This repository has been archived on 2026-09-06. You can view files and clone it. You cannot open issues or pull requests or push a commit.

mathiasandClaude Opus 5 1fdd7d2e3d ci: build via buildctl instead of rootless buildah (infra#241) ...

cad-atlas is the eighth repo to hit this wall, and it only surfaced now because
the build job had been unreachable behind a failing test job:

  error running container: from  creating container for
  [/bin/sh -c apk add --no-cache git]: : exec: no command

Root cause is the gitea-runner pod's securityContext, not this repo: it drops
ALL capabilities and sets allowPrivilegeEscalation:false, so newuidmap and
newgidmap cannot remap uids and rootless buildah gets a single non-remapped
mapping — not enough to set up a RUN step's user namespace.

buildctl talks to koala's host buildkitd over the socket the runner pod already
mounts, so the privileged layer work happens on the host and the pod keeps its
minimal posture. Same migration dispatch, tapir, brain-ingest-ntfy, parallax,
macro-research, cobalt-dingo, agentsquad (infra#233) and segment-embedder
(infra#243) have already made.

Note --opt build-arg:VERSION replaces buildah's --build-arg; the version label
this repo stamps into its binary depends on it, and dropping it silently would
have produced an image reporting the wrong version.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011PL5XcG68SvQqz3vGVbWbf

2026-08-19 13:38:54 +02:00

..

cd.yml

ci: build via buildctl instead of rootless buildah (infra#241)

2026-08-19 13:38:54 +02:00