使用 native snapshotter 生成镜像证明

Reviewed-on: #15

.gitea/workflows/publish-images.yml

@@ -45,7 +45,12 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          dockerd >/tmp/dockerd.log 2>&1 &
+          # The runner Pod itself uses an overlay filesystem. A nested overlay
+          # snapshotter cannot mount there, so use the copy-based vfs driver.
+          dockerd \
+            --storage-driver=vfs \
+            --feature containerd-snapshotter=false \
+            >/tmp/dockerd.log 2>&1 &
           for _ in $(seq 1 60); do
             if docker info >/dev/null 2>&1; then
               exit 0
@@ -69,9 +74,10 @@ jobs:
           image_tag="sha-${GITHUB_SHA}"
           docker_config=$(mktemp -d)
           jwt_file=$(mktemp)
+          buildkit_config=$(mktemp)
           cleanup() {
-            rm -rf -- "$docker_config" "$jwt_file"
             docker buildx rm ci-builder >/dev/null 2>&1 || true
+            rm -rf -- "$docker_config" "$jwt_file" "$buildkit_config"
           }
           trap cleanup EXIT
           export DOCKER_CONFIG="$docker_config"
@@ -84,7 +90,18 @@ jobs:
           jq -er '.[0].svids[0].svid' "$jwt_file" | \
             docker login "$PUSH_REGISTRY" --username zot --password-stdin
 
-          docker buildx create --name ci-builder --driver docker-container --use
+          # The docker driver cannot publish attestations. Use an isolated
+          # BuildKit worker, but force its snapshotter to copy-based native so
+          # it does not attempt nested overlay mounts inside the runner Pod.
+          printf '%s\n' \
+            '[worker.oci]' \
+            '  snapshotter = "native"' \
+            >"$buildkit_config"
+          docker buildx create \
+            --name ci-builder \
+            --driver docker-container \
+            --buildkitd-config "$buildkit_config" \
+            --use
 
           publish() {
             local repository=$1