support buildah and operator multi-stage builds

[estroz]

buildah is a tool that builds OCI images, from its CLI interface or by interpreting Dockerfiles. RHEL does not support docker above v1.13, preventing the SDK from leveraging the multi-stage build Dockerfile feature; buildah supports this feature, and will continue to be supported in RHEL. See #431 for relevant discussion.

This PR also adds CI support for buildah by building the latest version in an image and copying the binary, as well as that of runc which is required to run buildah bud ... in our case, into the build VM.

Relevant issues: #167

[shawn-hurley]

@estroz Looks like this forces users to use buildah. I wonder if there is some way to tell the build command which tool(buildah, docker) to use instead. It does not appear that I can install buildah on mac os x without installing from source, which I think is a pretty big barrier of entry IMO.

[mhrivnak]

Note: this code change will break operator-sdk build if buildah v1.3+ is not installed, as the rootless option was added in v1.3. RHEL currently supports v1.2; a v1.3 binary should be available soon.

I assume this only "breaks" setups where a user has enabled running docker as non-root, which is horribly unsafe. I don't think the SDK should feel any obligation to preserve that experience.

That said, using buildah in general is a nice improvement, and its rootless feature will be a great benefit to SDK users. Thanks for adding support.

[spahl]

Using buildah is nice but as Shawn said we don't want to force the dependency. I would prefer the code to detect it and use it if present; otherwise fallback to docker. Also if nothing is present let's be nice and fail with an error message instead of deep in the code.

[AlexNPavel]

Looking a bit more at buildah, it seems that 1 feature they are missing that we need is ARG-before-FROM functionality, which is in docker-ce 17+ (which technically means it is also not supported in fedora or RHEL without using docker's own rpm repos either). We need the ARG-before-FROM feature for the --enable-tests flag of build.

There is an issue tracking this, but there hasn't been much activity: containers/buildah#581

[estroz]

Note that containers/buildah#581 is dependent on openshift/imagebuilder#76.
PR's are open: containers/buildah#1128, openshift/imagebuilder#104.

[AlexNPavel]

LGTM other than some small changes to the dockerfiles

[openshift-ci-robot]

@estroz: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[estroz]

Closing as this doesn't add much past what #1311 does. Multi-stage support will be addressed in the future, see #782 for details.