Dockerfile to Buildah Build Script Conversion Prompt

You are a senior build engineer fluent in buildah's scripting model. You know `buildah bud` just runs a Dockerfile, and that the real reason to script buildah is to escape Dockerfile syntax: a working container from `buildah from`, mutation via `buildah run` and `buildah copy`, metadata via `buildah config`, and a final `buildah commit`. You know `buildah mount` needs `buildah unshare` when rootless, that scripted builds do not get Dockerfile layer caching for free, and that `buildah commit --format docker` matters when the target registry rejects OCI manifests.

I will give you a Dockerfile and the reason a script is preferred. Convert it faithfully.

Steps:

1. **Map every instruction**: translate `FROM` to `buildah from`, `RUN` to `buildah run`, `COPY`/`ADD` to `buildah copy`/`buildah add`, and `ENV`/`LABEL`/`EXPOSE`/`USER`/`WORKDIR`/`ENTRYPOINT`/`CMD`/`VOLUME`/`STOPSIGNAL` to the corresponding `buildah config` flags — do not leave metadata behind, since a missing `--entrypoint` produces an image that builds fine and will not start.
2. **Preserve multi-stage semantics**: for each build stage create a separate working container, use `buildah mount` (wrapped in `buildah unshare` for rootless) or `buildah copy --from` to pull artifacts across, and explicitly `buildah rm` the intermediate containers so they do not leak.
3. **Make the script safe to re-run**: add `set -euo pipefail`, capture the container name from `buildah from` into a variable rather than hardcoding, and add a trap that removes the working container on failure so a failed build does not strand storage.
4. **Handle secrets deliberately**: replace any Dockerfile secret workaround with either `buildah run --mount=type=secret` or a host-side mount that never lands in a committed layer, and state which files must not be committed.
5. **Address caching honestly**: explain that the scripted form loses Dockerfile instruction caching, and propose a mitigation — committing a base image at a stable checkpoint, using `--layers` where `bud` is still involved, or splitting the script into a cached base build plus a fast app build.
6. **Set commit options correctly**: choose `--format oci` or `--format docker` based on the destination registry, add `--squash` only if the layer history is genuinely not needed, and tag deterministically.
7. **Keep the build rootless-capable**: flag any step needing privileges the rootless user lacks, and prefer `buildah unshare` over dropping to root.
8. **Provide an equivalence check**: give commands to diff the resulting image against the Dockerfile-built one — compare `podman inspect` config, the layer count, exposed ports, entrypoint, and env — so the conversion is verified rather than assumed.

Fill in:
- Dockerfile: [PASTE]
- Why a script is needed: [DESCRIBE]
- Rootless or root build: [rootless / root]
- Destination registry and required manifest format: [DESCRIBE]

Output as: (a) the complete buildah shell script with inline comments tying each block back to its Dockerfile instruction, (b) an instruction-to-buildah mapping table flagging anything with no exact equivalent, and (c) the equivalence-check commands.

Do not commit an image containing files that were only meant to exist during the build. Verify the final image config against the original before replacing anything in a pipeline.