Migrate docker builds to BuildKit

[j-rivero]

The Linux debbuilders still build with the legacy Docker builder.

Beyond the announced removal, the legacy builder does not include --platform in its layer-cache key. Combined with the containerd image store — where a multi-arch FROM resolves to the manifest index digest, identical for every platform — two builds for different architectures on the same agent share their whole cache chain. That is the root cause of #1529: an arm64 job adopted an armhf job's layers and installed 305 _armhf.deb before dying at the first freshly executed COPY.

#1529 was worked around by emitting an arch-specific LABEL as the first instruction after FROM, which keeps the chains apart. That fixes the symptom for the arch axis only; the cache remains platform-blind for anything else that might collide.

BuildKit keys its cache by platform and is the durable fix.

Work involved

• Install docker-buildx-plugin on the Linux agents (chef-osrf).
• Set DOCKER_BUILDKIT=1 for the docker build call in jenkins-scripts/docker/lib/docker_run.bash — note it runs under sudo, so the variable needs sudo -E or to be passed explicitly.
• Check the log-output changes. BuildKit drops the Step N/M markers and buffers RUN output differently; confirm the # BEGIN SECTION / # END SECTION greps and the Naginator retry regexes in jenkins-scripts/dsl/_configs_/Globals.groovy still match.
• Confirm cache behaviour is acceptable — BuildKit's local cache is separate from the image layer cache, so expect a one-time cold-cache cost across the fleet.
• Once BuildKit is in place, decide whether the osrf.build.arch LABEL workaround from arm* debbuilds can fail to get image with specified platform #1529 can be dropped.

Related

• arm* debbuilds can fail to get image with specified platform #1529 — arm debbuilds failing with does not provide the specified platform
• arm: use official Ubuntu images instead of osrf custom ones #1521 — moved arm64 to the official Ubuntu base image, which exposed the collision