How we can restrict few Buildah commands from CLI Terminal.

[sachinkaushik]

Hi Team,

This is not issue/bug. I just need your support, I have a requirement where User can only build container image and also run others buildah command on terminal but _User can not run/create container using _ buildah from command. I have to kind of block or disable this command. Exception this command User can run all buildah commands.

As per our project requirement, we are proving a user interface to user he can only run that container image from there only. We have written all backend logic, image will be pulled from OpenShift's internal registry, that container image User has build from terminal and will be pushed to Openshift internal registry.

Any help/guidance will be appreciated.

Thank you in advance..!!!

[rhatdan]

We have no way of blocking this now.
You want to allow them to run
buildah pull, buildah bud, buildah push, buildah containers, and buildah images

But not buildah from and buildah run?

[sachinkaushik]

Thank you for response,

Yes we have to block buildah from and buildah run commands. So that instead of running containers from cli, they will run from ui only.

Since we have a UI page from there user only can run container image.

[rhatdan]

Great, so I can close this issue. We can continue conversation here if you want.

[TomSweeneyRedHat]

I've moved the discussion to #3276, it's an interesting topic/thought.

[sachinkaushik]

Thank you @TomSweeneyRedHat @rhatdan !

FYI..

I followed below tutorial for creating rootless openshitft container. We want build user to block/disable buildah from command. If build user try to do so, there should be message on cli that "This command is not allowed " or we can customize it accordingly.

https://github.com/containers/buildah/blob/master/docs/tutorials/05-openshift-rootless-bud.md