@vercel/container 22.0.2 → 23.0.1-snapshot-13615777d933

package/dist/index.js

@@ -38,7 +38,44 @@ __export(src_exports, {
   version: () => version
 });
 module.exports = __toCommonJS(src_exports);
-var import_build_utils6 = require("@vercel/build-utils");
+var import_build_utils8 = require("@vercel/build-utils");
+
+// src/schedules-command.ts
+var import_promises = require("fs/promises");
+var import_node_os = require("os");
+var import_node_path = require("path");
+var SCHEDULES_COMMAND_ENV = "VERCEL_SCHEDULE_COMMAND";
+var DISPATCHER = "schedules-command-dispatcher";
+async function buildSchedulesCommandImage(engine, params, dispatcher = (0, import_node_path.join)(__dirname, DISPATCHER)) {
+  const baseImage = await engine.build(params);
+  if ((await engine.onBuildTriggers?.(baseImage))?.length) {
+    throw new Error(
+      `"${params.dockerfilePath}" declares ONBUILD instructions, which only run when another image is built from it. Remove them from the schedule's Dockerfile.`
+    );
+  }
+  const contextDir = await (0, import_promises.mkdtemp)((0, import_node_path.join)((0, import_node_os.tmpdir)(), "vercel-schedules-image-"));
+  try {
+    await (0, import_promises.copyFile)(dispatcher, (0, import_node_path.join)(contextDir, DISPATCHER));
+    const dockerfilePath = (0, import_node_path.join)(contextDir, "Dockerfile");
+    await (0, import_promises.writeFile)(
+      dockerfilePath,
+      [
+        `FROM ${baseImage}`,
+        `COPY --chmod=0555 ${DISPATCHER} /__vercel_runtime/${DISPATCHER}`,
+        `ENTRYPOINT ["/__vercel_runtime/${DISPATCHER}"]`
+      ].join("\n")
+    );
+    await engine.build({
+      ...params,
+      contextDir,
+      dockerfilePath,
+      buildArgs: void 0,
+      baseImageIsLocal: true
+    });
+  } finally {
+    await (0, import_promises.rm)(contextDir, { recursive: true, force: true });
+  }
+}
 
 // src/diagnostics.ts
 var import_build_utils = require("@vercel/build-utils");
@@ -63,14 +100,15 @@ var diagnostics = (0, import_build_utils.createDiagnostics)("container");
 
 // src/index.ts
 var import_node_fs16 = require("fs");
-var import_node_path17 = __toESM(require("path"));
+var import_node_path22 = __toESM(require("path"));
 
 // src/util.ts
 var import_build_utils2 = require("@vercel/build-utils");
 var import_node_child_process = require("child_process");
 var import_node_fs = require("fs");
-var import_node_os = require("os");
-var import_node_path = require("path");
+var import_promises2 = require("fs/promises");
+var import_node_os2 = require("os");
+var import_node_path2 = require("path");
 var DEBUG = Boolean((0, import_build_utils2.getPlatformEnv)("BUILDER_DEBUG"));
 function normalizeCommand(command) {
   if (typeof command === "string") {
@@ -105,11 +143,23 @@ function debug(message) {
 function elapsed(since) {
   return `${((Date.now() - since) / 1e3).toFixed(1)}s`;
 }
+function formatBytes(bytes) {
+  if (bytes < 1024)
+    return `${bytes} B`;
+  const units = ["KiB", "MiB", "GiB"];
+  let value = bytes / 1024;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit += 1;
+  }
+  return `${value.toFixed(value >= 10 ? 0 : 1)} ${units[unit]}`;
+}
 function shortDigest(digest) {
   return digest.startsWith("sha256:") ? `${digest.slice(0, 19)}\u2026` : digest;
 }
 function delay(ms) {
-  return new Promise((resolve4) => setTimeout(resolve4, ms));
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 async function withSpan(parent, name, attrs, fn) {
   if (!parent) {
@@ -124,21 +174,21 @@ function readString(value) {
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
 function isDockerfileRef(ref) {
-  return /(docker|container)file/i.test((0, import_node_path.basename)(ref));
+  return /(docker|container)file/i.test((0, import_node_path2.basename)(ref));
 }
 var DOCKERFILE_CANDIDATES = [
   "Dockerfile.vercel",
   "Containerfile.vercel"
 ];
 function findDockerfile(workPath) {
-  return DOCKERFILE_CANDIDATES.find((name) => (0, import_node_fs.existsSync)((0, import_node_path.join)(workPath, name)));
+  return DOCKERFILE_CANDIDATES.find((name) => (0, import_node_fs.existsSync)((0, import_node_path2.join)(workPath, name)));
 }
 function devImageTag(serviceName) {
   const safe = serviceName.toLowerCase().replace(/[^a-z0-9-_.]/g, "-");
   return `vercel-dev/${safe || "service"}:dev`;
 }
 function run(cmd, args, opts = {}) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const child = (0, import_node_child_process.spawn)(cmd, args, {
       cwd: opts.cwd,
       env: opts.env,
@@ -173,7 +223,7 @@ function run(cmd, args, opts = {}) {
     });
     child.on("close", (code) => {
       if (code === 0) {
-        resolve4({ stdout, stderr });
+        resolve5({ stdout, stderr });
       } else {
         const detail = stderr.trim().split("\n").slice(-5).join("\n");
         const error = new Error(
@@ -189,6 +239,23 @@ ${detail}` : "")
     }
   });
 }
+async function hasCommand(name) {
+  try {
+    await run("which", [name], { quiet: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function lstatIfPresent(path4) {
+  try {
+    return await (0, import_promises2.lstat)(path4);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return void 0;
+    throw error;
+  }
+}
 function extractField(text, label) {
   const match = text.match(new RegExp(`^\\s*${label}:\\s*(.+)$`, "m"));
   return match?.[1]?.trim();
@@ -202,44 +269,130 @@ function existingRegistryAuthFile() {
     return (0, import_node_fs.existsSync)(explicit) ? explicit : void 0;
   }
   const fromXdg = readString(process.env.XDG_CONFIG_HOME);
-  const configHome = fromXdg || (0, import_node_path.join)((0, import_node_os.homedir)(), ".config");
-  const defaultPath = (0, import_node_path.join)(configHome, "containers", "auth.json");
+  const configHome = fromXdg || (0, import_node_path2.join)((0, import_node_os2.homedir)(), ".config");
+  const defaultPath = (0, import_node_path2.join)(configHome, "containers", "auth.json");
   return (0, import_node_fs.existsSync)(defaultPath) ? defaultPath : void 0;
 }
 
 // src/engines/buildah.ts
+var import_build_utils3 = require("@vercel/build-utils");
+var import_node_crypto3 = require("crypto");
 var import_node_fs3 = require("fs");
+var import_promises5 = require("fs/promises");
+var import_node_os5 = require("os");
+var import_node_path5 = require("path");
+
+// src/buildah-store-cache/state.ts
+var import_node_crypto = require("crypto");
+var import_promises3 = require("fs/promises");
 var import_node_os3 = require("os");
 var import_node_path3 = require("path");
 
+// src/buildah-store-cache/config.ts
+var BUILDAH_STORE_CACHE_FLAG = "VERCEL_BUILDAH_STORE_CACHE";
+function buildahStoreCacheRequested() {
+  return isBuildContainer() && process.env[BUILDAH_STORE_CACHE_FLAG] === "1";
+}
+function buildahStoreCacheEnabled() {
+  return buildahStoreCacheRequested() && deploymentId() !== void 0;
+}
+function deploymentId() {
+  return readString(process.env.VERCEL_DEPLOYMENT_ID);
+}
+
+// src/buildah-store-cache/state.ts
+var CLEANUP_CONTAINER_RE = /^vercel-cnb-[a-zA-Z0-9_.-]+$/;
+function buildahStoreStateDirectory() {
+  const deployment = deploymentId();
+  if (!deployment) {
+    throw new Error("VERCEL_DEPLOYMENT_ID is not set");
+  }
+  return (0, import_node_path3.join)(
+    (0, import_node_os3.tmpdir)(),
+    "vercel-buildah-store",
+    deployment.replace(/[^a-zA-Z0-9_-]/g, "_")
+  );
+}
+async function createBuildahStoreStateDirectory() {
+  const directory = buildahStoreStateDirectory();
+  await (0, import_promises3.mkdir)(directory, { recursive: true, mode: 448 });
+  return directory;
+}
+async function writeStateRecord(suffix, contents) {
+  const path4 = (0, import_node_path3.join)(
+    await createBuildahStoreStateDirectory(),
+    `${(0, import_node_crypto.randomUUID)()}${suffix}`
+  );
+  await (0, import_promises3.writeFile)(path4, contents, { mode: 384, flag: "wx" });
+  return path4;
+}
+
+// src/buildah-store-cache/usage.ts
+var import_promises4 = require("fs/promises");
+function imageIdsFromBuildOutput(output) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const match of output.matchAll(
+    /--> (?:Using cache )?([a-f0-9]{12,64})[ \t\r]*$/gm
+  )) {
+    ids.add(match[1]);
+  }
+  return [...ids];
+}
+var BuildahImageUsage = class _BuildahImageUsage {
+  constructor(path4) {
+    this.path = path4;
+  }
+  static async begin() {
+    if (!buildahStoreCacheEnabled()) {
+      return void 0;
+    }
+    try {
+      return new _BuildahImageUsage(
+        await writeStateRecord(".images", "pending\n")
+      );
+    } catch (error) {
+      debug(
+        `could not record Buildah image usage: ${error.message}`
+      );
+      return void 0;
+    }
+  }
+  /** A failure leaves the record pending, so the save stops instead of pruning blindly. */
+  async record(images) {
+    try {
+      const ids = (await images()).map((id) => id.replace(/^sha256:/, ""));
+      if (ids.length === 0) {
+        throw new Error("no Buildah image IDs were recorded");
+      }
+      const temporary = `${this.path}.tmp`;
+      await (0, import_promises4.writeFile)(temporary, `${ids.join("\n")}
+`, { mode: 384 });
+      await (0, import_promises4.rename)(temporary, this.path);
+    } catch (error) {
+      debug(
+        `could not record Buildah image usage: ${error.message}`
+      );
+    }
+  }
+};
+
 // src/storage-driver.ts
-var import_node_child_process2 = require("child_process");
 var import_node_fs2 = require("fs");
-var import_node_os2 = require("os");
-var import_node_path2 = require("path");
+var import_node_os4 = require("os");
+var import_node_path4 = require("path");
 var BUILDAH_GRAPH_ROOT = "/vercel/.containers/storage";
 var BUILDAH_RUN_ROOT = "/run/containers/storage";
 var REQUIRED_BUILD_CONTAINER_DRIVER = "overlay";
-async function hasBinary(name) {
-  try {
-    await run("which", [name], { quiet: true });
-    return true;
-  } catch {
-    return false;
-  }
-}
 var cachedStorageDriver;
 function selectStorageDriver() {
   if (!cachedStorageDriver) {
     cachedStorageDriver = (async () => {
       const override = readString(process.env.VERCEL_VCR_DOCKER_STORAGE_DRIVER);
-      if (override) {
+      if (override)
         return override;
-      }
-      if (isBuildContainer()) {
+      if (isBuildContainer())
         return void 0;
-      }
-      if (await hasBinary("fuse-overlayfs") && (0, import_node_fs2.existsSync)("/dev/fuse")) {
+      if (await hasCommand("fuse-overlayfs") && (0, import_node_fs2.existsSync)("/dev/fuse")) {
         return "fuse-overlayfs";
       }
       return "vfs";
@@ -253,8 +406,8 @@ short-name-mode = "permissive"
 var cachedRegistriesConfPath;
 function buildahRegistriesConfPath() {
   if (!cachedRegistriesConfPath) {
-    const dir = (0, import_node_fs2.mkdtempSync)((0, import_node_path2.join)((0, import_node_os2.tmpdir)(), "vercel-container-registries-"));
-    cachedRegistriesConfPath = (0, import_node_path2.join)(dir, "registries.conf");
+    const dir = (0, import_node_fs2.mkdtempSync)((0, import_node_path4.join)((0, import_node_os4.tmpdir)(), "vercel-container-registries-"));
+    cachedRegistriesConfPath = (0, import_node_path4.join)(dir, "registries.conf");
     (0, import_node_fs2.writeFileSync)(cachedRegistriesConfPath, BUILDAH_REGISTRIES_CONF);
   }
   return cachedRegistriesConfPath;
@@ -266,9 +419,8 @@ async function buildahStorageArgs() {
     "--registries-conf",
     buildahRegistriesConfPath()
   ];
-  if (!driver) {
+  if (!driver)
     return [...rootArgs, ...registriesArgs];
-  }
   if (driver === "fuse-overlayfs") {
     return [
       ...rootArgs,
@@ -281,121 +433,9 @@ async function buildahStorageArgs() {
   }
   return [...rootArgs, ...registriesArgs, "--storage-driver", driver];
 }
-async function runBuildah(args, opts = {}) {
-  const fullArgs = [...await buildahStorageArgs(), ...args];
-  debug(`exec: buildah ${fullArgs.join(" ")}`);
-  const start = Date.now();
-  try {
-    const result = await run("buildah", fullArgs, opts);
-    debug(`buildah ${args[0]} finished in ${Date.now() - start}ms`);
-    return result;
-  } catch (error) {
-    debug(`buildah ${args[0]} failed after ${Date.now() - start}ms`);
-    throw error;
-  }
-}
-async function startBuildahInBackground(args) {
-  const fullArgs = [...await buildahStorageArgs(), ...args];
-  debug(`exec in the background: buildah ${fullArgs.join(" ")}`);
-  const start = Date.now();
-  const child = (0, import_node_child_process2.spawn)("buildah", fullArgs, {
-    detached: true,
-    stdio: "ignore"
-  });
-  child.on(
-    "error",
-    (error) => debug(`background buildah ${args[0]} failed: ${error.message}`)
-  );
-  child.on(
-    "exit",
-    (code) => debug(
-      `background buildah ${args[0]} exited with code ${code} after ${Date.now() - start}ms`
-    )
-  );
-  child.unref();
-}
-async function readBuildahStoreInfo() {
-  const { stdout } = await runBuildah(["info"], { quiet: true });
-  const store = JSON.parse(stdout).store;
-  if (!store) {
-    return void 0;
-  }
-  const graphStatus = store.GraphStatus;
-  return {
-    graphRoot: String(store.GraphRoot ?? ""),
-    runRoot: String(store.RunRoot ?? ""),
-    driver: String(store.GraphDriverName ?? ""),
-    backingFs: String(
-      graphStatus?.["Backing Filesystem"] ?? graphStatus?.["Backing filesystem"] ?? ""
-    )
-  };
-}
-async function assertBuildContainerStorage(log = () => {
-}) {
-  if (!isBuildContainer()) {
-    return;
-  }
-  if (readString(process.env.VERCEL_VCR_DOCKER_STORAGE_DRIVER)) {
-    return;
-  }
-  const strict = Boolean(readString(process.env.VERCEL_VCR_STRICT_STORAGE));
-  let storeInfo;
-  try {
-    storeInfo = await readBuildahStoreInfo();
-  } catch (err) {
-    const message = `Could not verify buildah storage via \`buildah info\`: ${err.message}`;
-    if (strict) {
-      throw new Error(message);
-    }
-    log(message);
-    return;
-  }
-  if (!storeInfo) {
-    const message = "Could not verify buildah storage: `buildah info` returned no store data.";
-    if (strict) {
-      throw new Error(message);
-    }
-    log(message);
-    return;
-  }
-  const problems = [];
-  if (storeInfo.driver !== REQUIRED_BUILD_CONTAINER_DRIVER) {
-    problems.push(
-      `storage driver is "${storeInfo.driver}", expected "${REQUIRED_BUILD_CONTAINER_DRIVER}"`
-    );
-  }
-  if (storeInfo.graphRoot !== BUILDAH_GRAPH_ROOT) {
-    problems.push(
-      `graphRoot is "${storeInfo.graphRoot}", expected the mounted volume "${BUILDAH_GRAPH_ROOT}"`
-    );
-  }
-  if (storeInfo.backingFs && storeInfo.backingFs === "overlayfs") {
-    problems.push(
-      `backing filesystem is "${storeInfo.backingFs}" (the overlay rootfs), not the mounted volume`
-    );
-  }
-  const summary = `buildah storage: driver=${storeInfo.driver} graphRoot=${storeInfo.graphRoot} runRoot=${storeInfo.runRoot} backingFs=${storeInfo.backingFs || "?"}`;
-  if (problems.length === 0) {
-    log(`${summary} \u2014 verified`);
-    return;
-  }
-  const detail = `${summary}
-Problems: ${problems.join("; ")}.
-Expected the native overlay driver with the graphroot under the XFS \`/vercel\` cell volume (requires vercel/hive#2310 capabilities + the storage.conf from vercel/api#76567).`;
-  if (strict) {
-    throw new Error(
-      `Container build storage is not configured as intended.
-${detail}`
-    );
-  }
-  log(
-    `${detail}
-Continuing (set VERCEL_VCR_STRICT_STORAGE=1 to fail builds).`
-  );
-}
 
