fix docker on unprivileged ci: use vfs storage driver (#61)

overlayfs requires mount/unmount capabilities not available on the
unprivileged ci runner. Switch to vfs storage driver and use buildx
docker driver (not docker-container) to avoid nested mount issues.

Reviewed-on: graham/towerops-web#61

.forgejo/workflows/production.yaml

@@ -233,7 +233,11 @@ jobs:
           # features that require root/netadmin caps not available on unprivileged
           # CI runners. Only image builds and registry pushes are needed here.
           if ! docker info > /dev/null 2>&1; then
-            sudo dockerd --iptables=false --ip6tables=false --bridge=none &
+            sudo dockerd \
+              --iptables=false \
+              --ip6tables=false \
+              --bridge=none \
+              --storage-driver=vfs &
             # Wait for Docker to be ready
             timeout 30 bash -c 'until docker info > /dev/null 2>&1; do sleep 1; done'
           fi
@@ -241,9 +245,8 @@ jobs:
       - name: Set up Docker Buildx
         uses: https://github.com/docker/setup-buildx-action@v3
         with:
-          driver: docker-container
+          driver: docker
           install: true
-          buildkitd-flags: --allow-insecure-entitlement security.insecure
           cleanup: true
 
       - name: Log in to Container Registry