From d9b929038b52a33b77c7c1b96548f34d1e4a0d6f Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Sun, 29 Mar 2026 10:35:55 -0500
Subject: [PATCH] fix: use default buildx without attestations for unprivileged
 runner (#216)

Remove the setup-buildx-action step that was failing with unshare errors
when trying to create a docker-container builder.

Instead, use the default buildx that comes with dockerd and disable
attestation features (provenance and sbom) that require additional
mount operations.

This simpler approach should work within the constraints of the
unprivileged CI runner.

Reviewed-on: https://git.mcintire.me/graham/towerops-web/pulls/216
---
 .forgejo/workflows/production.yaml | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/.forgejo/workflows/production.yaml b/.forgejo/workflows/production.yaml
index b29f236c..932644b2 100644
--- a/.forgejo/workflows/production.yaml
+++ b/.forgejo/workflows/production.yaml
@@ -33,15 +33,6 @@ jobs:
             timeout 30 bash -c 'until docker info > /dev/null 2>&1; do sleep 1; done'
           fi
 
-      - name: Set up Docker Buildx
-        uses: https://github.com/docker/setup-buildx-action@v3
-        with:
-          driver: docker-container
-          driver-opts: |
-            image=moby/buildkit:latest
-          install: true
-          cleanup: true
-
       - name: Generate image tag
         id: tag
         run: |
@@ -65,6 +56,8 @@ jobs:
           context: .
           file: k8s/Dockerfile
           push: true
+          provenance: false
+          sbom: false
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production