vikingowl
faa63de3c7
The default buildx driver inside docker:29-dind is 'docker' (host daemon), which cannot produce attestations. Even with default provenance enabled, the docker driver silently drops attestation-related flags and emits a bare single-image manifest. registry.itsh.dev (Zot with strict attestation policy) rejects these with 'manifest invalid'. Creating a 'docker-container' driver builder before each build gives buildkit full export capabilities, matching both the Woodpecker plugin's behavior and what works from local development machines.