From beb6dc31133b6f55aad6452f6f5527c87d8b07a7 Mon Sep 17 00:00:00 2001
From: Bot <bot@example.com>
Date: Mon, 2 Mar 2026 00:11:27 +0100
Subject: [PATCH] ci: use kaniko for local registry pushes

---
 .gitlab-ci.yml | 83 ++++++++++++++++++++++++--------------------------
 1 file changed, 40 insertions(+), 43 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 62daa0d..7e25852 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -4,64 +4,61 @@ stages:
 variables:
   REGISTRY_HOST: "10.10.10.10:5050"
   IMAGE_NAME: "$REGISTRY_HOST/$CI_PROJECT_PATH"
-  DOCKER_HOST: "tcp://docker:2375"
-  DOCKER_DRIVER: overlay2
-  DOCKER_TLS_CERTDIR: ""
   # Force clone via IP instead of hostname to bypass Unraid Docker DNS issues
   CI_SERVER_URL: "http://10.10.10.10:9080"
   GITLAB_FEATURES: ""
 
 docker-build:
   stage: build
-  image: docker:24.0.5
-  services:
-    - name: docker:24.0.5-dind
-      command:
-        - "--host=tcp://0.0.0.0:2375"
-        - "--host=unix:///tmp/docker.sock"
-        - "--tls=false"
-        - "--insecure-registry=10.10.10.10:5050"
+  image:
+    name: gcr.io/kaniko-project/executor:v1.23.2-debug
+    entrypoint: [""]
   rules:
     - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH
   before_script:
-    - echo "$CI_REGISTRY_PASSWORD" | docker login "$REGISTRY_HOST" -u "$CI_REGISTRY_USER" --password-stdin
+    - mkdir -p /kaniko/.docker
+    - |
+      cat > /kaniko/.docker/config.json <<EOF
+      {
+        "auths": {
+          "$REGISTRY_HOST": {
+            "username": "$CI_REGISTRY_USER",
+            "password": "$CI_REGISTRY_PASSWORD"
+          }
+        }
+      }
+      EOF
   script:
     - |
       if [ "$CI_COMMIT_REF_NAME" = "main" ]; then
-        export TAG="main"
-        export VERSION="1.1.0"
-        export CHANNEL="stable"
+        TAG="main"
+        VERSION="1.1.0"
+        CHANNEL="stable"
       elif [ "$CI_COMMIT_REF_NAME" = "feature/nightly" ] || [ "$CI_COMMIT_REF_NAME" = "nightly" ]; then
-        export TAG="nightly"
-        export VERSION="1.1.0-nightly"
-        export CHANNEL="nightly"
+        TAG="nightly"
+        VERSION="1.1.0-nightly"
+        CHANNEL="nightly"
       else
-        export CLEAN_TAG=$(echo "$CI_COMMIT_REF_NAME" | sed 's/\//-/g')
-        export TAG="$CLEAN_TAG"
-        export VERSION="1.1.0-dev"
-        export CHANNEL="dev"
+        CLEAN_TAG=$(echo "$CI_COMMIT_REF_NAME" | sed 's/\//-/g')
+        TAG="$CLEAN_TAG"
+        VERSION="1.1.0-dev"
+        CHANNEL="dev"
       fi
 
-    - echo "Building for channel $CHANNEL with version $VERSION and tag $TAG"
-
-    # Build
-    - docker pull $IMAGE_NAME:$TAG || true
-    - >
-      docker build
-      --cache-from $IMAGE_NAME:$TAG
-      --build-arg VITE_BUILD_CHANNEL=$CHANNEL
-      --build-arg VITE_APP_VERSION=$VERSION
-      -t $IMAGE_NAME:$CI_COMMIT_SHA
-      -t $IMAGE_NAME:$TAG
-      .
-
-    # Push
-    - docker push $IMAGE_NAME:$CI_COMMIT_SHA
-    - docker push $IMAGE_NAME:$TAG
-
-    # If main branch, also tag and push as latest
-    - |
+      DESTINATIONS="--destination=$IMAGE_NAME:$CI_COMMIT_SHA --destination=$IMAGE_NAME:$TAG"
       if [ "$CI_COMMIT_REF_NAME" = "main" ]; then
-        docker tag $IMAGE_NAME:$TAG $IMAGE_NAME:latest
-        docker push $IMAGE_NAME:latest
+        DESTINATIONS="$DESTINATIONS --destination=$IMAGE_NAME:latest"
       fi
+
+      echo "Building for channel $CHANNEL with version $VERSION and tag $TAG"
+      echo "Using registry image: $IMAGE_NAME"
+
+      /kaniko/executor \
+        --context "$CI_PROJECT_DIR" \
+        --dockerfile "$CI_PROJECT_DIR/Dockerfile" \
+        --build-arg "VITE_BUILD_CHANNEL=$CHANNEL" \
+        --build-arg "VITE_APP_VERSION=$VERSION" \
+        --insecure \
+        --insecure-registry "$REGISTRY_HOST" \
+        --skip-tls-verify-registry "$REGISTRY_HOST" \
+        $DESTINATIONS