Buildah requires root privileges and also requires a properly installed shadow-utils package (which in turn requires SETFCAP). Instead of buildah, investigate the usage of google/go-containerregistry directly:

Tasks:

• Ensure that google/go-containerregistry can build ContainerDisk in an unprivileged pod
• Ensure that google/go-containerregistry can push ContainerDisk in an unprivileged pod