buildah-full

A self-contained container image used as a Forgejo Actions runner environment. It bundles buildah (rootless, daemonless image builds), Go, and Node.js (required by JS-based actions like checkout), so a single job can check out code, run GoReleaser, and build/push multi-arch OCI images without a Docker daemon or socket.

Why this exists

• The stock quay.io/buildah/stable image has no Node, so actions/checkout and other JS actions fail with exec: "node": not found.
• Forgejo doesn't support actions/upload-artifact@v4 (GHES-incompatible), so passing build artifacts between jobs is awkward.
• Mounting the Podman socket into jobs is a security escalation we want to avoid.

A purpose-built image with buildah + node + go solves all three: everything happens in one daemonless job.

Bootstrap (first build, run once locally)

There's a chicken-and-egg: the build workflow runs on this image, so the image must exist before CI can build it. Build the first version by hand on the runner host (minis-01):

git clone https://git.aads.cloud/aad/buildah-full.git
cd buildah-full
buildah build -t git.aads.cloud/aad/buildah-full:latest -f Containerfile .
buildah push --creds "USERNAME:PACKAGE_TOKEN" git.aads.cloud/aad/buildah-full:latest

Replace USERNAME:PACKAGE_TOKEN with an account/PAT that has write:package on the aad namespace.

Wire it into the runner

Add a label pointing at the image in the runner's config.yml:

labels:
  - docker:docker://node:20-bookworm
  - buildah-full:docker://git.aads.cloud/aad/buildah-full:latest

Then restart the runner:

systemctl --user restart forgejo-runner

If the package is private, the runner host (not the workflow) needs pull credentials, since the runner pulls the job image. Add them to the runner user's auth file:

buildah login -u USERNAME -p PACKAGE_TOKEN git.aads.cloud
# writes to ~/.config/containers/auth.json for the runner user

Using it from another repo

jobs:
  release:
    runs-on: buildah-full
    steps:
      - uses: actions/checkout@v7
      - run: buildah build -t git.aads.cloud/aad/myapp:latest .
      # ... buildah push, etc.

STORAGE_DRIVER, BUILDAH_ISOLATION, and BUILDAH_FORMAT are baked into the image as env vars, so workflows don't need to set them.

Maintenance

• The build workflow rebuilds on Containerfile changes, monthly via cron (base-image patches), and on manual workflow_dispatch.
• Bump GO_VERSION in the Containerfile to update the Go toolchain.
• Each build publishes :latest and a :YYYYMMDD tag for rollback.