ci: switch to rootful podman for image builds

Replace all rootless docker/podman calls with explicit 'sudo podman'
to eliminate the class of user namespace failures on the self-hosted
RISC-V runner (stale boot IDs, UID mapping permission denied, and
'cannot re-exec process to join existing user namespace').

Replace docker/login-action with direct 'sudo podman login' since
the GitHub Action can't use sudo. Add explicit logout step.

Requires runner-side setup: /usr/local/bin/docker wrapper that calls
'sudo podman' (needed for K8s build scripts that call docker
internally) and a passwordless sudoers entry for podman.

Author: brianredbeard

.github/workflows/build-riscv64.yml

@@ -138,11 +138,6 @@ jobs:
       - name: Clean workspace
         run: sudo rm -rf _output/ || true
 
-      - name: Reset Podman state
-        run: |
-          rm -rf /tmp/storage-run-$(id -u)/containers /tmp/storage-run-$(id -u)/libpod/tmp || true
-          podman system prune --force 2>/dev/null || true
-
       - name: Checkout
         uses: actions/checkout@v4
         with:
@@ -175,11 +170,9 @@ jobs:
           echo "K8S_VERSION=${K8S_VERSION}" >> "$GITHUB_ENV"
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | \
+            sudo podman login ghcr.io -u "${{ github.actor }}" --password-stdin
 
       - name: Build dependency images
         run: |
@@ -195,24 +188,24 @@ jobs:
           echo "KUBE_CROSS_TAG=${KUBE_CROSS_TAG}" >> "$GITHUB_ENV"
 
           # kube-cross
-          docker build \
+          sudo podman build \
             --build-arg GO_VERSION="${GO_VERSION}" \
             -t "${REGISTRY}/kube-cross:${KUBE_CROSS_TAG}" \
             riscv64/images/kube-cross/
 
           # go-runner
-          docker build \
+          sudo podman build \
             --build-arg GO_VERSION="${GO_VERSION}" \
             -t "${REGISTRY}/go-runner:${GO_RUNNER_TAG}" \
             riscv64/images/go-runner/
 
           # setcap
-          docker build \
+          sudo podman build \
             -t "${REGISTRY}/setcap:${SETCAP_TAG}" \
             riscv64/images/setcap/
 
           # distroless-iptables
-          docker build \
+          sudo podman build \
             --build-arg GORUNNERIMAGE="${REGISTRY}/go-runner:${GO_RUNNER_TAG}" \
             -t "${REGISTRY}/distroless-iptables:${IPTABLES_TAG}" \
             riscv64/images/distroless-iptables/
@@ -222,10 +215,10 @@ jobs:
           # BuildKit pulls base images from the registry rather than the
           # local Docker store, so dependency images must be pushed before
           # building server images.
-          docker push "${REGISTRY}/kube-cross:${KUBE_CROSS_TAG}"
-          docker push "${REGISTRY}/go-runner:${GO_RUNNER_TAG}"
-          docker push "${REGISTRY}/setcap:${SETCAP_TAG}"
-          docker push "${REGISTRY}/distroless-iptables:${IPTABLES_TAG}"
+          sudo podman push "${REGISTRY}/kube-cross:${KUBE_CROSS_TAG}"
+          sudo podman push "${REGISTRY}/go-runner:${GO_RUNNER_TAG}"
+          sudo podman push "${REGISTRY}/setcap:${SETCAP_TAG}"
+          sudo podman push "${REGISTRY}/distroless-iptables:${IPTABLES_TAG}"
 
       - name: Build Kubernetes component images
         run: |
@@ -259,28 +252,28 @@ jobs:
           gcc -Os -Wall -Werror -static -DVERSION=v${PAUSE_TAG}-${REV} \
             -o bin/pause-linux-riscv64 linux/pause.c
           strip bin/pause-linux-riscv64
-          docker buildx build --pull --output=type=docker --platform linux/riscv64 \
+          sudo podman build --platform linux/riscv64 \
             -t "${REGISTRY}/pause:${PAUSE_TAG}-linux-riscv64" \
             --build-arg BASE=scratch --build-arg ARCH=riscv64 .
 
