From 344c6658e86b0218ccbd24331ff74e51058b5bef Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Sun, 29 Mar 2026 13:28:37 -0500
Subject: [PATCH] fix: use existing Docker daemon instead of starting new one
 (#226)

The CI runner already has a working Docker daemon and the runner user
is in the docker group. All previous failures were caused by the workflow
trying to start a NEW dockerd instance with vfs storage driver.

Solution: Remove all daemon startup code and just use the existing Docker
daemon directly. The runner user already has access via group membership.

Verified on ci host:
- Docker service running: overlayfs storage driver
- runner user in docker group: uid=1001(runner) groups=1001(runner),989(docker)
- docker info works as runner user

This is the simplest solution and should have been tried first.

Reviewed-on: https://git.mcintire.me/graham/towerops-web/pulls/226
---
 .forgejo/workflows/production.yaml | 29 ++++++++++-------------------
 1 file changed, 10 insertions(+), 19 deletions(-)

diff --git a/.forgejo/workflows/production.yaml b/.forgejo/workflows/production.yaml
index c842be5c..34d719da 100644
--- a/.forgejo/workflows/production.yaml
+++ b/.forgejo/workflows/production.yaml
@@ -100,35 +100,26 @@ jobs:
           echo "tag=${TAG}" >> $GITHUB_OUTPUT
           echo "Full image tag: ${TAG}"
 
-      - name: Install img
-        run: |
-          curl -fsSL https://github.com/genuinetools/img/releases/download/v0.5.11/img-linux-amd64 -o /tmp/img
-          sudo install /tmp/img /usr/local/bin/img
-          rm /tmp/img
-
-      - name: Build and push with img
+      - name: Build and push Docker image
         run: |
           IMAGE_TAG="${{ steps.tag.outputs.tag }}"
 
-          # Build with img (completely unprivileged, no capabilities needed)
-          img build \
+          # Build using existing Docker daemon (runner user is in docker group)
+          docker build \
             --build-arg MIX_ENV=prod \
             --file k8s/Dockerfile \
             --tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}" \
+            --tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production" \
             .
 
-          # Login and push
-          img login \
-            -u "${{ secrets.REGISTRY_USER }}" \
-            -p "${{ secrets.REGISTRY_PASSWORD }}" \
+          # Login and push both tags
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login \
+            --username "${{ secrets.REGISTRY_USER }}" \
+            --password-stdin \
             "${{ secrets.REGISTRY_URL }}"
 
-          img push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}"
-
-          # Tag and push production
-          img tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}" \
-                  "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production"
-          img push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production"
+          docker push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}"
+          docker push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production"
 
   update-manifest:
     name: Update Deployment Manifest