Fix the arm64 kiosk release build

.dockerignore

@@ -0,0 +1,15 @@
+.git
+.gitea
+node_modules
+**/node_modules
+target
+**/target
+build
+**/build
+.svelte-kit
+**/.svelte-kit
+data
+infra/certs
+*.db
+*.db-shm
+*.db-wal

.gitea/workflows/release.yml

@@ -1,7 +1,8 @@
 name: Release
 
 # Container images are published separately by publish-images.yml. This builds the kiosk
-# package for the Pi, which needs an arm64 toolchain rather than a Docker build.
+# package for the Pi, which needs an arm64 toolchain, so it goes through buildx and QEMU
+# rather than running on the host directly.
 on:
   push:
     tags: ["v*"]
@@ -17,35 +18,22 @@ jobs:
         with:
           platforms: arm64
 
+      - uses: docker/setup-buildx-action@v3
+
       - name: Build the kiosk bundle for arm64
-        run: |
-          docker run --rm --platform linux/arm64 \
-            -v "$PWD:/work" -w /work \
-            arm64v8/debian:bookworm \
-            bash -eux -c '
-              export DEBIAN_FRONTEND=noninteractive
-              apt-get update
-              apt-get install -y --no-install-recommends \
-                curl ca-certificates unzip build-essential file wget \
-                libwebkit2gtk-4.1-dev libgtk-3-dev librsvg2-dev \
-                libayatana-appindicator3-dev libssl-dev patchelf pkg-config
-
-              curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal
-              . "$HOME/.cargo/env"
-
-              curl -fsSL https://bun.sh/install | bash
-              export PATH="$HOME/.bun/bin:$PATH"
-
-              bun install
-              export PATH="/work/node_modules/.bin:$PATH"
-              bun run build:kiosk
-            '
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./apps/kiosk-client/Dockerfile.bundle
+          platforms: linux/arm64
+          target: bundle
+          outputs: type=local,dest=bundle
 
       - name: Collect artifacts
         run: |
           mkdir -p dist
-          find apps/kiosk-client/src-tauri/target/release/bundle -name '*.deb' -exec cp {} dist/ \;
-          find apps/kiosk-client/src-tauri/target/release/bundle -name '*.AppImage' -exec cp {} dist/ \;
+          find bundle -name '*.deb' -exec cp {} dist/ \;
+          find bundle -name '*.AppImage' -exec cp {} dist/ \;
           ls -lh dist
 
       - uses: actions/upload-artifact@v4

apps/kiosk-client/Dockerfile.bundle

@@ -0,0 +1,34 @@
+FROM rust:1-bookworm AS build
+
+ENV DEBIAN_FRONTEND=noninteractive
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        build-essential \
+        file \
+        libayatana-appindicator3-dev \
+        libgtk-3-dev \
+        librsvg2-dev \
+        libssl-dev \
+        libwebkit2gtk-4.1-dev \
+        patchelf \
+        pkg-config \
+        unzip \
+        wget \
+        xdg-utils \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV BUN_INSTALL=/usr/local
+RUN curl -fsSL https://bun.sh/install | bash
+
+WORKDIR /work
+ENV NODE_ENV=development
+
+COPY package.json ./
+COPY packages packages
+COPY apps/kiosk-client apps/kiosk-client
+
+RUN bun install
+RUN bun run build:kiosk
+
+FROM scratch AS bundle
+COPY --from=build /work/apps/kiosk-client/src-tauri/target/release/bundle /