From 075a3c7705f89a22e08e9ab2f12b5b06a2b06f53 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=90=D0=BB=D0=B5=D0=BA=D1=81=D0=B0=D0=BD=D0=B4=D1=80=20?=
 =?UTF-8?q?=D0=97=D0=B8=D0=BC=D0=B8=D0=BD?= <zimin.an@nstart.space>
Date: Sun, 3 May 2026 22:08:30 +0300
Subject: [PATCH] ci: use corp docker-cli-buildx image and dind 29.1.2

Switch to the working pattern provided by infra team:
- image: repo.nstart.cloud/nstart/docker-cli-buildx:1.0.0 (corp-built
  client with proper Harbor credentials baked in / runner-friendly)
- service: docker:29.1.2-dind (matches runner-tested version)
- explicit --tls=false + DOCKER_HOST=tcp://docker:2375 + DOCKER_TLS_CERTDIR=''
The earlier docker:26 + custom TLS attempts hit shared-volume issues
specific to this runner setup.
---
 .gitlab-ci.yml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index d40be57..af054e3 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -62,15 +62,14 @@ maven-package:
 # ─── PUBLISH (Docker images) ───────────────────
 .docker_base:
   stage: publish
-  image: repo.nstart.cloud/library/docker:26
+  image: repo.nstart.cloud/nstart/docker-cli-buildx:1.0.0
   services:
-    - name: repo.nstart.cloud/library/docker:26-dind
+    - name: repo.nstart.cloud/library/docker:29.1.2-dind
       alias: docker
+      command: ["--tls=false"]
   variables:
-    DOCKER_HOST: tcp://docker:2376
-    DOCKER_TLS_CERTDIR: /certs
-    DOCKER_TLS_VERIFY: "1"
-    DOCKER_CERT_PATH: /certs/client
+    DOCKER_HOST: tcp://docker:2375
+    DOCKER_TLS_CERTDIR: ""
     DOCKER_BUILDKIT: "1"
 
 # Build & push в repo.nstart.cloud (corp Harbor) — единый registry для всех окружений.