 // src/oidc.ts
-var import_node_crypto = require("crypto");
+var import_node_crypto2 = require("crypto");
 function parseOidcToken(token) {
   const parts = token.split(".");
   if (parts.length !== 3) {
@@ -426,7 +466,7 @@ function decodeOidcClaims(token) {
 function tokenFingerprint(token) {
   if (!token)
     return "absent";
-  const sha = (0, import_node_crypto.createHash)("sha256").update(token).digest("hex").slice(0, 8);
+  const sha = (0, import_node_crypto2.createHash)("sha256").update(token).digest("hex").slice(0, 8);
   return `present(len=${token.length}, sha256=${sha})`;
 }
 function debugTokenClaims(label, token) {
@@ -720,206 +760,266 @@ async function ensureRepository(repository, token, claims, span) {
 }
 
 // src/engines/buildah.ts
-function logLayerCacheSummary(output) {
-  const steps = (output.match(/^STEP\s+\d+\/\d+:/gm) || []).length;
-  const cached = (output.match(/-->\s+Using cache\b/gi) || []).length;
-  if (steps === 0) {
-    return;
+function localImageRef(params) {
+  const { imageRef } = params;
+  if (!params.useBuildahStoreCache) {
+    return imageRef;
   }
-  const built = Math.max(steps - cached, 0);
-  info(`layer cache: ${cached}/${steps} steps reused, ${built} rebuilt`);
+  return `${imageRef.slice(0, imageRef.lastIndexOf(":"))}:vercel-buildah-store`;
 }
-var buildahEngine = {
-  name: "buildah",
-  async ensureReady(span) {
-    try {
-      const storageDriver = await selectStorageDriver();
-      const { stdout } = await runBuildah(["--version"], { quiet: true });
-      span?.setAttributes({
-        "buildah.version": stdout.trim().split("\n")[0],
-        "buildah.storage_driver": storageDriver ?? "storage.conf"
-      });
-    } catch (err) {
-      const message = err.message;
-      if (/Command not found/i.test(message)) {
-        throw new Error(
-          isBuildContainer() ? "The `buildah` CLI is not available in this build container. Install buildah (via SPAL) in the build image." : "Buildah was not found on your PATH. Install buildah or run the build on Vercel where the build container provides it."
-        );
-      }
-      throw err;
-    }
-  },
-  async logDiagnostics(span) {
+function pullFlags(params) {
+  if (params.baseImageIsLocal) {
+    return ["--pull=never"];
+  }
+  return params.useBuildahStoreCache ? ["--pull=always"] : [];
+}
+async function deploymentSourceDateEpoch() {
+  if ((0, import_build_utils3.resolveBuildConcurrency)() <= 1) {
+    return void 0;
+  }
+  if (readString(process.env.SOURCE_DATE_EPOCH?.trim()) !== void 0) {
+    return void 0;
+  }
+  try {
+    const path4 = (0, import_node_path5.join)(
+      await createBuildahStoreStateDirectory(),
+      "source-date-epoch"
+    );
+    const candidate = `${path4}.${(0, import_node_crypto3.randomUUID)()}`;
+    await (0, import_promises5.writeFile)(candidate, `${Math.floor(Date.now() / 1e3)}
+`, {
+      flag: "wx",
+      mode: 384
+    });
     try {
-      const storageDriver = await selectStorageDriver();
-      const version2 = (await runBuildah(["--version"], { quiet: true })).stdout.trim();
-      info(
-        `buildah: ${version2.split("\n")[0] ?? version2} (storage-driver=${storageDriver ?? "storage.conf"})`
-      );
-      span?.setAttributes({
-        "container.engine": "buildah",
-        "buildah.version": toTag(version2.split("\n")[0]),
-        "buildah.storage_driver": toTag(storageDriver ?? "storage.conf")
-      });
-    } catch (err) {
-      debug(`buildah diagnostics unavailable: ${err.message}`);
+      await (0, import_promises5.link)(candidate, path4);
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+    } finally {
+      await (0, import_promises5.rm)(candidate, { force: true });
     }
-  },
-  async withRuntime(_span, fn) {
-    return fn();
-  },
-  async build(params) {
-    try {
-      const { stdout: stdout2 } = await runBuildah(["images", "--quiet"], {
-        quiet: true
-      });
-      const imageCount = stdout2.trim() ? stdout2.trim().split("\n").length : 0;
-      info(
-        imageCount > 0 ? `layer store: warm (${imageCount} image(s) present before build)` : "layer store: cold (no images present before build)"
-      );
-    } catch (err) {
-      debug(`could not read store warmth: ${err.message}`);
+    const epoch = (await (0, import_promises5.readFile)(path4, "utf8")).trim();
+    if (!/^[0-9]+$/.test(epoch)) {
+      throw new Error(`invalid value ${JSON.stringify(epoch)}`);
     }
-    const { stdout, stderr } = await runBuildah([
-      "build",
-      "--platform",
-      TARGET_PLATFORM,
-      // Commit and cache a layer per Dockerfile instruction so unchanged steps
-      // (base image, dependency installs, etc.) can be reused on later builds
-      // when the image store is warm. Without this buildah squashes the build
-      // and no per-step caching happens.
-      "--layers",
-      // Use the host network namespace for RUN steps. The build runs inside a
-      // restricted Hive cell that cannot program iptables, so buildah's default
-      // rootless networking (netavark) fails with
-      // "netavark: iptables ... Could not fetch rule set generation id".
-      // Host networking skips per-container network setup and reuses the cell's
-      // existing egress.
-      "--network",
-      "host",
-      ...buildArgFlags(params),
-      "-t",
-      params.imageRef,
-      "-f",
-      params.dockerfilePath,
-      params.contextDir
-    ]);
-    logLayerCacheSummary(`${stdout}
-${stderr}`);
-  },
-  async login(params) {
-    try {
-      await runBuildah(
-        [
-          "login",
-          params.registry,
-          "--username",
-          params.username,
-          "--password-stdin"
-        ],
-        { input: params.token, quiet: !DEBUG }
+    return epoch;
+  } catch (error) {
+    debug(
+      `could not share a Buildah source date epoch: ${error.message}`
+    );
+    return void 0;
+  }
+}
+function createBuildahEngine(client) {
+  return {
+    name: "buildah",
+    async ensureReady(span) {
+      try {
+        const storageDriver = await selectStorageDriver();
+        const version2 = await client.version();
+        span?.setAttributes({
+          "buildah.version": version2.split("\n")[0],
+          "buildah.storage_driver": storageDriver ?? "storage.conf"
+        });
+      } catch (err) {
+        const message = err.message;
+        if (/Command not found/i.test(message)) {
+          throw new Error(
+            isBuildContainer() ? "The `buildah` CLI is not available in this build container. Install buildah (via SPAL) in the build image." : "Buildah was not found on your PATH. Install buildah or run the build on Vercel where the build container provides it."
+          );
+        }
+        throw err;
+      }
+    },
+    async logDiagnostics(span) {
+      try {
+        const storageDriver = await selectStorageDriver();
+        const version2 = await client.version();
+        info(
+          `buildah: ${version2.split("\n")[0] ?? version2} (storage-driver=${storageDriver ?? "storage.conf"})`
+        );
+        span?.setAttributes({
+          "container.engine": "buildah",
+          "buildah.version": toTag(version2.split("\n")[0]),
+          "buildah.storage_driver": toTag(storageDriver ?? "storage.conf")
+        });
+      } catch (err) {
+        debug(`buildah diagnostics unavailable: ${err.message}`);
+      }
+    },
+    async withRuntime(_span, fn) {
+      return fn();
+    },
+    async build(params) {
+      try {
+        const { stdout: stdout2 } = await client.run(["images", "--quiet"], {
+          quiet: true
+        });
+        const imageCount = stdout2.trim() ? stdout2.trim().split("\n").length : 0;
+        info(
+          imageCount > 0 ? `Buildah store: warm (${imageCount} image(s) present before build)` : "Buildah store: cold (no images present before build)"
+        );
+      } catch (err) {
+        debug(`could not read store warmth: ${err.message}`);
+      }
+      const sourceDateEpoch = await deploymentSourceDateEpoch();
+      if (sourceDateEpoch) {
+        info(
+          `Buildah source date epoch: ${sourceDateEpoch} (shared by this deployment's concurrent service builds)`
+        );
+      }
+      const usage = await BuildahImageUsage.begin();
+      const { stdout, stderr } = await client.run([
+        "build",
+        "--platform",
+        TARGET_PLATFORM,
+        // Commit and cache a layer per Dockerfile instruction so unchanged steps
+        // (base image, dependency installs, etc.) can be reused on later builds
+        // when the image store is warm. Without this buildah squashes the build
+        // and no per-step caching happens.
+        "--layers",
+        // With --layers, Buildah leaves the working container of a FROM-only
+        // stage behind, which stops the store cache from being saved.
+        "--force-rm",
+        ...sourceDateEpoch ? ["--source-date-epoch", sourceDateEpoch] : [],
+        ...pullFlags(params),
+        // Use the host network namespace for RUN steps. The build runs inside a
+        // restricted Hive cell that cannot program iptables, so buildah's default
+        // rootless networking (netavark) fails with
+        // "netavark: iptables ... Could not fetch rule set generation id".
+        // Host networking skips per-container network setup and reuses the cell's
+        // existing egress.
+        "--network",
+        "host",
+        ...buildArgFlags(params),
+        "-t",
+        localImageRef(params),
+        "-f",
+        params.dockerfilePath,
+        params.contextDir
+      ]);
+      await usage?.record(
+        () => imageIdsFromBuildOutput(`${stdout}
+${stderr}`)
       );
-    } catch (err) {
-      const message = err.message;
-      if (/denied|forbidden|unauthorized|401|403/i.test(message)) {
-        throw new Error(
-          formatVcrAuthError(
+      return localImageRef(params);
+    },
+    async login(params) {
+      try {
+        await client.run(
+          [
+            "login",
             params.registry,
+            "--username",
             params.username,
-            `Underlying error: ${message}`
-          )
+            "--password-stdin"
+          ],
+          { input: params.token, quiet: !DEBUG }
         );
+      } catch (err) {
+        const message = err.message;
+        if (/denied|forbidden|unauthorized|401|403/i.test(message)) {
+          throw new Error(
+            formatVcrAuthError(
+              params.registry,
+              params.username,
+              `Underlying error: ${message}`
+            )
+          );
+        }
+        throw err;
       }
-      throw err;
-    }
-  },
-  async verifyStorage(span) {
-    await assertBuildContainerStorage((message) => {
-      info(message);
-      const info0 = message.split("\n")[0];
-      span?.setAttributes({ "buildah.storage.verify": info0 });
-    });
-  },
-  async reportStorage(span) {
-    if (!DEBUG) {
-      return;
-    }
-    try {
-      const storeInfo = await readBuildahStoreInfo();
-      if (!storeInfo) {
-        debug("buildah info: no `store` field in output");
+    },
+    async verifyStorage(span) {
+      await client.verifyStorage((message) => {
+        info(message);
+        const info0 = message.split("\n")[0];
+        span?.setAttributes({ "buildah.storage.verify": info0 });
+      });
+    },
+    async reportStorage(span) {
+      if (!DEBUG) {
         return;
       }
-      info(
-        `buildah storage: graphRoot=${storeInfo.graphRoot} runRoot=${storeInfo.runRoot} driver=${storeInfo.driver} backingFs=${storeInfo.backingFs || "?"}`
-      );
-      span?.setAttributes({
-        "buildah.storage.graph_root": storeInfo.graphRoot,
-        "buildah.storage.run_root": storeInfo.runRoot,
-        "buildah.storage.driver": storeInfo.driver,
-        "buildah.storage.backing_fs": storeInfo.backingFs
-      });
-    } catch (err) {
-      debug(`buildah storage report unavailable: ${err.message}`);
-    }
-  },
-  async push(params) {
-    const digestDir = (0, import_node_fs3.mkdtempSync)((0, import_node_path3.join)((0, import_node_os3.tmpdir)(), "vercel-container-digest-"));
-    const digestFile = (0, import_node_path3.join)(digestDir, "digest");
-    const zstdEnabled = !readString(process.env.VERCEL_VCR_DISABLE_ZSTD);
-    const zstdArgs = zstdEnabled ? [
-      "--compression-format",
-      "zstd",
-      "--compression-level",
-      "3",
-      "--force-compression",
-      "--format",
-      "oci"
-    ] : [];
-    info(
-      `pushing ${params.imageRef} ` + (zstdEnabled ? "with zstd compression (level=3, force, oci)" : "with default compression (zstd disabled)")
-    );
-    const pushStart = Date.now();
-    let digest;
-    try {
-      await runBuildah([
-        "push",
-        ...zstdArgs,
-        "--digestfile",
-        digestFile,
-        params.imageRef
-      ]);
-      digest = readDigestFile(digestFile);
-    } catch (err) {
-      const message = err.message;
-      if (/denied|forbidden|unauthorized|not found|401|403|404/i.test(message)) {
-        throw new Error(
-          [
-            `Pushing ${params.imageRef} was denied.`,
-            "",
-            `The build tried to ensure the "${params.repository}" repository exists, but`,
-            "the push was still rejected. Verify access (or create the repository under",
-            "your project's Sandboxes \u2192 Container Registry tab), then re-run the build.",
-            "",
-            `Underlying error: ${message}`
-          ].join("\n")
+      try {
+        const storeInfo = await client.info();
+        if (!storeInfo) {
+          debug("buildah info: no `store` field in output");
+          return;
+        }
+        info(
+          `buildah storage: graphRoot=${storeInfo.graphRoot} runRoot=${storeInfo.runRoot} driver=${storeInfo.driver} backingFs=${storeInfo.backingFs || "?"}`
         );
+        span?.setAttributes({
+          "buildah.storage.graph_root": storeInfo.graphRoot,
+          "buildah.storage.run_root": storeInfo.runRoot,
+          "buildah.storage.driver": storeInfo.driver,
+          "buildah.storage.backing_fs": storeInfo.backingFs
+        });
+      } catch (err) {
+        debug(`buildah storage report unavailable: ${err.message}`);
+      }
+    },
+    async push(params) {
+      const digestDir = (0, import_node_fs3.mkdtempSync)((0, import_node_path5.join)((0, import_node_os5.tmpdir)(), "vercel-container-digest-"));
+      const digestFile = (0, import_node_path5.join)(digestDir, "digest");
+      const zstdEnabled = !readString(process.env.VERCEL_VCR_DISABLE_ZSTD);
+      const zstdArgs = zstdEnabled ? [
+        "--compression-format",
+        "zstd",
+        "--compression-level",
+        "3",
+        "--force-compression",
+        "--format",
+        "oci"
+      ] : [];
+      info(
+        `pushing ${params.imageRef} ` + (zstdEnabled ? "with zstd compression (level=3, force, oci)" : "with default compression (zstd disabled)")
+      );
+      const pushStart = Date.now();
+      let digest;
+      try {
+        await client.run([
+          "push",
+          ...zstdArgs,
+          "--digestfile",
+          digestFile,
+          localImageRef(params),
+          ...params.useBuildahStoreCache ? [`docker://${params.imageRef}`] : []
+        ]);
+        digest = readDigestFile(digestFile);
+      } catch (err) {
+        const message = err.message;
+        if (/denied|forbidden|unauthorized|not found|401|403|404/i.test(message)) {
+          throw new Error(
+            [
+              `Pushing ${params.imageRef} was denied.`,
+              "",
+              `The build tried to ensure the "${params.repository}" repository exists, but`,
+              "the push was still rejected. Verify access (or create the repository under",
+              "your project's Sandboxes \u2192 Container Registry tab), then re-run the build.",
+              "",
+              `Underlying error: ${message}`
+            ].join("\n")
+          );
+        }
+        throw err;
+      } finally {
+        (0, import_node_fs3.rmSync)(digestDir, { recursive: true, force: true });
       }
-      throw err;
-    } finally {
-      (0, import_node_fs3.rmSync)(digestDir, { recursive: true, force: true });
-    }
-    debug(`push completed in ${Date.now() - pushStart}ms`);
-    if (DIGEST_RE.test(digest)) {
-      debug(`pushed digest ${digest}`);
-      return digest;
+      debug(`push completed in ${Date.now() - pushStart}ms`);
+      if (DIGEST_RE.test(digest)) {
+        debug(`pushed digest ${digest}`);
+        return digest;
+      }
+      debug(
+        `--digestfile did not contain a digest (${JSON.stringify(digest)}) \u2014 resolving registry manifest`
+      );
+      return resolvePushedImageDigest(params);
     }
-    debug(
-      `--digestfile did not contain a digest (${JSON.stringify(digest)}) \u2014 resolving registry manifest`
-    );
-    return resolvePushedImageDigest(params);
-  }
-};
+  };
+}
 function readDigestFile(path4) {
   try {
     return (0, import_node_fs3.readFileSync)(path4, "utf8").trim();
@@ -930,19 +1030,11 @@ function readDigestFile(path4) {
 }
 
