modified: .gitea/workflows/ docker-image.deploy.yml

.gitea/workflows/ docker-image.deploy.yml

@@ -17,13 +17,20 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
 
-    - name: Start BuildKit
+    - name: Create non-root user for BuildKit
       run: |
-        mkdir -p /run/buildkit
+        adduser -D -u 1000 builder
+
+    - name: Start BuildKit (rootless)
+      run: |
+        su builder -c '
+          export XDG_RUNTIME_DIR=/tmp/buildkit
+          mkdir -p $XDG_RUNTIME_DIR
           buildkitd \
-          --root /tmp/buildkit \
-          --addr unix:///run/buildkit/buildkitd.sock \
-          >/tmp/buildkitd.log 2>&1 &
+            --root /home/builder/.local/share/buildkit \
+            --addr unix://$XDG_RUNTIME_DIR/buildkitd.sock \
+            >/home/builder/buildkitd.log 2>&1 &
+        '
         sleep 3
 
     - name: Check BuildKit daemon
@@ -37,6 +44,7 @@ jobs:
         AUTH=$(printf "%s" "${{ secrets.GITLIMBO_DOCKER_REGISTRY_USERNAME }}:${{ secrets.GITLIMBO_DOCKER_REGISTRY_PASSWORD }}" | base64 -w 0)
         printf '{"auths":{"git.limbosolutions.com":{"auth":"%s"}}}' "$AUTH" > ~/.docker/config.json
 
+
     - name: Debug paths
       run: |
         echo "PWD: $(pwd)"
@@ -45,13 +53,16 @@ jobs:
         ls -al ./pbsclient/docker || echo "docker dir missing"
 
     - name: Build and push image
-      working-directory: ${{ env.GITEA_WORKSPACE }}
       run: |
+        su builder -c '
+          export XDG_RUNTIME_DIR=/tmp/buildkit
           buildctl \
-          --addr unix:///run/buildkit/buildkitd.sock \
+            --addr unix://$XDG_RUNTIME_DIR/buildkitd.sock \
             build \
             --frontend=dockerfile.v0 \
             --local context=./pbsclient \
             --local dockerfile=./pbsclient/docker \
             --opt filename=Dockerfile \
-          --output type=image,name=git.limbosolutions.com/kb/pbsclient:latest,push=true
+            --output type=image,name=git.limbosolutions.com/kb/pbsclient:latest,push=true '
+
+