feat: add crane for daemonless kpack -src image packaging

Rootless buildah needs user namespaces, which Talos keeps disabled.
crane append can push scratch source images without that host tradeoff.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: miragecentury

AGENTS.md

@@ -8,7 +8,7 @@ Self-hosted GitHub Actions runner **container image** for Deerhide / Velmios CI:
 
 - Image: `ghcr.io/deerhide/python-github-runner`
 - Base: `ghcr.io/actions/actions-runner` (`RUNNER_VERSION` in `manifest.yaml`)
-- Includes Python 3.12/3.13 (deadsnakes), Poetry, UV, DevOps CLIs (argo, kargo, kubectl, pack, skopeo, buildah, …), OpenAPI CLIs (redocly, spectral, portman, newman, oasdiff), Node/Bun, Rust + Zig + cargo-lambda (AWS Lambda Rust CI), and a full OCI build/scan pipeline so the image can build itself.
+- Includes Python 3.12/3.13 (deadsnakes), Poetry, UV, DevOps CLIs (argo, kargo, kubectl, pack, crane, skopeo, buildah, …), OpenAPI CLIs (redocly, spectral, portman, newman, oasdiff), Node/Bun, Rust + Zig + cargo-lambda (AWS Lambda Rust CI), and a full OCI build/scan pipeline so the image can build itself.
 
 Tool inventory and version tables live in [README.md](README.md). Do not duplicate them here.
 

Containerfile

@@ -127,6 +127,16 @@ RUN curl -sSL -o /tmp/pack.tgz \
     && tar -xzf /tmp/pack.tgz -C /usr/local/bin/ \
     && rm /tmp/pack.tgz
 
+# Install crane (daemonless OCI append/push for kpack -src images; no userns)
+ARG CRANE_VERSION=0.21.8
+RUN curl -sSL -o /tmp/crane.tgz \
+      "https://github.com/google/go-containerregistry/releases/download/v${CRANE_VERSION}/go-containerregistry_Linux_x86_64.tar.gz" \
+    && tar -xzf /tmp/crane.tgz -C /tmp crane \
+    && mv /tmp/crane /usr/local/bin/crane \
+    && chmod +x /usr/local/bin/crane \
+    && rm -f /tmp/crane.tgz \
+    && crane version
+
 # Install Node.js (bundles npm and npx)
 ARG NODE_VERSION=24.18.0
 RUN curl -sSL -o /tmp/node.tgz \

README.md

@@ -47,6 +47,7 @@ These tools allow the image to run its own build pipeline as a self-hosted runne
 | Tool | Description |
 |------|-------------|
 | [buildah](https://github.com/containers/buildah) | OCI container image builder |
+| [crane](https://github.com/google/go-containerregistry) | Daemonless OCI append/push (`CRANE_VERSION`; kpack `-src` packaging) |
 | [dive](https://github.com/wagoodman/dive) | Container filesystem analysis |
 | [trivy](https://github.com/aquasecurity/trivy) | Vulnerability scanner |
 | [syft](https://github.com/anchore/syft) | Software bill of materials (SBOM) generator |

manifest.yaml

@@ -9,6 +9,7 @@ build:
     - ARGO_VERSION=4.0.7
     - KARGO_VERSION=1.10.8
     - PACK_VERSION=0.40.8
+    - CRANE_VERSION=0.21.8
     - KUBECTL_VERSION=1.36.2
     - GH_CLI_VERSION=2.96.0
     - DIVE_VERSION=0.13.1

renovate.json

@@ -94,6 +94,15 @@
       "datasourceTemplate": "github-releases",
       "extractVersionTemplate": "^v?(?<version>.+)$"
     },
+    {
+      "customType": "regex",
+      "description": "Update crane (go-containerregistry) version",
+      "fileMatch": ["^Containerfile$", "^manifest\\.yaml$"],
+      "matchStrings": ["CRANE_VERSION=(?<currentValue>\\S+)"],
+      "depNameTemplate": "google/go-containerregistry",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v?(?<version>.+)$"
+    },
     {
       "customType": "regex",
       "description": "Update Node.js version",