       - name: Build ecosystem images
         run: |
           # etcd
-          docker build \
+          sudo podman build \
             --build-arg ETCD_VERSION="${ETCD_VERSION}" \
             --build-arg GO_VERSION="${GO_VERSION}" \
             -t "${REGISTRY}/etcd:${ETCD_VERSION}-riscv64" \
             riscv64/ecosystem/etcd/
 
           # CoreDNS
-          docker build \
+          sudo podman build \
             --build-arg COREDNS_VERSION="${COREDNS_VERSION}" \
             --build-arg GO_VERSION="${GO_VERSION}" \
             -t "${REGISTRY}/coredns:${COREDNS_VERSION}-riscv64" \
             riscv64/ecosystem/coredns/
 
           # Flannel
-          docker build \
+          sudo podman build \
             --build-arg FLANNEL_VERSION="${FLANNEL_VERSION}" \
             --build-arg GO_VERSION="${GO_VERSION}" \
             -t "${REGISTRY}/flannel:${FLANNEL_VERSION}-riscv64" \
@@ -291,7 +284,7 @@ jobs:
           echo "=== Kubernetes component images ==="
           for img in kube-apiserver kube-controller-manager kube-scheduler kube-proxy; do
             echo -n "${img}-riscv64: "
-            docker inspect "${REGISTRY}/${img}-riscv64:${K8S_VERSION}" --format '{{.Architecture}}' 2>/dev/null || echo "MISSING"
+            sudo podman inspect "${REGISTRY}/${img}-riscv64:${K8S_VERSION}" --format '{{.Architecture}}' 2>/dev/null || echo "MISSING"
           done
 
           echo "=== Dependency images ==="
@@ -300,38 +293,42 @@ jobs:
                      "setcap:${SETCAP_TAG}" \
                      "pause:${PAUSE_TAG}-linux-riscv64"; do
             echo -n "${img}: "
-            docker inspect "${REGISTRY}/${img}" --format '{{.Architecture}}' 2>/dev/null || echo "MISSING"
+            sudo podman inspect "${REGISTRY}/${img}" --format '{{.Architecture}}' 2>/dev/null || echo "MISSING"
           done
 
           echo "=== Ecosystem images ==="
           for img in "etcd:${ETCD_VERSION}-riscv64" \
                      "coredns:${COREDNS_VERSION}-riscv64" \
                      "flannel:${FLANNEL_VERSION}-riscv64"; do
             echo -n "${img}: "
-            docker inspect "${REGISTRY}/${img}" --format '{{.Architecture}}' 2>/dev/null || echo "MISSING"
+            sudo podman inspect "${REGISTRY}/${img}" --format '{{.Architecture}}' 2>/dev/null || echo "MISSING"
           done
 
       - name: Push images
         if: inputs.publish == true || github.event_name == 'schedule'
         run: |
           # Kubernetes components (arch-suffixed per upstream convention)
           for img in kube-apiserver kube-controller-manager kube-scheduler kube-proxy; do
-            docker push "${REGISTRY}/${img}-riscv64:${K8S_VERSION}"
+            sudo podman push "${REGISTRY}/${img}-riscv64:${K8S_VERSION}"
           done
 
           # Pause
-          docker push "${REGISTRY}/pause:${PAUSE_TAG}-linux-riscv64"
+          sudo podman push "${REGISTRY}/pause:${PAUSE_TAG}-linux-riscv64"
 
           # Dependency images (already pushed before make release-images,
           # re-push is a no-op but keeps the release gate explicit)
-          docker push "${REGISTRY}/go-runner:${GO_RUNNER_TAG}"
-          docker push "${REGISTRY}/distroless-iptables:${IPTABLES_TAG}"
-          docker push "${REGISTRY}/setcap:${SETCAP_TAG}"
+          sudo podman push "${REGISTRY}/go-runner:${GO_RUNNER_TAG}"
+          sudo podman push "${REGISTRY}/distroless-iptables:${IPTABLES_TAG}"
+          sudo podman push "${REGISTRY}/setcap:${SETCAP_TAG}"
 
           # Ecosystem
-          docker push "${REGISTRY}/etcd:${ETCD_VERSION}-riscv64"
-          docker push "${REGISTRY}/coredns:${COREDNS_VERSION}-riscv64"
-          docker push "${REGISTRY}/flannel:${FLANNEL_VERSION}-riscv64"
+          sudo podman push "${REGISTRY}/etcd:${ETCD_VERSION}-riscv64"
+          sudo podman push "${REGISTRY}/coredns:${COREDNS_VERSION}-riscv64"
+          sudo podman push "${REGISTRY}/flannel:${FLANNEL_VERSION}-riscv64"
+
+      - name: Log out of GHCR
+        if: always()
+        run: sudo podman logout ghcr.io || true
 
   release:
     name: Create release