Buildah vs Incus

Buildah is a free command-line tool for building OCI container images on Linux. It can create images from working containers, Dockerfiles, or Containerfiles, and can also build through commands and scripts without a build file. Output can use OCI format or the traditional upstream Docker image format. Builds can run without root privileges, and Buildah follows a fork-exec model rather than running as a daemon. Its commands create, mount, unmount, delete, and rename working containers, as well as create or delete images; users can also pull images from a specified location and push local images elsewhere. Buildah is based on a Go API that other tools can vendor, and Podman uses it for Dockerfile builds while remaining independently installable. Buildah requires a kernel with OverlayFS or fuse-overlayfs support; RHEL or CentOS requires version 7.4 or later. Installation guidance warns that short image names can be spoofed and recommends fully qualified names from trusted registries or pulling by digest. The project points users to tutorials, releases, and a mailing list for questions.

Incus is free software for managing system containers, application containers, and virtual machines. Instances can share storage and networking, and administrators can manage them through a command-line tool, REST API, or third-party integrations. The software supports snapshots, backup and recovery, migration, configurable storage pools and networks, and resource controls. The project describes its API as suitable for use from a laptop through clusters of thousands of compute nodes. Documented integrations include Terraform, OpenTofu, Ansible, Packer, Distrobuilder, GARM, Kubernetes Cluster API, and Incant. The daemon runs on Linux; client applications are available for Windows and macOS, with FreeBSD client packages also listed. Upstream does not directly provide packages, so installation is through Linux distributions, third-party repositories, or source. Incus is developed under the Apache 2 license. Containers are unprivileged by default, but access to the Unix socket grants full control, so it should be limited to trusted users. The 6.0 LTS release is supported until June 2029; feature releases are normally supported until the next release.