From 057731ae62a6b88940e87e5cee179f798b8ed120 Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Wed, 16 Sep 2026 18:19:27 +0000
Subject: [PATCH] =?UTF-8?q?=E4=BD=BF=E7=94=A8=20native=20snapshotter=20?=
 =?UTF-8?q?=E7=94=9F=E6=88=90=E9=95=9C=E5=83=8F=E8=AF=81=E6=98=8E?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/publish-images.yml | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/publish-images.yml b/.gitea/workflows/publish-images.yml
index 70033c7..5d9094e 100644
--- a/.gitea/workflows/publish-images.yml
+++ b/.gitea/workflows/publish-images.yml
@@ -74,8 +74,10 @@ jobs:
           image_tag="sha-${GITHUB_SHA}"
           docker_config=$(mktemp -d)
           jwt_file=$(mktemp)
+          buildkit_config=$(mktemp)
           cleanup() {
-            rm -rf -- "$docker_config" "$jwt_file"
+            docker buildx rm ci-builder >/dev/null 2>&1 || true
+            rm -rf -- "$docker_config" "$jwt_file" "$buildkit_config"
           }
           trap cleanup EXIT
           export DOCKER_CONFIG="$docker_config"
@@ -88,12 +90,25 @@ jobs:
           jq -er '.[0].svids[0].svid' "$jwt_file" | \
             docker login "$PUSH_REGISTRY" --username zot --password-stdin
 
+          # The docker driver cannot publish attestations. Use an isolated
+          # BuildKit worker, but force its snapshotter to copy-based native so
+          # it does not attempt nested overlay mounts inside the runner Pod.
+          printf '%s\n' \
+            '[worker.oci]' \
+            '  snapshotter = "native"' \
+            >"$buildkit_config"
+          docker buildx create \
+            --name ci-builder \
+            --driver docker-container \
+            --buildkitd-config "$buildkit_config" \
+            --use
+
           publish() {
             local repository=$1
             local dockerfile=$2
             local metadata=$3
             docker buildx build \
-              --builder default \
+              --builder ci-builder \
               --platform linux/amd64 \
               --file "$dockerfile" \
               --tag "${PUSH_REGISTRY}/${repository}:${image_tag}" \