fix(ci): use Kaniko for base image build (no privileged mode)

Co-authored-by: Jason Woltje <jason@diversecanvas.com>
Co-committed-by: Jason Woltje <jason@diversecanvas.com>

.woodpecker/base-image.yml

@@ -3,16 +3,25 @@ when:
   - event: cron
     cron: weekly-base-image
 
+variables:
+  - &kaniko_setup |
+    mkdir -p /kaniko/.docker
+    echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$GITEA_USER\",\"password\":\"$GITEA_TOKEN\"}}}" > /kaniko/.docker/config.json
+
 steps:
   build-base:
-    image: woodpeckerci/plugin-docker-buildx:latest
-    privileged: true
-    settings:
-      registry: git.mosaicstack.dev
-      repo: git.mosaicstack.dev/mosaic/node-base
-      tags: 24-slim
-      dockerfile: docker/base.Dockerfile
-      username:
-        from_secret: gitea_user
-      password:
+    image: gcr.io/kaniko-project/executor:debug
+    environment:
+      GITEA_USER:
+        from_secret: gitea_username
+      GITEA_TOKEN:
         from_secret: gitea_token
+    commands:
+      - *kaniko_setup
+      - /kaniko/executor
+          --context .
+          --dockerfile docker/base.Dockerfile
+          --destination git.mosaicstack.dev/mosaic/node-base:24-slim
+          --destination git.mosaicstack.dev/mosaic/node-base:latest
+          --cache=true
+          --cache-repo git.mosaicstack.dev/mosaic/node-base/cache