---
title: BuildImageOptions
description: Everything CreateMicrovmImage needs.
---

Everything `CreateMicrovmImage` needs.

**What is deliberately not a field**

A `clientToken`. There is no such field on the core's request type and none here: a
digest-derived token replays the original create and wedges an image in `CREATING` for
fifteen hours with no error at all (TRAP-1). `tokenScope` is a CloudTrail **label** folded
in beside a fresh nonce and cannot become the token.

A `capabilities` list. `repairGuestIdentity` is a boolean and the request injects `["ALL"]`
itself, so `["CAP_SYS_ADMIN"]` — the request AWS rejects after the artifact upload — is not
something a caller can write (TRAP-3).

An `architecture`. The model's enum has exactly one value, so the only thing a field could
express is a rejected request.

## Properties

### baseImage?

```ts
optional baseImage?: BaseImageInput;
```

***

### baseImageVersion?

```ts
optional baseImageVersion?: string;
```

Pins the managed base to one version, a value `managedBaseVersions` lists.

***

### binary

```ts
binary: Uint8Array;
```

The daemon binary's bytes, zipped into the artifact.

***

### buildRoleArn

```ts
buildRoleArn: string;
```

The build role, which must grant logs on `/aws/lambda-microvms/*`.

***

### codeArtifactUri

```ts
codeArtifactUri: string;
```

Where the artifact is uploaded to. `buildImage` does not upload: the caller puts the
bytes there and passes the URI. `ensureImage` is the path that uploads for itself.

***

### dockerfile?

```ts
optional dockerfile?: string;
```

A caller-supplied Dockerfile, checked against the base image's `FROM`.

***

### inheritWorkdir?

```ts
optional inheritWorkdir?: boolean;
```

Whether the daemon should inherit the image's `WORKDIR`. Refused when nothing declares
one, because the inheritance would silently resolve to `/`.

***

### logGroup?

```ts
optional logGroup?: string;
```

`logging.cloudWatch.logGroup`, or absent for the service default (a service-created
group under `/aws/lambda-microvms/<image-name>` with random stream names). The
build role must grant logs on whatever this names.

***

### logStream?

```ts
optional logStream?: string;
```

A log-stream name **prefix** inside `logGroup`, never the exact name: the platform
member is an exact stream name (prefixes unsupported) and one build is three VMs
writing three streams, so the client appends `/<16 hex>` per build attempt and the
resolved name comes back on `Image.logStream`. Requires `logGroup`.

***

### name

```ts
name: string;
```

***

### projectDir?

```ts
optional projectDir?: string;
```

A directory whose one manifest+lockfile pair bakes an environment layer, by the rule
the CLI's `--project` uses. A directory without exactly one pair is refused before any
call.

***

### repairGuestIdentity?

```ts
optional repairGuestIdentity?: boolean;
```

Whether to repair guest identity. A boolean, not a capability list — see above.

***

### tags?

```ts
optional tags?: Record<string, string>;
```

***

### tokenScope?

```ts
optional tokenScope?: string;
```

A CloudTrail-readability **label**, defaulting to the image name. Not the token.

## Provenance

This page is generated from `bindings/microvms-js/index.d.ts` by TypeDoc 0.28.20 and typedoc-plugin-markdown 4.13.1, run from `site/scripts/gen-reference.mjs` on every `pnpm run sync`, so an edit made here is overwritten by the next run.

To change the page, change the doc comment in the binding's Rust source, then regenerate the declarations with `mise run dts`. `mise run dts:check` fails when the committed file no longer matches the source.