 // src/engines/docker.ts
-var import_node_child_process3 = require("child_process");
+var import_node_child_process2 = require("child_process");
 function runDocker(args, opts = {}) {
   debug(`exec: docker ${args.join(" ")}`);
   return run("docker", args, opts);
 }
-async function hasBinary2(name) {
-  try {
-    await run("which", [name], { quiet: true });
-    return true;
-  } catch {
-    return false;
-  }
-}
 async function isDockerDaemonReachable() {
   try {
     await run("docker", ["version", "--format", "{{.Server.Version}}"], {
@@ -966,7 +1058,7 @@ async function startDockerDaemon(span) {
   span?.setAttributes({ "docker.storage_driver": driver });
   step(`Starting Docker daemon (storage-driver=${driver})`);
   debug(`exec: dockerd ${args.join(" ")}`);
-  const child = (0, import_node_child_process3.spawn)("dockerd", args, {
+  const child = (0, import_node_child_process2.spawn)("dockerd", args, {
     stdio: ["ignore", "pipe", "pipe"]
   });
   let log = "";
@@ -1019,7 +1111,7 @@ async function startDockerDaemon(span) {
         ].join("\n")
       );
     }
-    await new Promise((resolve4) => setTimeout(resolve4, 500));
+    await new Promise((resolve5) => setTimeout(resolve5, 500));
   }
 }
 async function stopDockerDaemon(daemon, span) {
@@ -1029,12 +1121,12 @@ async function stopDockerDaemon(daemon, span) {
   }
   step("Stopping Docker daemon");
   const stopTimeoutMs = Number(process.env.VERCEL_VCR_DOCKERD_STOP_TIMEOUT_MS) || 1e4;
-  await new Promise((resolve4) => {
+  await new Promise((resolve5) => {
     let settled = false;
     const finish = () => {
       if (!settled) {
         settled = true;
-        resolve4();
+        resolve5();
       }
     };
     child.once("exit", finish);
@@ -1062,7 +1154,7 @@ async function withManagedDaemon(span, fn) {
   if (await isDockerDaemonReachable()) {
     return fn();
   }
-  if (!await hasBinary2("dockerd")) {
+  if (!await hasCommand("dockerd")) {
     return fn();
   }
   const daemon = await withSpan(
@@ -1161,6 +1253,17 @@ ${version2.trim()}`);
       params.dockerfilePath,
       params.contextDir
     ]);
+    return params.imageRef;
+  },
+  async onBuildTriggers(imageRef) {
+    const { stdout } = await runDocker([
+      "image",
+      "inspect",
+      "--format",
+      "{{json .Config.OnBuild}}",
+      imageRef
+    ]);
+    return JSON.parse(stdout) ?? [];
   },
   async login(params) {
     try {
@@ -1223,41 +1326,163 @@ ${version2.trim()}`);
 };
 
 // src/engines/index.ts
-function selectContainerEngine() {
+function selectContainerEngine(client) {
   const override = readString(
     process.env.VERCEL_CONTAINER_ENGINE
   )?.toLowerCase();
   if (override === "buildah")
-    return buildahEngine;
+    return createBuildahEngine(client);
   if (override === "docker")
     return dockerEngine;
-  return isBuildContainer() ? buildahEngine : dockerEngine;
+  return isBuildContainer() ? createBuildahEngine(client) : dockerEngine;
 }
 
+// src/clients/buildah.ts
+var BuildahClient = class {
+  constructor(lock) {
+    this.lock = lock;
+  }
+  async run(args, options = {}) {
+    const fullArgs = [...await buildahStorageArgs(), ...args];
+    debug(`exec: buildah ${fullArgs.join(" ")}`);
+    const start = Date.now();
+    try {
+      const [command, ...commandArgs] = await this.lock.wrap([
+        "buildah",
+        ...fullArgs
+      ]);
+      const result = await run(command, commandArgs, options);
+      debug(`buildah ${args[0]} finished in ${Date.now() - start}ms`);
+      return result;
+    } catch (error) {
+      debug(`buildah ${args[0]} failed after ${Date.now() - start}ms`);
+      throw error;
+    }
+  }
+  /** Version checks must not open the store or acquire its lock before restore. */
+  version() {
+    this.cachedVersion ??= run("buildah", ["--version"], { quiet: true }).then(({ stdout }) => stdout.trim()).catch((error) => {
+      this.cachedVersion = void 0;
+      throw error;
+    });
+    return this.cachedVersion;
+  }
+  /** Only stable store fields are cached; image and container counts are not. */
+  info() {
+    this.cachedStoreInfo ??= this.readStoreInfo().then(
+      (store) => {
+        if (!store)
+          this.cachedStoreInfo = void 0;
+        return store;
+      },
+      (error) => {
+        this.cachedStoreInfo = void 0;
+        throw error;
+      }
+    );
+    return this.cachedStoreInfo;
+  }
+  /** Storage mismatches are diagnostic unless strict verification is requested. */
+  async verifyStorage(log = () => {
+  }) {
+    if (!isBuildContainer())
+      return;
+    if (readString(process.env.VERCEL_VCR_DOCKER_STORAGE_DRIVER))
+      return;
+    const strict = Boolean(readString(process.env.VERCEL_VCR_STRICT_STORAGE));
+    let storeInfo;
+    try {
+      storeInfo = await this.info();
+    } catch (error) {
+      const message = `Could not verify buildah storage via \`buildah info\`: ${error.message}`;
+      if (strict)
+        throw new Error(message);
+      log(message);
+      return;
+    }
+    if (!storeInfo) {
+      const message = "Could not verify buildah storage: `buildah info` returned no store data.";
+      if (strict)
+        throw new Error(message);
+      log(message);
+      return;
+    }
+    const problems = [];
+    if (storeInfo.driver !== REQUIRED_BUILD_CONTAINER_DRIVER) {
+      problems.push(
+        `storage driver is "${storeInfo.driver}", expected "${REQUIRED_BUILD_CONTAINER_DRIVER}"`
+      );
+    }
+    if (storeInfo.graphRoot !== BUILDAH_GRAPH_ROOT) {
+      problems.push(
+        `graphRoot is "${storeInfo.graphRoot}", expected the mounted volume "${BUILDAH_GRAPH_ROOT}"`
+      );
+    }
+    if (storeInfo.backingFs && storeInfo.backingFs === "overlayfs") {
+      problems.push(
+        `backing filesystem is "${storeInfo.backingFs}" (the overlay rootfs), not the mounted volume`
+      );
+    }
+    const summary = `buildah storage: driver=${storeInfo.driver} graphRoot=${storeInfo.graphRoot} runRoot=${storeInfo.runRoot} backingFs=${storeInfo.backingFs || "?"}`;
+    if (problems.length === 0) {
+      log(`${summary} \u2014 verified`);
+      return;
+    }
+    const detail = `${summary}
+Problems: ${problems.join("; ")}.
+Expected the native overlay driver with the graphroot under the XFS \`/vercel\` cell volume (requires vercel/hive#2310 capabilities + the storage.conf from vercel/api#76567).`;
+    if (strict) {
+      throw new Error(
+        `Container build storage is not configured as intended.
+${detail}`
+      );
+    }
+    log(
+      `${detail}
+Continuing (set VERCEL_VCR_STRICT_STORAGE=1 to fail builds).`
+    );
+  }
+  async readStoreInfo() {
+    const { stdout } = await this.run(["info"], { quiet: true });
+    const store = JSON.parse(stdout).store;
+    if (!store)
+      return void 0;
+    const graphStatus = store.GraphStatus;
+    return {
+      graphRoot: String(store.GraphRoot ?? ""),
+      runRoot: String(store.RunRoot ?? ""),
+      driver: String(store.GraphDriverName ?? ""),
+      backingFs: String(
+        graphStatus?.["Backing Filesystem"] ?? graphStatus?.["Backing filesystem"] ?? ""
+      )
+    };
+  }
+};
+
 // src/buildpacks/build.ts
 var import_node_fs13 = require("fs");
-var import_node_os7 = require("os");
-var import_node_path13 = require("path");
+var import_node_os10 = require("os");
+var import_node_path17 = require("path");
 
