Set up rootless (daemonless-Docker) BuildKit as the image-build backend for CI/Kubernetes, running buildkitd as a non-root user inside a container.

Documented steps

1. Reference doc: https://github.com/moby/buildkit/blob/master/docs/rootless.md. Install RootlessKit (github.com/rootless-containers/rootlesskit) then start the daemon rootless: `rootlesskit buildkitd`, and connect with `buildctl --addr unix:///run/user/$UID/buildkit/buildkitd.sock build ...`. For network isolation (recommended): `rootlesskit --net=gvisor-tap-vsock --copy-up=/etc --disable-host-loopback buildkitd` (use slirp4netns instead of gvisor-tap-vsock if RootlessKit < v3.0).
2. Containerized (Docker) rootless run: `docker run --name buildkitd -d --security-opt seccomp=unconfined --security-opt apparmor=unconfined --security-opt systempaths=unconfined moby/buildkit:rootless`, then `buildctl --addr docker-container://buildkitd build ...`.
3. In Kubernetes, use the official example manifests at github.com/moby/buildkit/tree/master/examples/kubernetes (pod.rootless.yaml, deployment+service.rootless.yaml, statefulset.rootless.yaml, job.rootless.yaml). Prefer the *.rootless.yaml variants to minimize container-breakout risk; fall back to *.privileged.yaml if rootless mode doesn't work in your cluster. Apply with `kubectl apply -f pod.rootless.yaml` then run `buildctl --addr kube-pod://buildkitd build --frontend dockerfile.v0 --local context=/path --local dockerfile=/path` (requires RBAC access to pods/exec; if unavailable, use the Deployment+Service variant with mTLS instead).
4. Key pod.rootless.yaml settings (from examples/kubernetes/pod.rootless.yaml): image `moby/buildkit:master-rootless`, args: ['--oci-worker-no-process-sandbox'], securityContext: seccompProfile.type=Unconfined (needs K8s >=1.19), appArmorProfile.type=Unconfined (needs K8s >=1.30), runAsUser=1000, runAsGroup=1000; mount an emptyDir volume at /home/user/.local/share/buildkit (the image's default VOLUME there doesn't work rootless on nosuid/nodev filesystems like GKE COS). Readiness/liveness probes run `buildctl debug workers`.
5. `--oci-worker-no-process-sandbox` (a buildkitd flag) is used in place of Docker's `--security-opt systempaths=unconfined` because Kubernetes lacks an equivalent option; it avoids creating a new PID namespace, but is discouraged outside Kubernetes since it can't terminate leftover ExecOp processes and allows ExecOp containers to kill/ptrace arbitrary processes in the buildkitd container (docs/rootless.md).
6. For a single ephemeral container doing client+daemon in one shot ('daemonless mode'), use the moby/buildkit:master-rootless image's buildctl-daemonless.sh entrypoint: `docker run -it --rm --security-opt seccomp=unconfined --security-opt apparmor=unconfined --security-opt systempaths=unconfined -v /path/to/dir:/tmp/work --entrypoint buildctl-daemonless.sh moby/buildkit:master-rootless build --frontend dockerfile.v0 --local context=/tmp/work --local dockerfile=/tmp/work` (from the moby/buildkit README 'Daemonless' section).