.gitea/workflows/ docker-image.deploy.yml

@@ -17,13 +17,20 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
 
-    - name: Start BuildKit
+    - name: Create non-root user for BuildKit
       run: |
-        mkdir -p /run/buildkit
+        adduser -D -u 1000 builder
-        buildkitd \
+
-          --root /tmp/buildkit \
+    - name: Start BuildKit (rootless)
-          --addr unix:///run/buildkit/buildkitd.sock \
+      run: |
-          >/tmp/buildkitd.log 2>&1 &
+        su builder -c '
+          export XDG_RUNTIME_DIR=/tmp/buildkit
+          mkdir -p $XDG_RUNTIME_DIR
+          buildkitd \
+            --root /home/builder/.local/share/buildkit \
+            --addr unix://$XDG_RUNTIME_DIR/buildkitd.sock \
+            >/home/builder/buildkitd.log 2>&1 &
+        '
         sleep 3
 
     - name: Check BuildKit daemon
@@ -47,11 +54,15 @@ jobs:
 
     - name: Build and push image
       run: |
-        buildctl \
+        su builder -c '
-          --addr unix:///run/buildkit/buildkitd.sock \
+          export XDG_RUNTIME_DIR=/tmp/buildkit
-          build \
+          buildctl \
-          --frontend=dockerfile.v0 \
+            --addr unix://$XDG_RUNTIME_DIR/buildkitd.sock \
-          --local context=./pbsclient \
+            build \
-          --local dockerfile=./pbsclient/docker \
+            --frontend=dockerfile.v0 \
-          --opt filename=Dockerfile \
+            --local context=./pbsclient \
-          --output type=image,name=git.limbosolutions.com/kb/pbsclient:latest,push=true
+            --local dockerfile=./pbsclient/docker \
+            --opt filename=Dockerfile \
+            --output type=image,name=git.limbosolutions.com/kb/pbsclient:latest,push=true '
+
+