 // src/buildpacks/cache.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var import_node_fs4 = require("fs");
-var import_promises = require("fs/promises");
-var import_node_path4 = require("path");
+var import_promises6 = require("fs/promises");
+var import_node_path6 = require("path");
 var BUILDPACK_CACHE_DIR = ".vercel/cache/buildpacks";
 var CNB_COMMITTED_DIR = "committed";
 var CNB_CACHE_METADATA_FILE = "io.buildpacks.lifecycle.cache.metadata";
 var IMAGE_ID_FILE = "image-id";
 function buildpackCacheDir(options) {
-  const root = (0, import_node_path4.resolve)(options.repoRootPath || options.workPath);
-  const app = (0, import_node_path4.relative)(root, (0, import_node_path4.resolve)(options.workPath)).split(import_node_path4.sep).join("/") || ".";
+  const root = (0, import_node_path6.resolve)(options.repoRootPath || options.workPath);
+  const app = (0, import_node_path6.relative)(root, (0, import_node_path6.resolve)(options.workPath)).split(import_node_path6.sep).join("/") || ".";
   const daemon = options.config?.daemon;
   const owner = daemon ? { daemon: daemon.name } : options.service?.name ?? null;
-  const key = (0, import_node_crypto2.createHash)("sha256").update(JSON.stringify([app, owner])).digest("hex").slice(0, 32);
-  return (0, import_node_path4.join)(root, BUILDPACK_CACHE_DIR, key);
+  const key = (0, import_node_crypto4.createHash)("sha256").update(JSON.stringify([app, owner])).digest("hex").slice(0, 32);
+  return (0, import_node_path6.join)(root, BUILDPACK_CACHE_DIR, key);
 }
 async function restoreBuildpackCache(dir, cacheKey, cacheDir) {
-  const committed = (0, import_node_path4.join)(cacheDir, CNB_COMMITTED_DIR);
+  const committed = (0, import_node_path6.join)(cacheDir, CNB_COMMITTED_DIR);
   const [copy, key] = await Promise.allSettled([
     copyCommitted(dir, cacheDir),
     cacheKey
@@ -1267,7 +1492,7 @@ async function restoreBuildpackCache(dir, cacheKey, cacheDir) {
       throw copy.reason;
     if (key.status === "rejected")
       throw key.reason;
-    if (readRegularFile((0, import_node_path4.join)(dir, IMAGE_ID_FILE)) !== key.value) {
+    if (readRegularFile((0, import_node_path6.join)(dir, IMAGE_ID_FILE)) !== key.value) {
       (0, import_node_fs4.rmSync)(committed, { recursive: true, force: true });
       return { status: "miss", reason: "base_image_changed" };
     }
@@ -1282,11 +1507,11 @@ async function restoreBuildpackCache(dir, cacheKey, cacheDir) {
   }
 }
 async function saveBuildpackCache(dir, cacheKey, cacheDir) {
-  const committed = (0, import_node_path4.join)(cacheDir, CNB_COMMITTED_DIR);
+  const committed = (0, import_node_path6.join)(cacheDir, CNB_COMMITTED_DIR);
   let metadata;
   try {
     assertDirectory(committed);
-    metadata = readRegularFile((0, import_node_path4.join)(committed, CNB_CACHE_METADATA_FILE));
+    metadata = readRegularFile((0, import_node_path6.join)(committed, CNB_CACHE_METADATA_FILE));
   } catch (error) {
     const missing = error.code === "ENOENT";
     return {
@@ -1300,7 +1525,7 @@ async function saveBuildpackCache(dir, cacheKey, cacheDir) {
     const bytes = sizeOf(committed);
     (0, import_node_fs4.rmSync)(dir, { recursive: true, force: true });
     await copyCommitted(cacheDir, dir);
-    (0, import_node_fs4.writeFileSync)((0, import_node_path4.join)(dir, IMAGE_ID_FILE), cacheKey);
+    (0, import_node_fs4.writeFileSync)((0, import_node_path6.join)(dir, IMAGE_ID_FILE), cacheKey);
     return { status: "saved", bytes };
   } catch (error) {
     try {
@@ -1312,16 +1537,16 @@ async function saveBuildpackCache(dir, cacheKey, cacheDir) {
 }
 function isSaved(dir, cacheKey, metadata) {
   try {
-    const committed = (0, import_node_path4.join)(dir, CNB_COMMITTED_DIR);
+    const committed = (0, import_node_path6.join)(dir, CNB_COMMITTED_DIR);
     assertDirectory(committed);
-    return readRegularFile((0, import_node_path4.join)(dir, IMAGE_ID_FILE)) === cacheKey && readRegularFile((0, import_node_path4.join)(committed, CNB_CACHE_METADATA_FILE)) === metadata;
+    return readRegularFile((0, import_node_path6.join)(dir, IMAGE_ID_FILE)) === cacheKey && readRegularFile((0, import_node_path6.join)(committed, CNB_CACHE_METADATA_FILE)) === metadata;
   } catch {
     return false;
   }
 }
 async function copyCommitted(from, to) {
-  const source = (0, import_node_path4.join)(from, CNB_COMMITTED_DIR);
-  const target = (0, import_node_path4.join)(to, CNB_COMMITTED_DIR);
+  const source = (0, import_node_path6.join)(from, CNB_COMMITTED_DIR);
+  const target = (0, import_node_path6.join)(to, CNB_COMMITTED_DIR);
   assertDirectory(source);
   (0, import_node_fs4.mkdirSync)(target, { recursive: true });
   const entries = (0, import_node_fs4.readdirSync)(source, { withFileTypes: true });
@@ -1331,9 +1556,9 @@ async function copyCommitted(from, to) {
   }
   const copies = await Promise.allSettled(
     entries.map(
-      (entry) => (0, import_promises.copyFile)(
-        (0, import_node_path4.join)(source, entry.name),
-        (0, import_node_path4.join)(target, entry.name),
+      (entry) => (0, import_promises6.copyFile)(
+        (0, import_node_path6.join)(source, entry.name),
+        (0, import_node_path6.join)(target, entry.name),
         import_node_fs4.constants.COPYFILE_FICLONE
       )
     )
@@ -1344,12 +1569,12 @@ async function copyCommitted(from, to) {
 }
 function assertDirectory(path4) {
   if (!(0, import_node_fs4.lstatSync)(path4).isDirectory()) {
-    throw new Error(`${(0, import_node_path4.basename)(path4)} is not a directory`);
+    throw new Error(`${(0, import_node_path6.basename)(path4)} is not a directory`);
   }
 }
 function readRegularFile(path4) {
   if (!(0, import_node_fs4.lstatSync)(path4).isFile())
-    throw notRegularFile((0, import_node_path4.basename)(path4));
+    throw notRegularFile((0, import_node_path6.basename)(path4));
   return (0, import_node_fs4.readFileSync)(path4, "utf8");
 }
 function notRegularFile(name) {
@@ -1357,25 +1582,13 @@ function notRegularFile(name) {
 }
 function sizeOf(dir) {
   return (0, import_node_fs4.readdirSync)(dir).reduce(
-    (bytes, name) => bytes + (0, import_node_fs4.lstatSync)((0, import_node_path4.join)(dir, name)).size,
+    (bytes, name) => bytes + (0, import_node_fs4.lstatSync)((0, import_node_path6.join)(dir, name)).size,
     0
   );
 }
 function firstLine(error) {
   return error.message.split("\n")[0];
 }
-function formatBytes(bytes) {
-  if (bytes < 1024)
-    return `${bytes} B`;
-  const units = ["KiB", "MiB", "GiB"];
-  let value = bytes / 1024;
-  let unit = 0;
-  while (value >= 1024 && unit < units.length - 1) {
-    value /= 1024;
-    unit += 1;
-  }
-  return `${value.toFixed(value >= 10 ? 0 : 1)} ${units[unit]}`;
-}
 function describeRestore(outcome) {
   return outcome.status === "hit" ? `restored buildpack cache (${formatBytes(outcome.bytes)})` : `no buildpack cache to restore (${outcome.reason})`;
 }
@@ -1406,11 +1619,11 @@ function recordSave(span, outcome, durationMs) {
 }
 
 // src/buildpacks/lifecycle/lifecycle.ts
-var import_build_utils3 = require("@vercel/build-utils");
-var import_node_crypto3 = require("crypto");
+var import_build_utils4 = require("@vercel/build-utils");
+var import_node_crypto5 = require("crypto");
 var import_node_fs5 = require("fs");
-var import_node_os4 = require("os");
-var import_node_path5 = require("path");
+var import_node_os6 = require("os");
+var import_node_path7 = require("path");
 var import_smol_toml = require("smol-toml");
 var import_tar = require("tar");
 
