The runtime stage copies the chisel rootfs onto `/` in a scratch stage.
chisel ships /var/run as a symlink to /run; Kaniko replacing it forces a
RemoveAll of the destination /var/run, which on the Forgejo act runner
holds a busy /var/run/act bind-mount -> 'unlinkat ... device or resource
busy'. The image does not need /var/run, so remove the symlink.
Replace the docker buildx / build-push-action build job with Kaniko running as
the job container: it builds the Dockerfile from the git context and pushes to
the forge registry, with no Docker daemon, no buildx, and no privileged DinD.
Kaniko cannot handle BuildKit `RUN --mount=type=cache`, so drop the two cache
mounts on the cargo build layer (plain `cargo build` now). Document the pipeline
and this gotcha (plus the node20-only runner and full-github-URL action rules) in
the README so it isn't reintroduced.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add brewlog user/group (UID/GID 1000) to chiseled rootfs via
base-passwd_data slice and useradd. Set USER 1000:1000 in the
runtime stage. Requires a one-time remediation deploy (with
gosu + chown entrypoint) to fix existing volume permissions
before this can be used.
Replace Nix flake with mise for toolchain management, treefmt for
formatting, prek for pre-commit hooks, and a Dockerfile for container
builds. Update CI workflows to use jdx/mise-action instead of Nix.
Add system dependency instructions to README.md and CLAUDE.md.
