fix(docker): drop /var/run symlink from chisel rootfs for Kaniko

The runtime stage copies the chisel rootfs onto `/` in a scratch stage.
chisel ships /var/run as a symlink to /run; Kaniko replacing it forces a
RemoveAll of the destination /var/run, which on the Forgejo act runner
holds a busy /var/run/act bind-mount -> 'unlinkat ... device or resource
busy'. The image does not need /var/run, so remove the symlink.

.github/workflows/deploy.yml

@@ -1,25 +1,53 @@
-name: Deploy
+name: Build & Publish
+# Fork build pipeline for the "zo" forge (git.ziemlichoptimal.de/moby/brewlog).
+# On every push to `dev` this checks the code, then builds the container and
+# publishes it to this forge's own container registry. The moby homelab
+# (git.ziemlichoptimal.de/moby/cluster-moby) deploys the resulting image via
+# Flux GitOps — this pipeline does NOT deploy anything itself (the upstream
+# Fly.io deploy step was removed).
 on:
   push:
-    branches: ["main"]
+    branches: ["dev"]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# The registry push uses a PAT with `write:package` scope, supplied via the
+# REGISTRY_USER / REGISTRY_TOKEN Actions secrets (same as moby/uberbau_xyz and
+# moby/claude-code). Forgejo's auto GITHUB_TOKEN lacks org package-write, so a
+# push authenticated with it 401s (reqPackageAccess). `contents: read` keeps the
+# Kaniko git-context clone (over the auto token) working; `packages: write` is
+# belt-and-suspenders on the auto token.
+permissions:
+  contents: read
+  packages: write
+
+env:
+  # This forge's built-in container registry, same host as the git server.
+  REGISTRY: git.ziemlichoptimal.de
+  IMAGE: git.ziemlichoptimal.de/moby/brewlog
+
 jobs:
   check:
     name: Check
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
-      - name: Install mise
-        uses: jdx/mise-action@v4
+      # The repo's mise.toml pulls the whole dev toolchain (tailwind, cargo-watch,
+      # flyctl, shellcheck, ...), and mise resolves most of those via the GitHub
+      # API — which 401s on this runner (it has no github.com token), failing the
+      # entire install. CI only needs the pinned Rust toolchain, so install it
+      # directly via mise (rust resolves through rustup, no GitHub API).
+      - name: Install Rust toolchain
+        uses: https://github.com/jdx/mise-action@v2
+        with:
+          install_args: rust
 
       - name: Cache Cargo artifacts
-        uses: actions/cache@v5
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry/index/
@@ -31,11 +59,10 @@ jobs:
             cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-
             cargo-${{ runner.os }}-
 
+      # No sudo on the node:20-bookworm runner image (job runs as root). mold is
+      # required by .cargo/config.toml's linker flag (-fuse-ld=mold).
       - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y clang lld mold libssl-dev pkg-config
-
-      - name: Ensure Rust components
-        run: rustup component add rustfmt clippy
+        run: apt-get update && apt-get install -y --no-install-recommends clang lld mold pkg-config
 
       - name: Check formatting
         run: cargo fmt -- --check
@@ -46,44 +73,46 @@ jobs:
       - name: Run tests
         run: cargo test -- --show-output
 
-  deploy:
-    name: Deploy
+  build:
+    name: Build & Publish
     runs-on: ubuntu-latest
     needs: [check]
+    # Build the image DAEMONLESS with Kaniko — no Docker, no buildx, no
+    # privileged DinD. The job runs *inside* the Kaniko executor image, which
+    # builds the Dockerfile and pushes straight to the forge registry.
+    container:
+      image: gcr.io/kaniko-project/executor:v1.24.0-debug
+    defaults:
+      run:
+        # The kaniko -debug image is busybox-only (no bash).
+        shell: sh
     steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Install mise
-        uses: jdx/mise-action@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract version from Cargo.toml
-        id: version
-        run: echo "version=$(grep '^version = ' Cargo.toml | head -1 | cut -d'"' -f2)" >> "$GITHUB_OUTPUT"
-
-      - name: Build and push container
-        uses: docker/build-push-action@v7
-        with:
-          context: .
-          push: true
-          tags: |
-            ghcr.io/jnsgruk/brewlog:${{ github.sha }}
-            ghcr.io/jnsgruk/brewlog:latest
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: Deploy to Fly.io
-        run: |
-          flyctl deploy -i "ghcr.io/jnsgruk/brewlog:${{ github.sha }}"
+      - name: Build and push (Kaniko)
         env:
-          FLY_ACCESS_TOKEN: ${{ secrets.FLY_API_TOKEN }}
+          # Registry push uses a PAT with write:package scope (Forgejo's auto
+          # GITHUB_TOKEN lacks org package-write -> 401 reqPackageAccess).
+          FORGE_USER: ${{ secrets.REGISTRY_USER }}
+          FORGE_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          # Kaniko clones the `--context` git URL over the auto token (read).
+          GIT_USERNAME: ${{ github.actor }}
+          GIT_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -eu
+          # Registry auth for the push (docker config.json format).
+          AUTH=$(printf '%s:%s' "$FORGE_USER" "$FORGE_TOKEN" | base64 | tr -d '\n')
+          mkdir -p /kaniko/.docker
+          printf '{"auths":{"%s":{"auth":"%s"}}}' "$REGISTRY" "$AUTH" > /kaniko/.docker/config.json
+          # Kaniko clones the context itself (this job has no node for JS actions
+          # like checkout). `dev` is the moving branch tag; the commit SHA is the
+          # immutable ref the moby Deployment pins by digest.
+          # The runtime stage is `FROM scratch` + `COPY /rootfs /`, so Kaniko
+          # rebuilds the container root. The act runner bind-mounts /var/run/act
+          # into the job container; Kaniko can't unlink that busy mount while
+          # laying down the rootfs (unlinkat ... device or resource busy), so
+          # ignore it. It is a runner artifact and must not be in the image.
+          /kaniko/executor \
+            --context "git://${REGISTRY}/moby/brewlog.git#refs/heads/dev" \
+            --dockerfile Dockerfile \
+            --ignore-path=/var/run/act \
+            --destination "${IMAGE}:${GITHUB_SHA}" \
+            --destination "${IMAGE}:dev"