@@ -1561,39 +1774,39 @@ async function stageWorkspace({ files, workPath }, destinationDir) {
   const symlinks = /* @__PURE__ */ new Set();
   for (const [name, file] of Object.entries(files)) {
     const portable = name.replace(/\\/g, "/");
-    const normalized = import_node_path5.posix.normalize(portable).replace(/\/$/, "");
-    if (!normalized || normalized === "." || import_node_path5.win32.isAbsolute(name) || import_node_path5.posix.isAbsolute(portable) || portable.split("/").includes("..") || normalized in staged) {
+    const normalized = import_node_path7.posix.normalize(portable).replace(/\/$/, "");
+    if (!normalized || normalized === "." || import_node_path7.win32.isAbsolute(name) || import_node_path7.posix.isAbsolute(portable) || portable.split("/").includes("..") || normalized in staged) {
       throw new Error(`Invalid buildpack source path ${JSON.stringify(name)}.`);
     }
     staged[normalized] = file;
-    if (!(0, import_build_utils3.isSymbolicLink)(file.mode))
+    if (!(0, import_build_utils4.isSymbolicLink)(file.mode))
       continue;
-    let target = (0, import_build_utils3.getSymlinkTarget)(file);
+    let target = (0, import_build_utils4.getSymlinkTarget)(file);
     if (target === null && file.type === "FileRef") {
-      target = (await (0, import_build_utils3.streamToBuffer)(await file.toStreamAsync())).toString();
+      target = (await (0, import_build_utils4.streamToBuffer)(await file.toStreamAsync())).toString();
     }
     if (!target) {
       throw new Error(`Cannot read buildpack source symlink ${name}.`);
     }
-    if ((0, import_node_path5.isAbsolute)(target)) {
-      target = (0, import_node_path5.relative)((0, import_node_path5.resolve)(workPath, import_node_path5.posix.dirname(normalized)), target) || ".";
-    } else if (import_node_path5.win32.isAbsolute(target)) {
+    if ((0, import_node_path7.isAbsolute)(target)) {
+      target = (0, import_node_path7.relative)((0, import_node_path7.resolve)(workPath, import_node_path7.posix.dirname(normalized)), target) || ".";
+    } else if (import_node_path7.win32.isAbsolute(target)) {
       throw new Error(
         `Buildpack source symlink ${name} has an absolute target.`
       );
     }
     target = target.replace(/\\/g, "/");
-    const resolved = import_node_path5.posix.join(import_node_path5.posix.dirname(normalized), target);
+    const resolved = import_node_path7.posix.join(import_node_path7.posix.dirname(normalized), target);
     if (resolved === ".." || resolved.startsWith("../")) {
       throw new Error(
         `Buildpack source symlink ${name} escapes the service root. Buildpack services must be self-contained.`
       );
     }
-    staged[normalized] = new import_build_utils3.FileBlob({ data: target, mode: file.mode });
+    staged[normalized] = new import_build_utils4.FileBlob({ data: target, mode: file.mode });
     symlinks.add(normalized);
   }
   for (const name of Object.keys(staged)) {
-    for (let parent = import_node_path5.posix.dirname(name); parent !== "."; parent = import_node_path5.posix.dirname(parent)) {
+    for (let parent = import_node_path7.posix.dirname(name); parent !== "."; parent = import_node_path7.posix.dirname(parent)) {
       if (symlinks.has(parent)) {
         throw new Error(
           `Buildpack source ${name} is inside symlink ${parent}.`
@@ -1601,17 +1814,17 @@ async function stageWorkspace({ files, workPath }, destinationDir) {
       }
     }
     const file = staged[name];
-    if (file.type === "FileFsRef" && !(0, import_build_utils3.isSymbolicLink)(file.mode)) {
-      const sourcePath = (0, import_node_path5.resolve)(file.fsPath);
-      const sourceRelative = (0, import_node_path5.relative)((0, import_node_path5.resolve)(workPath), sourcePath);
-      if (sourceRelative.startsWith(`..${import_node_path5.sep}`) || sourceRelative === ".." || (0, import_node_path5.isAbsolute)(sourceRelative)) {
+    if (file.type === "FileFsRef" && !(0, import_build_utils4.isSymbolicLink)(file.mode)) {
+      const sourcePath = (0, import_node_path7.resolve)(file.fsPath);
+      const sourceRelative = (0, import_node_path7.relative)((0, import_node_path7.resolve)(workPath), sourcePath);
+      if (sourceRelative.startsWith(`..${import_node_path7.sep}`) || sourceRelative === ".." || (0, import_node_path7.isAbsolute)(sourceRelative)) {
         continue;
       }
       const sourceRoot = import_node_fs5.realpathSync.native(workPath);
       const sourceTarget = import_node_fs5.realpathSync.native(sourcePath);
-      if (sourceTarget !== (0, import_node_path5.resolve)(sourceRoot, sourceRelative)) {
-        const target = (0, import_node_path5.relative)(sourceRoot, sourceTarget).split(import_node_path5.sep).join("/");
-        if (target === ".." || target.startsWith("../") || (0, import_node_path5.isAbsolute)(target) || !(target in staged)) {
+      if (sourceTarget !== (0, import_node_path7.resolve)(sourceRoot, sourceRelative)) {
+        const target = (0, import_node_path7.relative)(sourceRoot, sourceTarget).split(import_node_path7.sep).join("/");
+        if (target === ".." || target.startsWith("../") || (0, import_node_path7.isAbsolute)(target) || !(target in staged)) {
           throw new Error(
             `Buildpack source ${name} follows a symlink to an excluded or outside-root file. Buildpack services must be self-contained.`
           );
@@ -1619,25 +1832,25 @@ async function stageWorkspace({ files, workPath }, destinationDir) {
       }
     }
   }
-  await (0, import_build_utils3.download)(staged, destinationDir);
+  await (0, import_build_utils4.download)(staged, destinationDir);
   const root = import_node_fs5.realpathSync.native(destinationDir);
   for (const name of symlinks) {
     let target;
     try {
-      target = (0, import_node_path5.relative)(root, import_node_fs5.realpathSync.native((0, import_node_path5.join)(destinationDir, name)));
+      target = (0, import_node_path7.relative)(root, import_node_fs5.realpathSync.native((0, import_node_path7.join)(destinationDir, name)));
     } catch {
       throw new Error(
         `Buildpack source symlink ${name} has no target in the staged service.`
       );
     }
-    if (target === ".." || target.startsWith(`..${import_node_path5.sep}`) || (0, import_node_path5.isAbsolute)(target)) {
+    if (target === ".." || target.startsWith(`..${import_node_path7.sep}`) || (0, import_node_path7.isAbsolute)(target)) {
       throw new Error(
         `Buildpack source symlink ${name} escapes the staged service.`
       );
     }
   }
 }
-function writePlatformEnvDir(buildEnv, config, parentDir = (0, import_node_os4.tmpdir)()) {
+function writePlatformEnvDir(buildEnv, config, parentDir = (0, import_node_os6.tmpdir)()) {
   const environment = { ...buildEnv };
   delete environment.VERCEL_NODE_HOME;
   delete environment.VERCEL_ENTRYPOINT;
@@ -1651,14 +1864,14 @@ function writePlatformEnvDir(buildEnv, config, parentDir = (0, import_node_os4.t
   if (config.command) {
     environment.VERCEL_COMMAND = JSON.stringify(config.command);
   }
-  const dir = (0, import_node_fs5.mkdtempSync)((0, import_node_path5.join)(parentDir, "vercel-cnb-env-"));
+  const dir = (0, import_node_fs5.mkdtempSync)((0, import_node_path7.join)(parentDir, "vercel-cnb-env-"));
   (0, import_node_fs5.chmodSync)(dir, 493);
   for (const [key, value] of Object.entries(environment)) {
     if (!ENV_NAME_RE.test(key)) {
       debug(`skipping build env var with an unsupported name: ${key}`);
       continue;
     }
-    const file = (0, import_node_path5.join)(dir, key);
+    const file = (0, import_node_path7.join)(dir, key);
     (0, import_node_fs5.writeFileSync)(file, value);
     (0, import_node_fs5.chmodSync)(file, 420);
   }
@@ -1723,7 +1936,7 @@ function lifecycleFailure(error, context) {
     { exitCode }
   );
 }
-function writeOrderDir(buildpack, parentDir = (0, import_node_os4.tmpdir)()) {
+function writeOrderDir(buildpack, parentDir = (0, import_node_os6.tmpdir)()) {
   const order = {
     order: [
       {
@@ -1734,9 +1947,9 @@ function writeOrderDir(buildpack, parentDir = (0, import_node_os4.tmpdir)()) {
       }
     ]
   };
-  const dir = (0, import_node_fs5.mkdtempSync)((0, import_node_path5.join)(parentDir, "vercel-cnb-order-"));
+  const dir = (0, import_node_fs5.mkdtempSync)((0, import_node_path7.join)(parentDir, "vercel-cnb-order-"));
   (0, import_node_fs5.chmodSync)(dir, 493);
-  const file = (0, import_node_path5.join)(dir, "order.toml");
+  const file = (0, import_node_path7.join)(dir, "order.toml");
   (0, import_node_fs5.writeFileSync)(file, (0, import_smol_toml.stringify)(order));
   (0, import_node_fs5.chmodSync)(file, 420);
   return dir;
@@ -1765,7 +1978,7 @@ async function downloadPinnedArchive(archive, destinationPath) {
     );
   }
   const contents = new Uint8Array(await response.arrayBuffer());
-  const checksum = (0, import_node_crypto3.createHash)("sha256").update(contents).digest("hex");
+  const checksum = (0, import_node_crypto5.createHash)("sha256").update(contents).digest("hex");
   if (checksum !== archive.sha256) {
     throw new Error(
       `Checksum mismatch for ${archiveName(archive)}: expected ${archive.sha256}, received ${checksum}.`
@@ -1774,7 +1987,7 @@ async function downloadPinnedArchive(archive, destinationPath) {
   (0, import_node_fs5.writeFileSync)(destinationPath, contents);
 }
 async function fetchPinnedArchive(archive, destinationDir) {
-  const archivePath = (0, import_node_path5.join)(destinationDir, `${archive.sha256}.tgz`);
+  const archivePath = (0, import_node_path7.join)(destinationDir, `${archive.sha256}.tgz`);
   try {
     await downloadPinnedArchive(archive, archivePath);
     (0, import_tar.extract)({ file: archivePath, cwd: destinationDir, sync: true });
@@ -1791,16 +2004,16 @@ function blobPath(layoutDir, digest) {
   if (!match) {
     throw new Error(`Unsupported OCI digest ${JSON.stringify(digest)}.`);
   }
-  return (0, import_node_path5.join)(layoutDir, "blobs", "sha256", match[1]);
+  return (0, import_node_path7.join)(layoutDir, "blobs", "sha256", match[1]);
 }
 async function fetchBuildpackage(archive, cnbDir) {
-  const layoutDir = (0, import_node_fs5.mkdtempSync)((0, import_node_path5.join)((0, import_node_os4.tmpdir)(), "vercel-cnb-buildpackage-"));
-  const archivePath = (0, import_node_path5.join)(layoutDir, "buildpackage.cnb");
+  const layoutDir = (0, import_node_fs5.mkdtempSync)((0, import_node_path7.join)((0, import_node_os6.tmpdir)(), "vercel-cnb-buildpackage-"));
+  const archivePath = (0, import_node_path7.join)(layoutDir, "buildpackage.cnb");
   try {
     await downloadPinnedArchive(archive, archivePath);
     await (0, import_tar.extract)({ file: archivePath, cwd: layoutDir });
     const index = readOciJson(
-      (0, import_node_path5.join)(layoutDir, "index.json")
+      (0, import_node_path7.join)(layoutDir, "index.json")
     );
     const name = archiveName(archive);
     const manifestDigest = index.manifests?.[0]?.digest;
@@ -1822,7 +2035,7 @@ async function fetchBuildpackage(archive, cnbDir) {
         );
       }
       const layerPath = blobPath(layoutDir, layer.digest);
-      const actual = (0, import_node_crypto3.createHash)("sha256").update(new Uint8Array((0, import_node_fs5.readFileSync)(layerPath))).digest("hex");
+      const actual = (0, import_node_crypto5.createHash)("sha256").update(new Uint8Array((0, import_node_fs5.readFileSync)(layerPath))).digest("hex");
       if (`sha256:${actual}` !== layer.digest) {
         throw new Error(
           `${name} layer ${layer.digest} hashes to sha256:${actual}.`
@@ -1859,14 +2072,14 @@ async function fetchDistribution(buildpack, cnbDir) {
     )
   ]);
   for (const entry of buildpack.buildpacks) {
-    const directory = (0, import_node_path5.join)(
+    const directory = (0, import_node_path7.join)(
       cnbDir,
       "buildpacks",
       entry.id.replace("/", "_"),
       entry.version
     );
     for (const file of ["buildpack.toml", "bin/detect", "bin/build"]) {
-      if (!(0, import_node_fs5.statSync)((0, import_node_path5.join)(directory, file), { throwIfNoEntry: false })?.isFile()) {
+      if (!(0, import_node_fs5.statSync)((0, import_node_path7.join)(directory, file), { throwIfNoEntry: false })?.isFile()) {
         throw new Error(
           `Buildpack ${entry.id}@${entry.version} is missing ${file}.`
         );
@@ -1891,20 +2104,113 @@ function creatorArgs(image, imageRef, options = {}) {
 
