Running rootless Buildah on OCP with restricted-v2 SCC

[im-konge]

Hi,
I tried to run Buildah on OCP based on your tutorial, which was really helpful (thanks for that!). However it needs the anyuid SCC, which can be a security issue for other users that want to use the restricted-v2 or non-root-v2 SCCs. I wanted to ask you if it's possible to somehow workaround the issues when running buildah build on the Pod under the restricted-v2?

I tried multiple things like having some entrypoint adding the UID etc. to subuid and other files, however it always ends up with some issues like Error during unshare(CLONE_NEWUSER): Function not implemented (I don't know the internals, I think it's during some user namespace creation?).

Thanks for the answers everyone :).