lets try another avenue...

.forgejo/workflows/runner-image.yml

@@ -24,36 +24,28 @@ jobs:
       - name: Prepare podman
         run: |
           # configure container policy to accept insecure registry
-          nix-env -iA nixpkgs.podman nixpkgs.kmod
+          nix-env -iA nixpkgs.podman
 
           # configure container policy to accept insecure registry
           mkdir -p ~/.config/containers
           echo '{ "default": [ {"type":"insecureAcceptAnything"} ] }' > ~/.config/containers/policy.json
-          
-          # ensure all required directories exist with proper permissions
-          mkdir -p /tmp/podman /var/tmp ~/.local/share/containers
-          chmod 755 /tmp/podman /var/tmp || true
-
-          # set multiple environment variables for skopeo temporary directories
-          export TMPDIR=/tmp/podman
-          export TMP=/tmp/podman
-          export TEMP=/tmp/podman
-          export XDG_RUNTIME_DIR=/tmp/podman
-
-          modprobe fuse
 
       - name: Log into registry
         run: |
           podman login --username "${{ forge.actor }}" --password "${{ forge.token }}" ${{ env.registry }}
 
       - name: Build image
-        run: >-
-          podman build
-          -t ${{ env.registry }}/${{ env.owner }}/${{ env.image }}:${{ env.tag }} 
-          -f Dockerfile.default
-          modules/nixos/services/development/forgejo
-        env:
-          DOCKER_BUILDKIT: 1
+        run: nix-build modules/nixos/services/development/forgejo/runners/default.nix
+        # run: >-
+        #   podman build
+        #   -t ${{ env.registry }}/${{ env.owner }}/${{ env.image }}:${{ env.tag }} 
+        #   -f Dockerfile.default
+        #   modules/nixos/services/development/forgejo
+
+      - name: __DEBUG__
+        run: |
+          ls -al result
+          podman load < result
 
       - name: Push image
         run: |

modules/nixos/services/development/forgejo/Dockerfile.default

@@ -1,8 +0,0 @@
-FROM docker.io/nixos/nix:latest
-
-RUN nix-env -iA nixpkgs.nodejs_24 nixpkgs.podman
-
-RUN echo "experimental-features = nix-command flakes pipe-operators" >> /etc/nix/nix.conf
-RUN echo '{ "default": [ {"type":"insecureAcceptAnything"} ] }' >> /etc/containers/policy.json
-
-CMD ["/bin/bash"]

modules/nixos/services/development/forgejo/runners/default.nix

@@ -0,0 +1,11 @@
+{
+  pkgs ? import <nixpkgs> {},
+  pkgs_linux ? import <nixpkgs> { system = "x86_64-linux"; },
+}:
+
+pkgs.dockerTools.buildImage {
+  name = "default";
+  config = {
+    Cmd = [ "${pkgs_linux.hello}/bin/hello" ];
+  };
+}