Why buildah can not do without unshare(CLONE_NEWUSER)?

[abitrolly]

I am trying to build Fedora image with buildah image on GitLab.

base-fedora-image:
  stage: build
  image: quay.io/buildah/stable
  script:
    - buildah build -f Dockerfile.fedora -t fedora-fedora

But it fails.

$ buildah build -f Dockerfile.fedora -t fedora-fedora
Error during unshare(CLONE_NEWUSER): Operation not permitted
time="2025-01-17T22:43:17Z" level=error msg="parsing PID \"\": strconv.Atoi: parsing \"\": invalid syntax"
time="2025-01-17T22:43:17Z" level=error msg="(Unable to determine exit status)"

I've seen numerous messages below this error message, but no explanations, like if I am 5:

why is unshare(CLONE_NEWUSER) needed?
it is possible to build images without it?
if it is not possible, then how kaniko manages to do it?

[rhatdan]

It is attempting to create a user namespace, so if you are running with a rootless container, then yes it is required

[abitrolly]

@rhatdan why rootless buildkit doesn't require it https://github.com/moby/buildkit/blob/master/docs/rootless.md ?