 // src/buildpacks/lifecycle/buildah.ts
 var import_node_fs6 = require("fs");
-var import_node_crypto4 = require("crypto");
-var import_node_os5 = require("os");
-var import_node_path6 = require("path");
-async function removeContainerInBackground(name) {
+var import_node_crypto6 = require("crypto");
+var import_node_os8 = require("os");
+var import_node_path10 = require("path");
+
+// src/buildah-store-cache/cleanup.ts
+var import_node_child_process3 = require("child_process");
+
+// src/buildah-store-cache/command/index.ts
+var import_node_path8 = require("path");
+var STORE_COMMAND_SCRIPT = (0, import_node_path8.join)(__dirname, "buildah-store-command.js");
+function storeCommand(request, script = STORE_COMMAND_SCRIPT) {
+  return [process.execPath, script, JSON.stringify(request)];
+}
+async function runStoreCommand(request, lock) {
+  const [command, ...args] = lock.exclusive(storeCommand(request));
+  const { stdout } = await run(command, args, { quiet: true });
+  return JSON.parse(stdout);
+}
+
+// src/buildah-store-cache/lock.ts
+var import_node_os7 = require("os");
+var import_node_path9 = require("path");
+var FileLock = class {
+  constructor(path4) {
+    this.path = path4;
+  }
+  shared(command) {
+    return this.wrap("--shared", command);
+  }
+  exclusive(command) {
+    return this.wrap("--exclusive", command);
+  }
+  wrap(mode, command) {
+    return ["flock", mode, "--close", this.path, ...command];
+  }
+};
+var flockAvailable;
+async function buildahStoreLock() {
+  if (!buildahStoreCacheEnabled()) {
+    return void 0;
+  }
+  flockAvailable ??= hasCommand("flock");
+  return await flockAvailable ? new FileLock((0, import_node_path9.join)((0, import_node_os7.tmpdir)(), "vercel-buildah-store.lock")) : void 0;
+}
+var sharedBuildahStoreLock = {
+  async wrap(command) {
+    const lock = await buildahStoreLock();
+    return lock ? lock.shared(command) : command;
+  }
+};
+
+// src/buildah-store-cache/cleanup.ts
+async function startContainerCleanup(name) {
+  const rmArgs = [...await buildahStorageArgs(), "rm", name];
+  debug(`exec in the background: buildah ${rmArgs.join(" ")}`);
+  const start = Date.now();
+  const [command, ...commandArgs] = await cleanupCommand(name, rmArgs);
+  const child = (0, import_node_child_process3.spawn)(command, commandArgs, {
+    detached: true,
+    stdio: "ignore"
+  });
+  child.on(
+    "error",
+    (error) => debug(`background buildah rm failed: ${error.message}`)
+  );
+  child.on(
+    "exit",
+    (code) => debug(
+      `background buildah rm exited with code ${code} after ${Date.now() - start}ms`
+    )
+  );
+  child.unref();
+}
+async function cleanupCommand(container, buildahArgs) {
+  const record = await recordPendingCleanup(container);
+  return sharedBuildahStoreLock.wrap(
+    record ? storeCommand({ action: "cleanup", options: { record, buildahArgs } }) : ["buildah", ...buildahArgs]
+  );
+}
+async function recordPendingCleanup(container) {
+  if (!buildahStoreCacheEnabled()) {
+    return void 0;
+  }
+  try {
+    if (!CLEANUP_CONTAINER_RE.test(container)) {
+      throw new Error("invalid Buildah cleanup container");
+    }
+    return await writeStateRecord(".cleanup", `${container}
+`);
+  } catch (error) {
+    debug(`could not record Buildah cleanup: ${error.message}`);
+    return void 0;
+  }
+}
+
+// src/buildpacks/lifecycle/buildah.ts
+async function cleanUpBuildContainer(name) {
   try {
-    await startBuildahInBackground(["rm", name]);
+    await startContainerCleanup(name);
   } catch (error) {
     debug(
-      `could not remove Buildah CNB container ${name}: ${error.message}`
+      `could not clean up Buildah CNB container ${name}: ${error.message}`
     );
   }
 }
-async function inspectBaseImageId(container) {
-  const { stdout } = await runBuildah(
+async function inspectBaseImageId(container, client) {
+  const { stdout } = await client.run(
     ["inspect", "--type", "container", container],
     { quiet: true }
   );
@@ -1929,14 +2235,14 @@ function cacheScratchParent() {
       );
     }
   }
-  return (0, import_node_os5.tmpdir)();
+  return (0, import_node_os8.tmpdir)();
 }
 function chownTree(root, uid, gid) {
   const stat = (0, import_node_fs6.lstatSync)(root);
   if (stat.isDirectory()) {
     (0, import_node_fs6.chmodSync)(root, 493);
     for (const entry of (0, import_node_fs6.readdirSync)(root)) {
-      chownTree((0, import_node_path6.join)(root, entry), uid, gid);
+      chownTree((0, import_node_path10.join)(root, entry), uid, gid);
     }
   } else if (stat.isFile()) {
     (0, import_node_fs6.chmodSync)(root, 420);
@@ -1949,12 +2255,13 @@ var RegistrySetupFailure = class extends Error {
     this.reason = reason;
   }
 };
-async function prepareBuildContainer(buildContainer, buildpack, params) {
+async function prepareBuildContainer(buildContainer, buildpack, params, client) {
   const start = Date.now();
   step(
     `Preparing ${buildpack.runtime} ${params.image.version} stock image and Vercel buildpacks`
   );
-  await runBuildah([
+  const usage = await BuildahImageUsage.begin();
+  await client.run([
     "from",
     "--pull=always",
     "--platform",
@@ -1963,7 +2270,10 @@ async function prepareBuildContainer(buildContainer, buildpack, params) {
     buildContainer,
     params.image.buildImage
   ]);
-  await runBuildah([
+  await usage?.record(async () => [
+    await inspectBaseImageId(buildContainer, client)
+  ]);
+  await client.run([
     "run",
     "--network",
     "host",
@@ -1973,7 +2283,7 @@ async function prepareBuildContainer(buildContainer, buildpack, params) {
     "-c",
     `groupadd -g ${BUILD_GROUP_ID} cnb && useradd -m -u ${BUILD_USER_ID} -g ${BUILD_GROUP_ID} cnb && mkdir -p /layers /platform /workspace && chown -R ${BUILD_USER} /layers /platform /workspace /home/cnb`
   ]);
-  await runBuildah([
+  await client.run([
     "copy",
     "--chown",
     BUILD_USER,
@@ -1989,17 +2299,17 @@ async function fetchDistributionTimed(buildpack, cnbDir) {
   await fetchDistribution(buildpack, cnbDir);
   done(`fetched the CNB lifecycle and buildpacks in ${elapsed(start)}`);
 }
-async function copySavedCache(dir, buildContainer, containerReady) {
+async function copySavedCache(dir, buildContainer, containerReady, client) {
   const start = Date.now();
   step("Restoring the buildpack cache");
   let scratch;
   try {
-    scratch = (0, import_node_fs6.mkdtempSync)((0, import_node_path6.join)(cacheScratchParent(), "vercel-cnb-cache-"));
+    scratch = (0, import_node_fs6.mkdtempSync)((0, import_node_path10.join)(cacheScratchParent(), "vercel-cnb-cache-"));
     (0, import_node_fs6.chmodSync)(scratch, 493);
-    const cacheDir = (0, import_node_path6.join)(scratch, "cache");
+    const cacheDir = (0, import_node_path10.join)(scratch, "cache");
     (0, import_node_fs6.mkdirSync)(cacheDir, { mode: 493 });
     const imageId = containerReady.then(
-      () => inspectBaseImageId(buildContainer)
+      () => inspectBaseImageId(buildContainer, client)
     );
     const restored = await restoreBuildpackCache(dir, imageId, cacheDir);
     const baseImageId = await imageId;
@@ -2025,7 +2335,7 @@ async function copySavedCache(dir, buildContainer, containerReady) {
     };
   }
 }
-async function buildAndPushWithLifecycle(buildpack, params, span) {
+async function buildAndPushWithLifecycle(buildpack, params, client, span) {
   const urls = distributionUrls(buildpack);
   return withSpan(
     span,
@@ -2041,20 +2351,20 @@ async function buildAndPushWithLifecycle(buildpack, params, span) {
       "image.ref": params.imageRef
     },
     async (lifecycleSpan) => {
-      const suffix = `${process.pid}-${(0, import_node_crypto4.randomBytes)(4).toString("hex")}`;
+      const suffix = `${process.pid}-${(0, import_node_crypto6.randomBytes)(4).toString("hex")}`;
       const buildContainer = `vercel-cnb-${buildpack.runtime}-${suffix}`;
       let cnbDir;
       let reportDir;
       let orderDir;
       let platformEnvDir;
       let cacheScratch;
-      let containerRemoval;
+      let containerCleanup;
       try {
-        reportDir = (0, import_node_fs6.mkdtempSync)((0, import_node_path6.join)((0, import_node_os5.tmpdir)(), "vercel-cnb-report-"));
-        const reportPath = (0, import_node_path6.join)(reportDir, "report.toml");
+        reportDir = (0, import_node_fs6.mkdtempSync)((0, import_node_path10.join)((0, import_node_os8.tmpdir)(), "vercel-cnb-report-"));
+        const reportPath = (0, import_node_path10.join)(reportDir, "report.toml");
         (0, import_node_fs6.chownSync)(reportDir, BUILD_USER_ID, BUILD_GROUP_ID);
         (0, import_node_fs6.chmodSync)(reportDir, 493);
-        cnbDir = (0, import_node_fs6.mkdtempSync)((0, import_node_path6.join)((0, import_node_os5.tmpdir)(), "vercel-cnb-"));
+        cnbDir = (0, import_node_fs6.mkdtempSync)((0, import_node_path10.join)((0, import_node_os8.tmpdir)(), "vercel-cnb-"));
         (0, import_node_fs6.chmodSync)(cnbDir, 493);
         orderDir = writeOrderDir(buildpack);
         platformEnvDir = writePlatformEnvDir(params.buildEnv, {
@@ -2066,13 +2376,19 @@ async function buildAndPushWithLifecycle(buildpack, params, span) {
         const containerReady = prepareBuildContainer(
           buildContainer,
           buildpack,
-          params
+          params,
+          client
         );
         const [registry, container, distribution2, cacheCopy] = await Promise.allSettled([
           registrySetup,
           containerReady,
           fetchDistributionTimed(buildpack, cnbDir),
-          params.cache ? copySavedCache(params.cache.dir, buildContainer, containerReady) : void 0
+          params.cache ? copySavedCache(
+            params.cache.dir,
+            buildContainer,
+            containerReady,
+            client
+          ) : void 0
         ]);
         const copy = cacheCopy.status === "fulfilled" ? cacheCopy.value : void 0;
         cacheScratch = copy?.scratch;
@@ -2105,7 +2421,7 @@ async function buildAndPushWithLifecycle(buildpack, params, span) {
         step(
           `Building and publishing ${params.imageRef} via Vercel ${buildpack.runtime} buildpacks`
         );
-        await runBuildah(
+        await client.run(
           [
             "run",
             "--network",
@@ -2142,7 +2458,7 @@ async function buildAndPushWithLifecycle(buildpack, params, span) {
           ],
           { env: lifecycleEnv }
         );
-        containerRemoval = removeContainerInBackground(buildContainer);
+        containerCleanup = cleanUpBuildContainer(buildContainer);
         const digest = readReportDigest((0, import_node_fs6.readFileSync)(reportPath, "utf8"));
         if (!digest) {
           throw new Error(
@@ -2179,7 +2495,7 @@ async function buildAndPushWithLifecycle(buildpack, params, span) {
           span: lifecycleSpan
         });
       } finally {
-        containerRemoval ??= removeContainerInBackground(buildContainer);
+        containerCleanup ??= cleanUpBuildContainer(buildContainer);
         for (const dir of [
           cnbDir,
           reportDir,
@@ -2195,17 +2511,17 @@ async function buildAndPushWithLifecycle(buildpack, params, span) {
             }
           }
         }
-        await containerRemoval;
+        await containerCleanup;
       }
     }
   );
 }
 
 // src/buildpacks/lifecycle/docker.ts
-var import_node_crypto5 = require("crypto");
+var import_node_crypto7 = require("crypto");
 var import_node_fs7 = require("fs");
-var import_node_os6 = require("os");
-var import_node_path7 = require("path");
+var import_node_os9 = require("os");
+var import_node_path11 = require("path");
 function localBuildImageDockerfile(buildImage, nodeMajor) {
   const lines = [];
   if (nodeMajor !== void 0) {
@@ -2224,7 +2540,7 @@ function localBuildImageDockerfile(buildImage, nodeMajor) {
 `;
 }
 function localBuildImageTag(dockerfile) {
-  const hash = (0, import_node_crypto5.createHash)("sha256").update(dockerfile).digest("hex");
+  const hash = (0, import_node_crypto7.createHash)("sha256").update(dockerfile).digest("hex");
   return `vercel-cnb-build:${hash.slice(0, 16)}`;
 }
 async function runDocker2(args, opts = {}) {
@@ -2250,8 +2566,8 @@ var buildAndPushWithLifecycleDocker = async (buildpack, params, span) => {
       let stageDir;
       const containers = [];
       try {
-        stageDir = (0, import_node_fs7.mkdtempSync)((0, import_node_path7.join)((0, import_node_os6.tmpdir)(), "vercel-cnb-"));
-        const cnbDir = (0, import_node_path7.join)(stageDir, "cnb");
+        stageDir = (0, import_node_fs7.mkdtempSync)((0, import_node_path11.join)((0, import_node_os9.tmpdir)(), "vercel-cnb-"));
+        const cnbDir = (0, import_node_path11.join)(stageDir, "cnb");
         (0, import_node_fs7.mkdirSync)(cnbDir, { mode: 493 });
         const orderDir = writeOrderDir(buildpack, stageDir);
         const platformEnvDir = writePlatformEnvDir(
@@ -2271,7 +2587,7 @@ var buildAndPushWithLifecycleDocker = async (buildpack, params, span) => {
           params.nodeToolchain?.major
         );
         const buildImageTag = localBuildImageTag(dockerfile);
-        const buildImageIdPath = (0, import_node_path7.join)(stageDir, "build-image.id");
+        const buildImageIdPath = (0, import_node_path11.join)(stageDir, "build-image.id");
         step(
           `Preparing ${buildpack.runtime} ${params.image.version} build image` + (params.nodeToolchain ? ` with Node.js ${params.nodeToolchain.major}` : "")
         );
@@ -2293,7 +2609,7 @@ var buildAndPushWithLifecycleDocker = async (buildpack, params, span) => {
         if (!/^sha256:[a-f0-9]{64}$/.test(buildImageId)) {
           throw new Error("Docker build did not report a valid image ID.");
         }
-        const containerName = `vercel-cnb-${buildpack.runtime}-${process.pid}-${(0, import_node_crypto5.randomBytes)(8).toString("hex")}`;
+        const containerName = `vercel-cnb-${buildpack.runtime}-${process.pid}-${(0, import_node_crypto7.randomBytes)(8).toString("hex")}`;
         const initContainerName = `${containerName}-init`;
         containers.push(initContainerName);
         await runDocker2([
@@ -2377,7 +2693,7 @@ var buildAndPushWithLifecycleDocker = async (buildpack, params, span) => {
           `Building and publishing ${params.imageRef} via Vercel ${buildpack.runtime} buildpacks`
         );
         await runDocker2(["start", "--attach", containerName]);
-        const reportPath = (0, import_node_path7.join)(stageDir, "report.toml");
+        const reportPath = (0, import_node_path11.join)(stageDir, "report.toml");
         await runDocker2([
           "cp",
           `${containerName}:/platform-output/report.toml`,
@@ -2431,15 +2747,15 @@ var buildAndPushWithLifecycleDocker = async (buildpack, params, span) => {
 };
 
 // src/buildpacks/node-toolchain.ts
-var import_build_utils4 = require("@vercel/build-utils");
+var import_build_utils5 = require("@vercel/build-utils");
 var import_node_fs8 = require("fs");
-var import_node_path8 = require("path");
+var import_node_path12 = require("path");
 async function selectNodeMajor(workPath, config, meta) {
-  if (!(0, import_node_fs8.existsSync)((0, import_node_path8.join)(workPath, "package.json"))) {
+  if (!(0, import_node_fs8.existsSync)((0, import_node_path12.join)(workPath, "package.json"))) {
     return void 0;
   }
-  const version2 = await (0, import_build_utils4.getNodeVersion)(workPath, void 0, config, meta);
-  if ((0, import_build_utils4.isBunVersion)(version2)) {
+  const version2 = await (0, import_build_utils5.getNodeVersion)(workPath, void 0, config, meta);
+  if ((0, import_build_utils5.isBunVersion)(version2)) {
     throw new Error(
       "Buildpack asset builds require Node.js. Bun is not supported yet; configure engines.node or use Dockerfile.vercel."
     );
@@ -2456,7 +2772,7 @@ async function resolveNodeToolchain(workPath, config, meta) {
     return void 0;
   }
   for (const executable of ["node", "npm"]) {
-    if (!(0, import_node_fs8.existsSync)((0, import_node_path8.join)(toolchain.home, "bin", executable))) {
+    if (!(0, import_node_fs8.existsSync)((0, import_node_path12.join)(toolchain.home, "bin", executable))) {
       throw new Error(
         `The selected Node.js ${toolchain.version} installation is missing ${toolchain.home}/bin/${executable} in the build environment.`
       );
@@ -2470,11 +2786,11 @@ async function resolveLocalNodeToolchain(workPath, config, meta) {
 
 // src/buildpacks/registry.ts
 var import_node_fs12 = require("fs");
-var import_node_path12 = require("path");
+var import_node_path16 = require("path");
 
 // src/buildpacks/go.ts
 var import_node_fs9 = require("fs");
-var import_node_path9 = require("path");
+var import_node_path13 = require("path");
 var DEFAULT_GO_VERSION = "1";
 var GO_IMAGE_REPOSITORY = "docker.io/library/golang";
 var GO_BUILD_IMAGE_DISTRO = "bookworm";
@@ -2503,7 +2819,7 @@ function compareImageVersions(a, b) {
   return a.parts[0] - b.parts[0] || a.parts[1] - b.parts[1] || a.parts[2] - b.parts[2];
 }
 function selectGoVersion(workPath) {
-  const goMod = (0, import_node_path9.join)(workPath, "go.mod");
+  const goMod = (0, import_node_path13.join)(workPath, "go.mod");
   if (!(0, import_node_fs9.existsSync)(goMod))
     return DEFAULT_GO_VERSION;
   const contents = (0, import_node_fs9.readFileSync)(goMod, "utf8");
@@ -2528,10 +2844,10 @@ var go = {
   },
   defaultEntrypoint({ workPath, zeroConfig }) {
     const candidate = GO_CANDIDATE_ENTRYPOINTS.find(
-      (name) => (0, import_node_fs9.existsSync)((0, import_node_path9.join)(workPath, name))
+      (name) => (0, import_node_fs9.existsSync)((0, import_node_path13.join)(workPath, name))
     );
     if (candidate)
-      return import_node_path9.posix.dirname(candidate);
+      return import_node_path13.posix.dirname(candidate);
     if (zeroConfig) {
       const last = GO_CANDIDATE_ENTRYPOINTS.length - 1;
       throw new Error(
@@ -2544,7 +2860,7 @@ var go = {
 
