Point the buildx docker-container builder at artifactapi's in-image CA
(/etc/docker/certs.d/.../ca.crt) so buildkitd, which runs in its own
container and performs the push, trusts the registry. Applied to both
push steps (docker-operator and docker-tsig-api). Proven in jellyfin-ha
v0.1.2.
unkin-agent