From 1fdd7d2e3d15ff38a2971b21be82eb88543a4839 Mon Sep 17 00:00:00 2001
From: Mathias <mthbqv@gmail.com>
Date: Wed, 19 Aug 2026 13:38:54 +0200
Subject: [PATCH] ci: build via buildctl instead of rootless buildah
 (infra#241)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cad-atlas is the eighth repo to hit this wall, and it only surfaced now because
the build job had been unreachable behind a failing test job:

  error running container: from  creating container for
  [/bin/sh -c apk add --no-cache git]: : exec: no command

Root cause is the gitea-runner pod's securityContext, not this repo: it drops
ALL capabilities and sets allowPrivilegeEscalation:false, so newuidmap and
newgidmap cannot remap uids and rootless buildah gets a single non-remapped
mapping — not enough to set up a RUN step's user namespace.

buildctl talks to koala's host buildkitd over the socket the runner pod already
mounts, so the privileged layer work happens on the host and the pod keeps its
minimal posture. Same migration dispatch, tapir, brain-ingest-ntfy, parallax,
macro-research, cobalt-dingo, agentsquad (infra#233) and segment-embedder
(infra#243) have already made.

Note --opt build-arg:VERSION replaces buildah's --build-arg; the version label
this repo stamps into its binary depends on it, and dropping it silently would
have produced an image reporting the wrong version.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011PL5XcG68SvQqz3vGVbWbf
---
 .gitea/workflows/cd.yml | 37 +++++++++++++++++++++++++++++--------
 1 file changed, 29 insertions(+), 8 deletions(-)

diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml
index 8e15890..fa62def 100644
--- a/.gitea/workflows/cd.yml
+++ b/.gitea/workflows/cd.yml
@@ -143,16 +143,37 @@ jobs:
 
       - name: Build and push to local registry
         run: |
+          set -euo pipefail
+          # infra#241: rootless buildah cannot build this Dockerfile in the
+          # gitea-runner pod — it drops ALL capabilities and sets
+          # allowPrivilegeEscalation:false (deliberate, it holds CI secrets), so
+          # newuidmap/newgidmap cannot remap uids and `RUN apk add` dies with
+          # "exec: no command". Every other repo on this runner has already
+          # moved: dispatch, tapir, brain-ingest-ntfy, parallax, macro-research,
+          # cobalt-dingo, agentsquad (infra#233), segment-embedder (infra#243).
+          #
+          # buildctl talks to koala's host buildkitd over the socket the runner
+          # pod already mounts, so the privileged work happens on the host and
+          # this pod's posture is irrelevant to whether the build succeeds.
+          # buildctl cannot push, so it writes an OCI archive that skopeo copies.
+          BUILDKIT_HOST="unix:///run/buildkit/buildkitd.sock"
           REGISTRY="localhost:5000"
           REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
-          buildah build \
-            --build-arg VERSION="${{ steps.meta.outputs.version }}" \
-            --label "org.opencontainers.image.revision=${{ github.sha }}" \
-            -t ${REF} \
-            -t ${REGISTRY}/${{ env.IMAGE }}:latest \
-            .
-          buildah push --tls-verify=false ${REF}
-          buildah push --tls-verify=false ${REGISTRY}/${{ env.IMAGE }}:latest
+          TAR_FILE="$(mktemp)"
+          trap 'rm -f "$TAR_FILE"' EXIT
+
+          buildctl --addr "$BUILDKIT_HOST" build \
+            --frontend dockerfile.v0 \
+            --local context=. \
+            --local dockerfile=. \
+            --opt build-arg:VERSION="${{ steps.meta.outputs.version }}" \
+            --opt label:org.opencontainers.image.revision="${{ github.sha }}" \
+            --output type=oci,dest="$TAR_FILE"
+
+          skopeo copy --dest-tls-verify=false \
+            oci-archive:"$TAR_FILE" docker://"${REF}"
+          skopeo copy --dest-tls-verify=false \
+            oci-archive:"$TAR_FILE" docker://"${REGISTRY}/${{ env.IMAGE }}:latest"
           echo "✓ Image pushed to ${REF}"
 
   deploy: