From 3e69d102ddc9613008100a598cff703b5f6011d0 Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Wed, 16 Sep 2026 18:28:33 +0000
Subject: [PATCH] =?UTF-8?q?=E5=9C=A8=20VM=20Runner=20=E4=B8=AD=E5=8F=91?=
 =?UTF-8?q?=E5=B8=83=E9=95=9C=E5=83=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/publish-images.yml | 36 ++---------------------------
 1 file changed, 2 insertions(+), 34 deletions(-)

diff --git a/.gitea/workflows/publish-images.yml b/.gitea/workflows/publish-images.yml
index 5d9094e..ccb1b36 100644
--- a/.gitea/workflows/publish-images.yml
+++ b/.gitea/workflows/publish-images.yml
@@ -17,7 +17,7 @@ on:
 jobs:
   publish-images:
     name: publish-images
-    runs-on: [self-hosted, pod]
+    runs-on: [self-hosted, vm]
     timeout-minutes: 45
     permissions:
       contents: read
@@ -41,29 +41,6 @@ jobs:
           apt-get install --yes --no-install-recommends shellcheck
           shellcheck scripts/*
 
-      - name: Start Docker
-        shell: bash
-        run: |
-          set -euo pipefail
-          # The runner Pod itself uses an overlay filesystem. A nested overlay
-          # snapshotter cannot mount there, so use the copy-based vfs driver.
-          dockerd \
-            --storage-driver=vfs \
-            --feature containerd-snapshotter=false \
-            >/tmp/dockerd.log 2>&1 &
-          for _ in $(seq 1 60); do
-            if docker info >/dev/null 2>&1; then
-              exit 0
-            fi
-            if ! kill -0 "$!" 2>/dev/null; then
-              cat /tmp/dockerd.log >&2
-              exit 1
-            fi
-            sleep 1
-          done
-          cat /tmp/dockerd.log >&2
-          exit 1
-
       - name: Build and publish
         shell: bash
         run: |
@@ -74,10 +51,9 @@ jobs:
           image_tag="sha-${GITHUB_SHA}"
           docker_config=$(mktemp -d)
           jwt_file=$(mktemp)
-          buildkit_config=$(mktemp)
           cleanup() {
             docker buildx rm ci-builder >/dev/null 2>&1 || true
-            rm -rf -- "$docker_config" "$jwt_file" "$buildkit_config"
+            rm -rf -- "$docker_config" "$jwt_file"
           }
           trap cleanup EXIT
           export DOCKER_CONFIG="$docker_config"
@@ -90,17 +66,9 @@ jobs:
           jq -er '.[0].svids[0].svid' "$jwt_file" | \
             docker login "$PUSH_REGISTRY" --username zot --password-stdin
 
-          # The docker driver cannot publish attestations. Use an isolated
-          # BuildKit worker, but force its snapshotter to copy-based native so
-          # it does not attempt nested overlay mounts inside the runner Pod.
-          printf '%s\n' \
-            '[worker.oci]' \
-            '  snapshotter = "native"' \
-            >"$buildkit_config"
           docker buildx create \
             --name ci-builder \
             --driver docker-container \
-            --buildkitd-config "$buildkit_config" \
             --use
 
           publish() {