Unable to suppress inheritance of annotations from base image

[jackwhelpton]

Issue Description

Looking to remove (rather than overwrite) some annotations present in the base image, but seem unable to do so.

Steps to reproduce the issue

Have tried various permutations such as:

buildah bud --annotation org.opencontainers.image.url=-

buildah bud --annotation org.opencontainers.image.url- .

Have also experimented with the inherit-labels=false flag.

Describe the results you received

In the first case, the annotation acquires the literal value -. In the second case, a new annotation with a trailing dash in the name is created. The inherit-labels flag appears to have no impact on annotations.

Describe the results you expected

The annotation org.opencontainers.image.url present in the base image should no longer be visible in the new derived image.

buildah version output

Version:         1.40.0
Go Version:      go1.24.2
Image Spec:      1.1.1
Runtime Spec:    1.2.1
CNI Spec:        1.1.0
libcni Version:  v1.3.0
image Version:   5.35.0
Git Commit:      ff62e3e8a5da56352e90039fb4747ff8438b7b5c
Built:           Mon Apr 21 18:24:35 2025
OS/Arch:         linux/amd64
BuildPlatform:   linux/amd64

buildah info output

{
    "host": {
        "CgroupVersion": "v2",
        "Distribution": {
            "distribution": "wolfi",
            "version": "20230201"
        },
        "MemFree": 25018122240,
        "MemTotal": 32882257920,
        "OCIRuntime": "crun",
        "SwapFree": 0,
        "SwapTotal": 0,
        "arch": "amd64",
        "cpus": 16,
        "hostname": "runner-vvkbyzurm-project-54529948-concurrent-0-6rl9flj5",
        "kernel": "6.1.132",
        "os": "linux",
        "rootless": false,
        "uptime": "1m 49.52s",
        "variant": ""
    },
    "store": {
        "ContainerStore": {
            "number": 0
        },
        "GraphDriverName": "overlay",
        "GraphOptions": null,
        "GraphRoot": "/var/lib/containers/storage",
        "GraphStatus": {
            "Backing Filesystem": "overlayfs",
            "Native Overlay Diff": "false",
            "Supports d_type": "true",
            "Supports shifting": "true",
            "Supports volatile": "true",
            "Using metacopy": "false"
        },
        "ImageStore": {
            "number": 20
        },
        "RunRoot": "/run/containers/storage"
    }
}

Provide your storage.conf

n/a

Upstream Latest Release

Yes

Additional environment details

No response

Additional information

No response

[jackwhelpton]

I'm able to work around this a little by using buildah bud to build an image, creating a container from that, updating its metadata via buildah config, and then using buildah commit to update the original image. buildah config does allow me to remove annotations, but the problem is that it also overwrites the base annotations such as org.opencontainers.image.base.name.

I can work around that by running buildah inspect with a Go template to extract the org.opencontainers.image.base.* annotations from the original image and then reapplying those during the buildah config stage, but this is pretty clunky, and a one-stage buildah bud based solution would definitely be preferred.

[flouthoc]

PR should close this #6198