# plugin-docker-buildx

A drop-in rebuild of `woodpeckerci/plugin-docker-buildx` with the internal
Vault-PKI CA baked in.

## Why

The stock `woodpeckerci/plugin-docker-buildx` image does not trust artifactapi's
internal CA, so k8s Woodpecker buildx jobs cannot push to
`artifactapi.k8s.syd1.au.unkin.net/docker-internal/*` — buildkit needs
`/etc/docker/certs.d/<registry>/ca.crt` inside the plugin container, and the k8s
backend has no way to inject it.

This image copies the `vault-ca-cert` bundle (root + intermediate) into that path
plus the system trust store, so pipelines can `settings.registry:
artifactapi.k8s.syd1.au.unkin.net` and push over TLS.

## Published as

`artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:<tag>` (and `:latest`)

## Bootstrap

This image is itself built and pushed by **buildah** (`.woodpecker/release.yaml`),
not by buildx, using `buildah push --tls-verify=false`. buildah is used precisely
because it sidesteps the buildx CA-trust problem that this image exists to fix —
its own push therefore cannot rely on that trust yet.

Once published, point Woodpecker docker-buildx steps at this image instead of the
upstream one to push to the docker-internal registry.