.github/workflows/push.yml

@@ -1,7 +1,7 @@
 name: CI
 on:
   pull_request:
-    branches: ["main"]
+    branches: ["dev"]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -13,13 +13,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Install mise
-        uses: jdx/mise-action@v4
+        uses: https://github.com/jdx/mise-action@v2
 
       - name: Cache Cargo artifacts
-        uses: actions/cache@v5
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry/index/
@@ -51,13 +51,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Install mise
-        uses: jdx/mise-action@v4
+        uses: https://github.com/jdx/mise-action@v2
 
       - name: Cache Cargo artifacts
-        uses: actions/cache@v5
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry/index/

Dockerfile

@@ -30,9 +30,10 @@ RUN mkdir -p /usr/local/bin \
 WORKDIR /app
 COPY . .
 
-RUN --mount=type=cache,target=/usr/local/cargo/registry \
-    --mount=type=cache,target=/app/target \
-    cargo build --release --locked \
+# NB: no `RUN --mount=type=cache` here on purpose. The CI image builder is
+# Kaniko (daemonless, no Docker/BuildKit), which does not support BuildKit cache
+# mounts — it errors on them. Keep this RUN plain. See README "CI / build".
+RUN cargo build --release --locked \
     && mkdir -p /out \
     && cp target/release/brewlog /out/brewlog
 
@@ -61,6 +62,14 @@ RUN useradd --root /rootfs -u 1000 -U -M -s /bin/false brewlog \
     && mkdir -p /rootfs/home/brewlog /rootfs/data \
     && chown 1000:1000 /rootfs/home/brewlog /rootfs/data
 
+# chisel's base-files ships /var/run as a symlink to /run. When the CI builder
+# (Kaniko) lays this rootfs onto `/` for the scratch stage, replacing that
+# symlink forces a RemoveAll of the destination /var/run — which on the Forgejo
+# act runner is a directory holding a busy /var/run/act bind-mount, so the copy
+# fails with "unlinkat /var/run/act: device or resource busy". The runtime image
+# does not need /var/run, so drop the symlink to avoid the collision.
+RUN rm -rf /rootfs/var/run
+
 # ---------------------------------------------------------------------------
 # Runtime — scratch with chisel rootfs
 # ---------------------------------------------------------------------------

README.md

@@ -165,6 +165,37 @@ cargo build               # Build
 
 See [CLAUDE.md](CLAUDE.md) for architecture, code patterns, and development conventions.
 
+## CI / build pipeline (this fork)
+
+This fork lives on the **zo** Forgejo forge
+(`git.ziemlichoptimal.de/uberbau/brewlog`, default branch **`dev`**) and is
+deployed to the **moby** homelab via Flux GitOps. `.github/workflows/deploy.yml`
+runs on every push to `dev`: it lints/tests (`check`), then builds and publishes
+the container image to the forge's own registry as
+`git.ziemlichoptimal.de/uberbau/brewlog:{dev,<sha>}`. The moby deployment pins
+that image by digest and bumps it per release.
+
+The build is **daemonless — it does not use Docker**. It runs
+[Kaniko](https://github.com/GoogleContainerTools/kaniko) as the job container,
+building the `Dockerfile` (context pulled straight from git) and pushing to the
+registry. No `docker`, no buildx, no privileged Docker-in-Docker.
+
+### Gotchas (learned the hard way)
+
+- **Kaniko does not support BuildKit `RUN --mount=type=cache`.** The build fails
+  on it. Keep every `RUN` in the `Dockerfile` plain — no BuildKit cache mounts.
+  (This is why the Rust build layer is a plain `cargo build`; we have been bitten
+  by this before, so do not "re-add caching" to the Dockerfile.)
+- **The forge's Actions runner is node20-only.** Pin JS actions to their node20
+  generation (`actions/checkout@v4`, `actions/cache@v4`, and if you reintroduce
+  docker actions, `@v3`/`@v6`) — the newer `@v5/@v6/@v7` releases declare
+  `runs.using: node24`, which the runner rejects (`must be one of [… node20 …]`).
+- **Reference actions by full `github.com` URL**
+  (`uses: https://github.com/owner/repo@ref`). The runner's default action
+  mirror (`code.forgejo.org`) is incomplete/flaky and aborts clones mid-run.
+- The `check` job installs only Rust via mise (`install_args: rust`); the full
+  `mise.toml` toolchain pulls tools from the GitHub API, which 401s on the runner.
+
 ## License
 
 [Apache License 2.0](LICENSE)