Is it possible to use podman/buildah build in Azure Container App Job?

Question

Is it possible to use podman/buildah build in Azure Container App Job?

Hieu Le 20

We are planning to migrate from AKS to ACA Jobs as self-hosted agents in Azure Pipeline. According to the documentation, it doesn't support Docker commands. However, I was wondering if ACA Jobs support rootless podman/buildah for building container images?

Docker build is an essential feature in our CI/CD pipelines, and I have already tried using podman/buildah without privileged and additional capabilities. It works fine on my local computer but not in ACA Jobs. Could anyone help me with this? Thanks in advance.

https://learn.microsoft.com/en-us/azure/container-apps/tutorial-ci-cd-runners-jobs?tabs=bash&pivots=container-apps-jobs-self-hosted-ci-cd-azure-pipelines

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Christos Panagiotidis 3,546 Reputation points

2026-07-29T14:50:14.6133333+00:00

You want to run Podman or Buildah inside an Azure Container Apps Job used as a self-hosted Azure Pipelines agent. Container Apps Jobs run in a managed, unprivileged container environment and do not expose a host container socket or support privileged containers and the kernel capabilities typically required for nested image builds. Rootless Podman reduces privileges, but it still depends on user namespaces, storage drivers, and mount behavior that the platform does not guarantee, so this is not a supported reliable build host. Use a Microsoft-hosted pipeline agent, a VM or VM Scale Set agent, or an AKS-based agent when a local container engine is required. A better Container Apps pattern is to submit the build to Azure Container Registry Tasks, for example through an ACR build command, then deploy the resulting image. Keep the Container Apps Job for orchestration or tests that do not require privileged image-building operations.

Christos Panagiotidis 3,546 Reputation points

2026-07-29T14:50:14.6133333+00:00

You want to run Podman or Buildah inside an Azure Container Apps Job used as a self-hosted Azure Pipelines agent. Container Apps Jobs run in a managed, unprivileged container environment and do not expose a host container socket or support privileged containers and the kernel capabilities typically required for nested image builds. Rootless Podman reduces privileges, but it still depends on user namespaces, storage drivers, and mount behavior that the platform does not guarantee, so this is not a supported reliable build host. Use a Microsoft-hosted pipeline agent, a VM or VM Scale Set agent, or an AKS-based agent when a local container engine is required. A better Container Apps pattern is to submit the build to Azure Container Registry Tasks, for example through an ACR build command, then deploy the resulting image. Keep the Container Apps Job for orchestration or tests that do not require privileged image-building operations.