The buildx docker-container builder runs buildkitd in its own container and performs the push. It needs the artifactapi internal (Vault) CA via buildkit_config even though the plugin image already trusts it. Point the builder at the in-image CA baked at /etc/docker/certs.d/<registry>/ca.crt.
unkin-agent