The stock woodpeckerci/plugin-docker-buildx image does not trust artifactapi's internal CA, so k8s Woodpecker buildx jobs cannot push to artifactapi.k8s.syd1.au.unkin.net/docker-internal/* — buildkit needs /etc/docker/certs.d/<registry>/ca.crt inside the plugin container, and the k8s backend has no way to inject it.

This image copies the vault-ca-cert bundle (root + intermediate) into that path plus the system trust store, so pipelines can settings.registry: artifactapi.k8s.syd1.au.unkin.net and push over TLS.

Published as

artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:<tag> (and :latest)

Bootstrap

This image is itself built and pushed by buildah (.woodpecker/release.yaml), not by buildx, using buildah push --tls-verify=false. buildah is used precisely because it sidesteps the buildx CA-trust problem that this image exists to fix — its own push therefore cannot rely on that trust yet.

Once published, point Woodpecker docker-buildx steps at this image instead of the upstream one to push to the docker-internal registry.