 // src/buildpacks/ruby.ts
 var import_node_fs10 = require("fs");
-var import_node_path10 = require("path");
+var import_node_path14 = require("path");
 var import_smol_toml2 = require("smol-toml");
 
 // src/buildpacks/version.ts
@@ -2576,7 +2892,7 @@ var ruby = {
     return { version: version2, buildImage: image, runImage: image };
   },
   validate({ workPath, buildEnv }) {
-    const gemfile = (0, import_node_path10.join)(workPath, "Gemfile");
+    const gemfile = (0, import_node_path14.join)(workPath, "Gemfile");
     if (!(0, import_node_fs10.existsSync)(gemfile))
       return;
     if (!GEMFILE_RAILS_GEM_RE.test((0, import_node_fs10.readFileSync)(gemfile, "utf8")))
@@ -2590,12 +2906,12 @@ var ruby = {
 };
 function selectRubyVersion(workPath) {
   for (const name of RUBY_VERSION_FILES) {
-    const file = (0, import_node_path10.join)(workPath, name);
+    const file = (0, import_node_path14.join)(workPath, name);
     if ((0, import_node_fs10.existsSync)(file)) {
       return parseVersionFile(name, (0, import_node_fs10.readFileSync)(file, "utf8"));
     }
   }
-  const gemfile = (0, import_node_path10.join)(workPath, "Gemfile");
+  const gemfile = (0, import_node_path14.join)(workPath, "Gemfile");
   return (0, import_node_fs10.existsSync)(gemfile) ? parseGemfileRubyVersion((0, import_node_fs10.readFileSync)(gemfile, "utf8")) : void 0;
 }
 function parseVersionFile(name, contents) {
@@ -2634,7 +2950,7 @@ function parseGemfileRubyVersion(contents) {
 
 // src/buildpacks/rust.ts
 var import_node_fs11 = require("fs");
-var import_node_path11 = require("path");
+var import_node_path15 = require("path");
 var import_smol_toml3 = require("smol-toml");
 var DEFAULT_RUST_VERSION = "1";
 var RUST_IMAGE_REPOSITORY = "docker.io/library/rust";
@@ -2654,12 +2970,12 @@ var rust = {
     };
   },
   defaultEntrypoint({ workPath, zeroConfig }) {
-    return zeroConfig && (0, import_node_fs11.existsSync)((0, import_node_path11.join)(workPath, "src/main.rs")) ? "src/main.rs" : void 0;
+    return zeroConfig && (0, import_node_fs11.existsSync)((0, import_node_path15.join)(workPath, "src/main.rs")) ? "src/main.rs" : void 0;
   }
 };
 function selectRustVersion(workPath) {
   for (const name of RUST_TOOLCHAIN_FILES) {
-    const file = (0, import_node_path11.join)(workPath, name);
+    const file = (0, import_node_path15.join)(workPath, name);
     if ((0, import_node_fs11.existsSync)(file)) {
       const channel = parseToolchainFile(name, (0, import_node_fs11.readFileSync)(file, "utf8"));
       return channel !== void 0 && isValidVersion(channel) ? channel : void 0;
@@ -2705,7 +3021,7 @@ function requestedBuildpack(config) {
 }
 function hasProjectMarkers(buildpack, workPath) {
   return buildpack.projectMarkers.some(
-    (name) => (0, import_node_fs12.existsSync)((0, import_node_path12.join)(workPath, name))
+    (name) => (0, import_node_fs12.existsSync)((0, import_node_path16.join)(workPath, name))
   );
 }
 
@@ -2719,11 +3035,12 @@ function selectEntrypoint(params, sourceDir) {
   return fromEnv ?? params.buildpack.defaultEntrypoint?.({ workPath: sourceDir, zeroConfig });
 }
 async function buildAndPushBuildpack(params) {
-  const sourceDir = (0, import_node_fs13.mkdtempSync)((0, import_node_path13.join)((0, import_node_os7.tmpdir)(), "vercel-cnb-source-"));
+  const sourceDir = (0, import_node_fs13.mkdtempSync)((0, import_node_path17.join)((0, import_node_os10.tmpdir)(), "vercel-cnb-source-"));
   try {
     step("Staging buildpack source files");
     await stageWorkspace(params, sourceDir);
-    const engine = selectContainerEngine();
+    const { buildahClient } = params;
+    const engine = selectContainerEngine(buildahClient);
     if (!hasProjectMarkers(params.buildpack, sourceDir)) {
       throw new Error(
         `The ${params.buildpack.runtime} buildpack was selected, but no supported project marker was found in the service sources. Add ${params.buildpack.projectMarkers.join(" or ")}, or add a Dockerfile.vercel to control the image build.`
@@ -2840,6 +3157,7 @@ async function buildAndPushBuildpack(params) {
             result = await buildAndPushWithLifecycle(
               buildpack,
               { ...lifecycleParams, prepareRegistry },
+              buildahClient,
               buildSpan
             );
           } else {
@@ -2871,7 +3189,7 @@ async function buildAndPushBuildpack(params) {
 
 // src/image-source.ts
 var import_node_fs14 = require("fs");
-var import_node_path14 = __toESM(require("path"));
+var import_node_path18 = __toESM(require("path"));
 var DETECT_SENTINEL = "<detect>";
 function resolveImageSource(options, context) {
   const { config, workPath, entrypoint } = options;
@@ -2888,7 +3206,7 @@ function resolveImageSource(options, context) {
   }
   const dockerfileConfigured = entrypointRef && isDockerfileRef(entrypointRef) ? entrypointRef : findDockerfile(workPath);
   const dockerfileRel = dockerfileConfigured ?? "Dockerfile";
-  const dockerfilePath = import_node_path14.default.join(workPath, dockerfileRel);
+  const dockerfilePath = import_node_path18.default.join(workPath, dockerfileRel);
   const hasDockerfile = dockerfileConfigured !== void 0 || !buildpack && (0, import_node_fs14.existsSync)(dockerfilePath);
   if (hasDockerfile) {
     return { kind: "dockerfile", dockerfileRel, dockerfilePath };
@@ -2905,11 +3223,252 @@ function resolveImageSource(options, context) {
   );
 }
 
+// src/buildah-store-cache/cache.ts
+var import_build_utils6 = require("@vercel/build-utils");
+var import_node_crypto8 = require("crypto");
+var import_promises7 = require("fs/promises");
+var import_node_os11 = require("os");
+var import_node_path19 = require("path");
+var BUILDAH_STORE_CACHE_DIR = ".vercel/cache/buildah-store";
+var STORE_PATHS = {
+  graphRoot: BUILDAH_GRAPH_ROOT,
+  // Buildah's default when running as root, as it does in the build container.
+  blobInfoCache: "/var/lib/containers/cache/blob-info-cache-v1.sqlite"
+};
+var BuildahStoreCache = class _BuildahStoreCache {
+  constructor(repositoryRoot, client) {
+    this.repositoryRoot = repositoryRoot;
+    this.client = client;
+  }
+  static forProject(options, client) {
+    return new _BuildahStoreCache(
+      (0, import_node_path19.resolve)(options.repoRootPath || options.workPath),
+      client
+    );
+  }
+  /**
+   * From `build()`, before a Buildah service opens the store or reads its build
+   * context. A service that builds nothing leaves the snapshot for a later
+   * deployment.
+   */
+  async beforeBuild(options) {
+    if (!isBuildContainer()) {
+      return;
+    }
+    if (buildahStoreCacheEnabled()) {
+      if (options.buildsWithBuildah) {
+        await this.restore(options.span);
+      }
+      return;
+    }
+    if (buildahStoreCacheRequested()) {
+      info("Buildah store cache disabled: VERCEL_DEPLOYMENT_ID is not set");
+    }
+    await this.removeSnapshots();
+  }
+  /** From `prepareCache`, which the platform runs once every service has built. */
+  async afterBuilds() {
+    if (!isBuildContainer()) {
+      return {};
+    }
+    if (buildahStoreCacheEnabled()) {
+      return this.save();
+    }
+    await this.removeSnapshots();
+    return {};
+  }
+  async restore(span) {
+    const start = Date.now();
+    step("Restoring the Buildah store cache");
+    let result = "miss";
+    let reason;
+    let bytes = 0;
+    try {
+      const archive = await this.archivePath({ create: false });
+      const restored = await restoreStore(archive);
+      result = restored.status;
+      if (restored.status === "hit")
+        bytes = restored.bytes;
+      if (restored.status === "miss")
+        reason = restored.reason;
+    } catch (error) {
+      result = "miss";
+      reason = failureReason(error);
+    }
+    await this.removeSnapshots();
+    const restoredBytes = result === "hit" ? bytes : 0;
+    const detail = reason ?? (result === "hit" ? formatBytes(restoredBytes) : void 0);
+    done(
+      `Buildah store cache: ${result}${detail ? ` (${detail})` : ""} in ${elapsed(start)}`
+    );
+    span?.setAttributes({
+      "container.buildah_store.restore": result,
+      "container.buildah_store.restore_ms": String(Date.now() - start),
+      "container.buildah_store.restore_bytes": String(restoredBytes),
+      "container.buildah_store.miss_reason": reason
+    });
+  }
+  async save() {
+    const start = Date.now();
+    step("Saving the Buildah store cache");
+    try {
+      const archive = await this.archivePath({ create: true });
+      const saved = await saveStore(archive);
+      done(await describeSave2(saved, archive, start));
+      if (!await isRegularFile(archive)) {
+        return {};
+      }
+      return await (0, import_build_utils6.glob)(
+        `${BUILDAH_STORE_CACHE_DIR}/${(0, import_node_path19.basename)(archive)}`,
+        this.repositoryRoot
+      );
+    } catch (error) {
+      done(`Buildah store cache not saved (${failureReason(error)})`);
+      return {};
+    }
+  }
+  async removeSnapshots() {
+    try {
+      await (0, import_promises7.rm)(await this.snapshotDirectory({ create: false }), {
+        recursive: true,
+        force: true
+      });
+    } catch (error) {
+      debug(
+        `could not remove Buildah store snapshots: ${failureReason(error)}`
+      );
+    }
+  }
+  async archivePath(options) {
+    const key = await snapshotKey(this.client);
+    return (0, import_node_path19.join)(await this.snapshotDirectory(options), `store-${key}.tar.zst`);
+  }
+  async snapshotDirectory({
+    create
+  }) {
+    const root = await (0, import_promises7.realpath)(this.repositoryRoot);
+    let directory = root;
+    for (const part of BUILDAH_STORE_CACHE_DIR.split("/")) {
+      directory = (0, import_node_path19.join)(directory, part);
+      if (create) {
+        await (0, import_promises7.mkdir)(directory, { mode: 448 }).catch((error) => {
+          if (error.code !== "EEXIST")
+            throw error;
+        });
+      }
+      const stats = await lstatIfPresent(directory);
+      if (!stats) {
+        return (0, import_node_path19.join)(root, BUILDAH_STORE_CACHE_DIR);
+      }
+      if (!stats.isDirectory()) {
+        throw new Error(`${directory} is not a directory`);
+      }
+    }
+    return directory;
+  }
+};
+async function restoreStore(archive) {
+  const storeLock = await requireStoreLock();
+  const state = await createBuildahStoreStateDirectory();
+  const gate = new FileLock((0, import_node_path19.join)(state, "restore.lock"));
+  return runStoreCommand(
+    {
+      action: "restore",
+      options: {
+        ...STORE_PATHS,
+        archive,
+        storeLock: storeLock.path,
+        marker: (0, import_node_path19.join)(state, "restored")
+      }
+    },
+    gate
+  );
+}
+async function saveStore(archive) {
+  const buildahArgs = await buildahStorageArgs();
+  const storeLock = await requireStoreLock();
+  return runStoreCommand(
+    {
+      action: "save",
+      options: {
+        ...STORE_PATHS,
+        archive,
+        stateDirectory: await createBuildahStoreStateDirectory(),
+        threads: (0, import_node_os11.availableParallelism)(),
+        buildahArgs
+      }
+    },
+    storeLock
+  );
+}
+async function requireStoreLock() {
+  const lock = await buildahStoreLock();
+  if (!lock)
+    throw new Error("flock unavailable");
+  return lock;
+}
+async function describeSave2(result, archive, start) {
+  if (result.status === "saved") {
+    return `saved the Buildah store cache (${formatBytes((await (0, import_promises7.lstat)(archive)).size)}) in ${elapsed(start)}`;
+  }
+  if (result.status === "unused") {
+    return await isRegularFile(archive) ? "kept the previous Buildah store cache: no service built with Buildah" : "no Buildah store cache to keep: no service recorded Buildah image usage";
+  }
+  if (result.status === "skipped" && result.previous === "failed") {
+    throw new Error("an earlier save for this deployment failed");
+  }
+  return "Buildah store cache already prepared for this deployment";
+}
+async function snapshotKey(client) {
+  const configuration = await Promise.all(
+    [
+      "/usr/share/containers/storage.conf",
+      "/etc/containers/storage.conf",
+      (0, import_node_path19.join)(
+        process.env.XDG_CONFIG_HOME || (0, import_node_path19.join)((0, import_node_os11.homedir)(), ".config"),
+        "containers/storage.conf"
+      ),
+      process.env.CONTAINERS_STORAGE_CONF,
+      "/etc/subuid",
+      "/etc/subgid"
+    ].map(readOptionalFile)
+  );
+  return (0, import_node_crypto8.createHash)("sha256").update(
+    JSON.stringify({
+      version: await client.version(),
+      arch: process.arch,
+      uid: process.getuid?.(),
+      gid: process.getgid?.(),
+      driver: process.env.VERCEL_VCR_DOCKER_STORAGE_DRIVER,
+      image: process.env.VERCEL_BUILD_IMAGE,
+      configuration
+    })
+  ).digest("hex").slice(0, 32);
+}
+async function readOptionalFile(path4) {
+  if (!path4) {
+    return "";
+  }
+  try {
+    return await (0, import_promises7.readFile)(path4, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return "";
+    throw error;
+  }
+}
+async function isRegularFile(path4) {
+  return (await lstatIfPresent(path4))?.isFile() ?? false;
+}
+function failureReason(error) {
+  return String(error?.message ?? error).trim().split("\n").at(-1) ?? "";
+}
+
 // src/dev.ts
 var import_node_child_process4 = require("child_process");
 var import_node_fs15 = require("fs");
-var import_node_os8 = require("os");
-var import_node_path15 = __toESM(require("path"));
+var import_node_os12 = require("os");
+var import_node_path20 = __toESM(require("path"));
 var HOST_ONLY_ENV = /* @__PURE__ */ new Set([
   "TMPDIR",
   "TMP",
@@ -2939,8 +3498,8 @@ function isHostOnlyEnvVar(key) {
   return HOST_ONLY_ENV.has(key) || key.startsWith("__") || key.startsWith("XPC_") || key.startsWith("SSH_") || key.startsWith("Apple");
 }
 function writeEnvFile(env) {
-  const dir = (0, import_node_fs15.mkdtempSync)(import_node_path15.default.join((0, import_node_os8.tmpdir)(), "vercel-container-dev-env-"));
-  const file = import_node_path15.default.join(dir, "env");
+  const dir = (0, import_node_fs15.mkdtempSync)(import_node_path20.default.join((0, import_node_os12.tmpdir)(), "vercel-container-dev-env-"));
+  const file = import_node_path20.default.join(dir, "env");
   const lines = [];
   for (const [key, value] of Object.entries(env)) {
     if (value.includes("\n")) {
@@ -2973,7 +3532,7 @@ function emit(out, line) {
   }
 }
 function runForwarded(cmd, args, out, opts = {}) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const child = (0, import_node_child_process4.spawn)(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
@@ -3010,7 +3569,7 @@ function runForwarded(cmd, args, out, opts = {}) {
     });
     child.on("close", (code) => {
       if (code === 0) {
-        resolve4({ stdout });
+        resolve5({ stdout });
       } else {
         const detail = stderr.trim().split("\n").slice(-5).join("\n");
         reject(
@@ -3046,7 +3605,7 @@ async function resolveDevImage(options, out, span) {
   }
   const serviceName = options.service?.name ?? "service";
   const tag = devImageTag(serviceName);
-  const contextDir = import_node_path15.default.dirname(dockerfilePath);
+  const contextDir = import_node_path20.default.dirname(dockerfilePath);
   const buildArgFlags2 = [];
   const buildEnv = options.meta?.buildEnv ?? {};
   for (const [key, value] of Object.entries(buildEnv)) {
@@ -3251,7 +3810,7 @@ async function startContainer(options, reuseKey) {
         }
       });
       const cleanupEnvFile = () => {
-        (0, import_node_fs15.rmSync)(import_node_path15.default.dirname(envFilePath), { recursive: true, force: true });
+        (0, import_node_fs15.rmSync)(import_node_path20.default.dirname(envFilePath), { recursive: true, force: true });
       };
       const shutdown = async () => {
         runningContainers.delete(reuseKey);
@@ -3284,7 +3843,7 @@ async function startContainer(options, reuseKey) {
             break;
           } catch (err) {
             lastErr = err;
-            await new Promise((resolve4) => setTimeout(resolve4, 250));
+            await new Promise((resolve5) => setTimeout(resolve5, 250));
           }
         }
         if (hostPort === void 0) {
@@ -3327,19 +3886,27 @@ async function startContainer(options, reuseKey) {
 }
 
