI to run Buildah securely without seccomp:unconfined.
• Learn step-by-step how to set up and execute Buildah builds.
• Address common errors and troubleshooting tips for Buildah in GitLab CI.

Prerequisites

• GitLab account with CI/CD access.
• Basic understanding of GitLab CI/CD pipelines.
• Familiarity with containerization concepts.
• Access to a GitLab Runner with Docker executor.

Step 1: Install Dependencies

To start using Buildah in your GitLab CI pipelines, you need to ensure that your GitLab Runner is properly configured with the necessary dependencies. Begin by installing Buildah on your runner. The following example shows installation on a Debian-based system:

sudo apt update
sudo apt install -y buildah

Ensure the runner has Docker installed, as Buildah will interface with Docker to build images.

Step 2: Configure GitLab CI Pipeline

Next, you need to configure your .gitlab-ci.yml file to use Buildah. Below is a sample configuration that sets up a Buildah job in a GitLab CI pipeline:

build:
  stage: build
  image: quay.io/buildah/stable
  script:
    - buildah bud -t my-image:latest .
  tags:
    - docker
  variables:
    BUILDAH_FORMAT: 'docker'

This configuration specifies the Buildah image from Quay.io and sets the BUILDAH_FORMAT variable to ensure compatibility with Docker registries.

Step 3: Execute Buildah Build

With the configuration in place, you can now execute your pipeline. Buildah will create a container image based on the instructions in your Dockerfile. This process is executed without the seccomp:unconfined setting, enhancing security by maintaining strict syscall filtering.

After the build completes, your image will be stored locally on the runner or pushed to a specified container registry, depending on your configuration.

Step 4: Manage Permissions and Security

Running Buildah without seccomp:unconfined requires managing permissions carefully. Ensure that the user under which the GitLab Runner executes has the necessary permissions to run Buildah commands. This often involves adding the user to the Docker group:

sudo usermod -aG docker $USER

Log out and back in to effect the group changes.

Step 5: Troubleshooting Common Issues

While using Buildah in GitLab CI, you might encounter several common issues. Here are solutions to some typical problems:

• Buildah Command Not Found: Ensure that Buildah is installed and your PATH is correctly set.
• Permission Denied: Check that the GitLab Runner user has appropriate permissions to run Docker and Buildah.
• Build Fails with Security Errors: Verify that seccomp:unconfined is not required, or adjust security settings as needed.

Common Errors/Troubleshooting

Buildah's integration in GitLab CI can lead to errors if not properly configured. Always ensure that your runner environment is correctly set up, and consult the Buildah and GitLab documentation for additional troubleshooting tips.

Frequently Asked Questions

What is Buildah?

Buildah is a tool for building Open Container Initiative (OCI) container images. It's an alternative to Docker's build functionality and focuses on flexibility and security.

Why avoid seccomp:unconfined?

Using seccomp:unconfined can expose your builds to security vulnerabilities. It's recommended to configure Buildah without it to leverage syscall filtering for better security.

How does Buildah integrate with GitLab CI?

Buildah can be integrated into GitLab CI pipelines by using it within a Docker-based GitLab Runner, allowing you to build container images directly from your CI/CD scripts.

Frequently Asked Questions

What is Buildah?

Buildah is a tool for building Open Container Initiative (OCI) container images. It's an alternative to Docker's build functionality and focuses on flexibility and security.

Why avoid seccomp:unconfined?

Using seccomp:unconfined can expose your builds to security vulnerabilities. It's recommended to configure Buildah without it to leverage syscall filtering for better security.

How does Buildah integrate with GitLab CI?

Buildah can be integrated into GitLab CI pipelines by using it within a Docker-based GitLab Runner, allowing you to build container images directly from your CI/CD scripts.