FROM docker.io/woodpeckerci/plugin-docker-buildx:latest
# buildkit reads this to trust artifactapi's internal-CA registry on push
COPY unkin-ca.crt /etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt
# fallback: system trust store (docker login / other code paths)
COPY unkin-ca.crt /usr/local/share/ca-certificates/unkin-ca.crt
RUN cat /usr/local/share/ca-certificates/unkin-ca.crt >> /etc/ssl/certs/ca-certificates.crt || true