By: Michael Lynch <git@mtlynch.io>
Make Dockerfile CI runner match local execution Run Kaniko against a temporary git-tracked build context instead of bind-mounting the real checkout into PRoot. This keeps local runs and NixCI on the same execution path and prevents Kaniko stage cleanup from touching the repository. Use the Alpine Go builder image so PRoot does not need to chmod Debian account-management binaries such as /usr/bin/chage while extracting the builder base image on NixCI.