From 7c1c4a0c63b4bee8a79d7f0addd8523f9b110cfa Mon Sep 17 00:00:00 2001
From: graham <graham@mcintire.me>
Date: Sat, 28 Mar 2026 12:51:10 -0500
Subject: [PATCH] fix: use kaniko for unprivileged container builds (#209)

- Replace Docker build with kaniko executor
- Kaniko doesn't require Docker daemon or unshare capabilities
- Works in unprivileged CI environments
- Builds and pushes directly to registry

Reviewed-on: https://git.mcintire.me/graham/towerops-web/pulls/209
---
 .forgejo/workflows/production.yaml | 57 +++++++++++++-----------------
 1 file changed, 24 insertions(+), 33 deletions(-)

diff --git a/.forgejo/workflows/production.yaml b/.forgejo/workflows/production.yaml
index 187aa3f8..603e7fbf 100644
--- a/.forgejo/workflows/production.yaml
+++ b/.forgejo/workflows/production.yaml
@@ -90,26 +90,6 @@ jobs:
         with:
           fetch-depth: 0  # Need full history for git operations
 
-      - name: Start Docker daemon
-        run: |
-          # Start Docker daemon in background if not running
-          # --iptables=false --bridge=none --ip6tables=false disables networking
-          # features that require root/netadmin caps not available on unprivileged
-          # CI runners. Only image builds and registry pushes are needed here.
-          if ! docker info > /dev/null 2>&1; then
-            sudo dockerd \
-              --iptables=false \
-              --ip6tables=false \
-              --bridge=none \
-              --storage-driver=vfs &
-            # Wait for Docker to be ready
-            timeout 30 bash -c 'until docker info > /dev/null 2>&1; do sleep 1; done'
-          fi
-
-      - name: Log in to Container Registry
-        run: |
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login ${{ secrets.REGISTRY_URL }} -u "${{ secrets.REGISTRY_USER }}" --password-stdin
-
       - name: Generate image tag
         id: tag
         run: |
@@ -120,23 +100,34 @@ jobs:
           echo "tag=${TAG}" >> $GITHUB_OUTPUT
           echo "Full image tag: ${TAG}"
 
-      - name: Build and push Docker image
-        env:
-          DOCKER_BUILDKIT: 0
+      - name: Build and push with kaniko
         run: |
           IMAGE_TAG="${{ steps.tag.outputs.tag }}"
 
-          # Build image
-          docker build \
-            --file k8s/Dockerfile \
-            --build-arg MIX_ENV=prod \
-            --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG} \
-            --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production \
-            .
+          # Create kaniko config for registry auth
+          mkdir -p /tmp/kaniko
+          cat > /tmp/kaniko/config.json <<EOF
+          {
+            "auths": {
+              "${{ secrets.REGISTRY_URL }}": {
+                "auth": "$(echo -n "${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASSWORD }}" | base64)"
+              }
+            }
+          }
+          EOF
 
-          # Push both tags
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production
+          # Run kaniko to build and push
+          docker run --rm \
+            -v $(pwd):/workspace \
+            -v /tmp/kaniko:/kaniko/.docker \
+            gcr.io/kaniko-project/executor:latest \
+            --context /workspace \
+            --dockerfile /workspace/k8s/Dockerfile \
+            --destination ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG} \
+            --destination ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production \
+            --build-arg MIX_ENV=prod \
+            --cache=false \
+            --cleanup
 
       - name: Update deployment manifest
         run: |