Rootless buildah in the containerized gitea-runner pod cannot remap UID/GID on a fresh base-image pull and has no OCI runtime, so this Dockerfile's `RUN apk add` / `RUN go build` cannot execute there at all. The last green run here (2026-07-22) predates the runner's containerization (infra#233, 2026-07-29), so the build has been latently broken since. buildctl hands the build to koala's host buildkitd over the socket the pod already mounts; skopeo pushes the resulting OCI archive once per tag, since buildctl has no `buildah push` equivalent. The VERSION build-arg carries over as `--opt build-arg:VERSION=`, so the ldflags version stamp is unchanged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011PL5XcG68SvQqz3vGVbWbf