fix: use kaniko for unprivileged container builds (#209)

- Replace Docker build with kaniko executor
- Kaniko doesn't require Docker daemon or unshare capabilities
- Works in unprivileged CI environments
- Builds and pushes directly to registry

Reviewed-on: graham/towerops-web#209

.forgejo/workflows/production.yaml

@@ -90,26 +90,6 @@ jobs:
         with:
           fetch-depth: 0  # Need full history for git operations
 
-      - name: Start Docker daemon
-        run: |
-          # Start Docker daemon in background if not running
-          # --iptables=false --bridge=none --ip6tables=false disables networking
-          # features that require root/netadmin caps not available on unprivileged
-          # CI runners. Only image builds and registry pushes are needed here.
-          if ! docker info > /dev/null 2>&1; then
-            sudo dockerd \
-              --iptables=false \
-              --ip6tables=false \
-              --bridge=none \
-              --storage-driver=vfs &
-            # Wait for Docker to be ready
-            timeout 30 bash -c 'until docker info > /dev/null 2>&1; do sleep 1; done'
-          fi
-
-      - name: Log in to Container Registry
-        run: |
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login ${{ secrets.REGISTRY_URL }} -u "${{ secrets.REGISTRY_USER }}" --password-stdin
-
       - name: Generate image tag
         id: tag
         run: |
@@ -120,23 +100,34 @@ jobs:
           echo "tag=${TAG}" >> $GITHUB_OUTPUT
           echo "Full image tag: ${TAG}"
 
-      - name: Build and push Docker image
+      - name: Build and push with kaniko
-        env:
-          DOCKER_BUILDKIT: 0
         run: |
           IMAGE_TAG="${{ steps.tag.outputs.tag }}"
 
-          # Build image
+          # Create kaniko config for registry auth
-          docker build \
+          mkdir -p /tmp/kaniko
-            --file k8s/Dockerfile \
+          cat > /tmp/kaniko/config.json <<EOF
-            --build-arg MIX_ENV=prod \
+          {
-            --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG} \
+            "auths": {
-            --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production \
+              "${{ secrets.REGISTRY_URL }}": {
-            .
+                "auth": "$(echo -n "${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASSWORD }}" | base64)"
+              }
+            }
+          }
+          EOF
 
-          # Push both tags
+          # Run kaniko to build and push
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}
+          docker run --rm \
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production
+            -v $(pwd):/workspace \
+            -v /tmp/kaniko:/kaniko/.docker \
+            gcr.io/kaniko-project/executor:latest \
+            --context /workspace \
+            --dockerfile /workspace/k8s/Dockerfile \
+            --destination ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG} \
+            --destination ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production \
+            --build-arg MIX_ENV=prod \
+            --cache=false \
+            --cleanup
 
       - name: Update deployment manifest
         run: |