runner-build

Purpose: make the host con-ci runner able to build OCI images with rootless buildah — never --privileged. This is a Kustomize Component that patches the runner Deployment, not a standalone workload.

Patches (manifests/components/runner-build/, kind: Component): adds to the runner container: - STORAGE_DRIVER=vfs + BUILDAH_ISOLATION=chroot (works without /dev/fuse), - subuid/subgid (1000:100000:65536) for the user-namespace mapping, - a squat.ai/fuse: "1" request (fuse device plugin) — the path to faster overlay+fuse-overlayfs.

Key facts: - Security: no privileged, no added caps beyond the rootless runtime; seccomp RuntimeDefault. - Pushes go to the Codeberg registry (codeberg.org) with a non-crown-jewel push token.

Status: DORMANT / superseded (2026-07-04). Image builds were moved to con-ci-oci (podman build, proven rootless there): the stock runner image ships no buildah binary and host jobs are non-root without a package manager, so this patch alone never yields a working build on con-ci. The component stays in the tree but out of the overlay; remove or revive it when the add-codeberg-ci-runners change is archived. See docs/troubleshooting.md ("buildah: command not found") for the decision trail.