 // src/prepare-cache.ts
-var import_build_utils5 = require("@vercel/build-utils");
-var import_node_path16 = require("path");
+var import_build_utils7 = require("@vercel/build-utils");
+var import_node_path21 = require("path");
 async function prepareCache(options) {
-  const root = (0, import_node_path16.resolve)(options.repoRootPath || options.workPath);
+  const root = (0, import_node_path21.resolve)(options.repoRootPath || options.workPath);
+  const buildpackFiles = await collectBuildpackCache(root);
+  const buildahStoreFiles = await BuildahStoreCache.forProject(
+    options,
+    new BuildahClient(sharedBuildahStoreLock)
+  ).afterBuilds();
+  return { ...buildpackFiles, ...buildahStoreFiles };
+}
+async function collectBuildpackCache(root) {
   const start = Date.now();
-  const files = await (0, import_build_utils5.glob)(`${BUILDPACK_CACHE_DIR}/**`, root);
+  const files = await (0, import_build_utils7.glob)(`${BUILDPACK_CACHE_DIR}/**`, root);
   const count = Object.keys(files).length;
   if (count > 0) {
     info(
-      `cached buildpack layers: ${count} file${count === 1 ? "" : "s"} under ${BUILDPACK_CACHE_DIR} in ${Date.now() - start}ms`
+      `cached ${count} file${count === 1 ? "" : "s"} under ${BUILDPACK_CACHE_DIR} in ${Date.now() - start}ms`
     );
   } else {
-    debug("no buildpack cache to persist");
+    debug(`no cache to persist under ${BUILDPACK_CACHE_DIR}`);
   }
   return files;
 }
@@ -3363,9 +3930,9 @@ function resolveImageTag() {
   if (sha) {
     return sha.slice(0, 12);
   }
-  const deploymentId = readString(process.env.VERCEL_DEPLOYMENT_ID);
-  if (deploymentId) {
-    return deploymentId.replace(/[^a-z0-9-_.]/gi, "-");
+  const deploymentId2 = readString(process.env.VERCEL_DEPLOYMENT_ID);
+  if (deploymentId2) {
+    return deploymentId2.replace(/[^a-z0-9-_.]/gi, "-");
   }
   return `build-${Date.now().toString(36)}`;
 }
@@ -3397,8 +3964,16 @@ async function authenticateRegistry(engine, buildParams, span) {
   done("authenticated");
 }
 async function buildAndPushImage(params) {
-  const { contextDir, dockerfilePath, repository, tag, buildArgs, parentSpan } = params;
-  const engine = selectContainerEngine();
+  const {
+    contextDir,
+    dockerfilePath,
+    repository,
+    tag,
+    buildArgs,
+    buildahClient,
+    parentSpan
+  } = params;
+  const engine = selectContainerEngine(buildahClient);
   return withSpan(
     parentSpan,
     "container.build_and_push",
@@ -3448,6 +4023,7 @@ async function buildAndPushImage(params) {
           token,
           repository,
           buildArgs,
+          useBuildahStoreCache: buildahStoreCacheEnabled(),
           span: buildSpan
         };
         await authenticateRegistry(engine, buildParams, buildSpan);
@@ -3470,7 +4046,13 @@ async function buildAndPushImage(params) {
           buildSpan,
           "container.image_build",
           { "image.ref": imageRef, "image.platform": TARGET_PLATFORM },
-          () => engine.build(buildParams)
+          async () => {
+            if (params.schedulesCommand) {
+              await buildSchedulesCommandImage(engine, buildParams);
+            } else {
+              await engine.build(buildParams);
+            }
+          }
         );
         done(`built in ${elapsed(buildStart)}`);
         const pushStart = Date.now();
@@ -3502,7 +4084,7 @@ async function buildAndPushImage(params) {
     }
   );
 }
-async function resolveImageHandler(options, source, span) {
+async function resolveImageHandler(options, source, buildahClient, span, schedulesCommand) {
   const { config, meta } = options;
   const { daemon } = config;
   span?.setAttributes({
@@ -3525,7 +4107,7 @@ async function resolveImageHandler(options, source, span) {
       });
       return tag3;
     }
-    const repository2 = daemon ? (0, import_build_utils6.getDaemonImageRepository)(daemon.name) : sanitizeRepository(options.service?.name ?? buildpack.runtime);
+    const repository2 = daemon ? (0, import_build_utils8.getDaemonImageRepository)(daemon.name) : sanitizeRepository(options.service?.name ?? buildpack.runtime);
     const tag2 = resolveImageTag();
     span?.setAttributes({
       "container.mode": "buildpack-build-and-push",
@@ -3545,6 +4127,7 @@ async function resolveImageHandler(options, source, span) {
         config,
         meta,
         buildEnv: buildArgsFromEnv(meta?.buildEnv),
+        buildahClient,
         parentSpan: span
       });
     } catch (error) {
@@ -3560,7 +4143,7 @@ async function resolveImageHandler(options, source, span) {
   if (meta?.isDev) {
     const serviceName = options.service?.name;
     const tag2 = devImageTag(
-      serviceName ?? import_node_path17.default.basename(dockerfileRel).split(".")[0]
+      serviceName ?? import_node_path22.default.basename(dockerfileRel).split(".")[0]
     );
     span?.setAttributes({ "container.mode": "dev", "image.tag": tag2 });
     return tag2;
@@ -3570,15 +4153,17 @@ async function resolveImageHandler(options, source, span) {
       `Dockerfile not found at "${dockerfilePath}" for container service.`
     );
   }
-  const repository = daemon ? (0, import_build_utils6.getDaemonImageRepository)(daemon.name) : sanitizeRepository(
-    options.service?.name ?? import_node_path17.default.basename(dockerfileRel).split(".")[0]
+  const repository = daemon ? (0, import_build_utils8.getDaemonImageRepository)(daemon.name) : sanitizeRepository(
+    options.service?.name ?? import_node_path22.default.basename(dockerfileRel).split(".")[0]
   );
   const tag = resolveImageTag();
-  const contextDir = import_node_path17.default.dirname(dockerfilePath);
+  const contextDir = schedulesCommand ? import_node_path22.default.join(options.workPath, schedulesCommand.root) : import_node_path22.default.dirname(dockerfilePath);
+  const contextIsRoot = Boolean(schedulesCommand) || import_node_path22.default.dirname(import_node_path22.default.normalize(daemon ? daemon.entrypoint : dockerfileRel)) === ".";
   const buildArgs = buildArgsFromEnv(meta?.buildEnv);
   span?.setAttributes({
     "container.mode": "build_and_push",
     "container.repository": repository,
+    "container.context_is_root": toTag(contextIsRoot),
     "image.tag": tag
   });
   return buildAndPushImage({
@@ -3587,7 +4172,9 @@ async function resolveImageHandler(options, source, span) {
     repository,
     tag,
     buildArgs,
-    parentSpan: span
+    buildahClient,
+    parentSpan: span,
+    schedulesCommand
   });
 }
 function buildArgsFromEnv(env) {
@@ -3604,12 +4191,26 @@ function buildArgsFromEnv(env) {
 }
 async function build(options) {
   const source = resolveImageSource(options, "build");
+  const schedulesCommand = options.config.schedulesCommand;
   const { daemon } = options.config;
+  const buildahClient = new BuildahClient(sharedBuildahStoreLock);
+  if (!options.meta?.isDev && selectContainerEngine(buildahClient).name === "buildah") {
+    await BuildahStoreCache.forProject(options, buildahClient).beforeBuild({
+      buildsWithBuildah: source.kind !== "prebuilt",
+      span: options.span
+    });
+  }
   const image = await withSpan(
     options.span,
     "container.resolve_image",
     { "service.name": options.service?.name },
-    (span) => resolveImageHandler(options, source, span)
+    (span) => resolveImageHandler(
+      options,
+      source,
+      buildahClient,
+      span,
+      schedulesCommand
+    )
   );
   if (daemon) {
     return {
@@ -3640,15 +4241,16 @@ async function build(options) {
       }
     };
   }
-  const lambdaOptions = await (0, import_build_utils6.getLambdaOptionsFromFunction)({
+  const lambdaOptions = await (0, import_build_utils8.getLambdaOptionsFromFunction)({
     sourceFile: resolveFunctionSourceFile(options),
-    config: options.config
+    config: options.config,
+    isScheduleEntrypoint: schedulesCommand !== void 0
   });
-  const command = source.kind === "buildpack" ? void 0 : normalizeCommand(options.config.command);
+  const command = source.kind === "buildpack" || schedulesCommand ? void 0 : normalizeCommand(options.config.command);
   await generateProjectManifest({
     workPath: options.workPath,
     framework: options.diagnosticsValues?.framework,
-    serviceType: options.service ? (0, import_build_utils6.getReportedServiceType)(options.service) : void 0
+    serviceType: options.service ? (0, import_build_utils8.getReportedServiceType)(options.service) : void 0
   });
   const routes = [
     { handle: "filesystem" },
@@ -3668,7 +4270,7 @@ async function build(options) {
     }
   ];
   return {
-    routes,
+    routes: schedulesCommand ? [] : routes,
     output: {
       [CONTAINER_OUTPUT_PATH]: {
         type: "Lambda",
@@ -3678,7 +4280,9 @@ async function build(options) {
         // (vercel/api#76729).
         handler: image,
         runtime: "container",
-        environment: {},
+        environment: schedulesCommand ? {
+          [SCHEDULES_COMMAND_ENV]: JSON.stringify(schedulesCommand.command)
+        } : {},
         ...command ? { command } : {},
         ...lambdaOptions
       }