From a0b916cc9a0f3e75f27a2e10de748a20ed77102a Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Sun, 29 Mar 2026 13:14:53 -0500
Subject: [PATCH] fix: use img for completely unprivileged container builds
 (#225)

Podman fails even with chroot isolation on this runner. The environment
is too restricted for standard container tools (Docker, Buildx, Podman).

Solution: Use 'img' by Jess Frazelle, designed specifically for truly
unprivileged environments:
- No root/sudo required for builds
- No user namespaces required
- No special capabilities required
- Pure userspace implementation
- Built for restricted CI environments

This is the last resort tool for environments where Docker/Podman
cannot run at all.

Reviewed-on: https://git.mcintire.me/graham/towerops-web/pulls/225
---
 .forgejo/workflows/production.yaml | 31 ++++++++++++++++--------------
 1 file changed, 17 insertions(+), 14 deletions(-)

diff --git a/.forgejo/workflows/production.yaml b/.forgejo/workflows/production.yaml
index 93117f5c..c842be5c 100644
--- a/.forgejo/workflows/production.yaml
+++ b/.forgejo/workflows/production.yaml
@@ -100,32 +100,35 @@ jobs:
           echo "tag=${TAG}" >> $GITHUB_OUTPUT
           echo "Full image tag: ${TAG}"
 
-      - name: Install Podman
+      - name: Install img
         run: |
-          sudo apt-get update
-          sudo apt-get install -y podman
+          curl -fsSL https://github.com/genuinetools/img/releases/download/v0.5.11/img-linux-amd64 -o /tmp/img
+          sudo install /tmp/img /usr/local/bin/img
+          rm /tmp/img
 
-      - name: Build and push with Podman
+      - name: Build and push with img
         run: |
           IMAGE_TAG="${{ steps.tag.outputs.tag }}"
 
-          # Build with chroot isolation (no namespaces required)
-          podman build \
-            --isolation=chroot \
+          # Build with img (completely unprivileged, no capabilities needed)
+          img build \
             --build-arg MIX_ENV=prod \
             --file k8s/Dockerfile \
             --tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}" \
-            --tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production" \
             .
 
-          # Login and push both tags
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | podman login \
-            --username "${{ secrets.REGISTRY_USER }}" \
-            --password-stdin \
+          # Login and push
+          img login \
+            -u "${{ secrets.REGISTRY_USER }}" \
+            -p "${{ secrets.REGISTRY_PASSWORD }}" \
             "${{ secrets.REGISTRY_URL }}"
 
-          podman push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}"
-          podman push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production"
+          img push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}"
+
+          # Tag and push production
+          img tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}" \
+                  "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production"
+          img push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production"
 
   update-manifest:
     name: Update Deployment Manifest