From 6e67f62ffe71c6e1e0dbb9e0132b1038d1440c7d Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Sun, 26 Apr 2026 01:20:45 -0500
Subject: [PATCH] =?UTF-8?q?Switch=20BuildKit=20to=20privileged=20mode=20?=
 =?UTF-8?q?=E2=80=94=20rootless=20fails=20on=20k3s=20mount=20propagation?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 servers/legion/k8s/gitea-runner/buildkitd.yaml | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/servers/legion/k8s/gitea-runner/buildkitd.yaml b/servers/legion/k8s/gitea-runner/buildkitd.yaml
index 4e18a65..b3241ae 100644
--- a/servers/legion/k8s/gitea-runner/buildkitd.yaml
+++ b/servers/legion/k8s/gitea-runner/buildkitd.yaml
@@ -1,7 +1,8 @@
 ---
-# BuildKit daemon — rootless image builder for CI runners.
-# Replaces the /var/run/docker.sock hostPath mount that gave containers
-# full root access to the Legion host node.
+# BuildKit daemon — privileged image builder for CI runners.
+# Runs as root with privileged=true in the isolated ci namespace.
+# Rootless mode (moby/buildkit:*-rootless) fails on k3s/containerd because
+# rootlesskit cannot share mount propagation on the container root fs.
 #
 # Runners connect via TCP: DOCKER_HOST=tcp://buildkitd.ci.svc.cluster.local:1234
 apiVersion: apps/v1
@@ -23,9 +24,8 @@ spec:
     spec:
       containers:
         - name: buildkitd
-          image: moby/buildkit:v0.19.0-rootless
+          image: moby/buildkit:v0.19.0
           args:
-            - --oci-worker-no-process-sandbox
             - --addr
             - tcp://0.0.0.0:1234
             - --addr
@@ -34,11 +34,7 @@ spec:
             - name: tcp
               containerPort: 1234
           securityContext:
-            seccompProfile:
-              type: Unconfined            # BuildKit rootless requires this
-            runAsUser: 1000
-            runAsGroup: 1000
-            allowPrivilegeEscalation: true  # required for newuidmap/newgidmap setuid binaries
+            privileged: true
           readinessProbe:
             exec:
               command: ["buildctl", "debug", "workers"]
@@ -53,7 +49,7 @@ spec:
               memory: 4Gi
           volumeMounts:
             - name: buildkit-storage
-              mountPath: /home/user/.local/share/buildkit
+              mountPath: /var/lib/buildkit
       volumes:
         - name: buildkit-storage
           emptyDir: {}