使用 vfs 构建嵌套容器镜像

.gitea/workflows/publish-images.yml

@@ -45,7 +45,12 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          dockerd >/tmp/dockerd.log 2>&1 &
+          # The runner Pod itself uses an overlay filesystem. A nested overlay
+          # snapshotter cannot mount there, so use the copy-based vfs driver.
+          dockerd \
+            --storage-driver=vfs \
+            --feature containerd-snapshotter=false \
+            >/tmp/dockerd.log 2>&1 &
           for _ in $(seq 1 60); do
             if docker info >/dev/null 2>&1; then
               exit 0
@@ -71,7 +76,6 @@ jobs:
           jwt_file=$(mktemp)
           cleanup() {
             rm -rf -- "$docker_config" "$jwt_file"
-            docker buildx rm ci-builder >/dev/null 2>&1 || true
           }
           trap cleanup EXIT
           export DOCKER_CONFIG="$docker_config"
@@ -84,14 +88,12 @@ jobs:
           jq -er '.[0].svids[0].svid' "$jwt_file" | \
             docker login "$PUSH_REGISTRY" --username zot --password-stdin
 
-          docker buildx create --name ci-builder --driver docker-container --use
-
           publish() {
             local repository=$1
             local dockerfile=$2
             local metadata=$3
             docker buildx build \
-              --builder ci-builder \
+              --builder default \
               --platform linux/amd64 \
               --file "$dockerfile" \
               --tag "${PUSH_REGISTRY}/${repository}:${image_tag}" \