Using Buildah libs in container for binary built with CGO_ENABLED=0 gives error parsing PID "": strconv.Atoi: parsing "": invalid syntax

[parthyadav3105]

I am trying to use buildah as library to build images inside container:

main.go

func main() {
	// init buildah for re-exec so that we can run as a different child processes
	if buildah.InitReexec() {
		return
	}
	// unshare so that we can run as a different user and not as root.
	unshare.MaybeReexecUsingUserNamespace(false)

	buildStoreOptions, err := storage.DefaultStoreOptions()
	if err != nil {
		log.Fatalln(err)
	}

	// get a store using the default configuration.
	buildStore, err := storage.GetStore(buildStoreOptions)
	if err != nil {
		log.Fatalln(err)
	}
	defer buildStore.Shutdown(false)

	imageRuntime, err := libimage.RuntimeFromStore(buildStore, nil)
	if err != nil {
		log.Fatalln(err)
	}
	defer imageRuntime.Shutdown(false)

	/////////////// Create Dockerfile
	Dockerfile := `
	FROM ubuntu:latest
	RUN echo hello
	`
	dockerfilePath := "/tmp/Dockerfile"
	img := "localhost:5000/demo:latest"

	err = os.WriteFile(dockerfilePath, []byte(Dockerfile), 0644)
	if err != nil {
		log.Fatalln("buildManager failed to build image, error writing Dockerfile")
	}
	defer os.Remove(dockerfilePath)

	///////////////////

	buildOpts := define.BuildOptions{
		Layers:       true,
		OutputFormat: define.OCIv1ImageManifest,

		Output: img,

		MaxPullPushRetries: 3,
		PullPushRetryDelay: 5 * time.Second,
	}

	// Build Image.
	_, _, err = imagebuildah.BuildDockerfiles(context.Background(), buildStore, buildOpts, dockerfilePath)
	if err != nil {
		log.Fatalln("buildManager failed to build image, error:", err)
	}
}

Dockerfile

FROM golang:1.22 as builder

RUN apt-get update && \
    apt-get install -y libbtrfs-dev libgpgme-dev libdevmapper-dev uidmap fuse-overlayfs libseccomp-dev buildah 

WORKDIR /workspace

COPY go.mod .
COPY go.sum .
RUN go mod download

COPY main.go .
# Build
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GO111MODULE=on go build -tags containers_image_openpgp -a -o /workspace/imagebuilder main.go


# Use distroless as minimal base image to package the manager binary
# Refer to https://github.com/GoogleContainerTools/distroless for more details
FROM gcr.io/distroless/static:nonroot
WORKDIR /
COPY --from=builder /workspace/imagebuilder .
USER 65532:65532

ENTRYPOINT ["./imagebuilder"]

The above gives error on running the built binary

$ docker container run -it --name dummy --privileged --rm dummy:latest
WARN[0000] Reading allowed ID mappings: reading subuid mappings for user "nonroot" and subgid mappings for group "nonroot": open /etc/subuid: no such file or directory 
WARN[0000] Found no UID ranges set aside for user "nonroot" in /etc/subuid. 
WARN[0000] Found no GID ranges set aside for user "nonroot" in /etc/subgid.
WARN[0000] Reading allowed ID mappings: reading subuid mappings for user "nonroot" and subgid mappings for group "nonroot": open /etc/subuid: no such file or directory 
WARN[0000] Found no UID ranges set aside for user "nonroot" in /etc/subuid. 
WARN[0000] Found no GID ranges set aside for user "nonroot" in /etc/subgid. 
WARN[0000] Reading allowed ID mappings: reading subuid mappings for user "nonroot" and subgid mappings for group "nonroot": open /etc/subuid: no such file or directory 
WARN[0000] Found no UID ranges set aside for user "nonroot" in /etc/subuid. 
WARN[0000] Found no GID ranges set aside for user "nonroot" in /etc/subgid.
ERRO[0000] parsing PID "": strconv.Atoi: parsing "": invalid syntax 
ERRO[0000] (Unable to determine exit status)            
ERRO[0000] parsing PID "": strconv.Atoi: parsing "": invalid syntax 
ERRO[0000] (Unable to determine exit status)            
ERRO[0000] parsing PID "": strconv.Atoi: parsing "": invalid syntax 
ERRO[0000] (Unable to determine exit status)            
ERRO[0000] parsing PID "": strconv.Atoi: parsing "": invalid syntax 
ERRO[0000] (Unable to determine exit status)

What are steps required to use buildah inside containers for binaries built with CGO_ENABLED=0?

[nalind]

The reexec mechanism, which is used to have subprocesses do work that can't be done in a goroutine because they affect global state, requires cgo.