From f91b06da9d7585bfb6263143149488610743f42a Mon Sep 17 00:00:00 2001
From: Christian Werner <cwer542@gmail.com>
Date: Sat, 20 Jun 2026 04:53:45 +0200
Subject: [PATCH] fix(kernel): Use per-version tags in Docker build to isolate
 jobs

Prevent race conditions in concurrent job builds by introducing unique
Docker image tags per kernel version. This ensures isolated builds with
correct verm
---
 .gitea/workflows/build-kernel.yml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/build-kernel.yml b/.gitea/workflows/build-kernel.yml
index 7add102..09c47fd 100644
--- a/.gitea/workflows/build-kernel.yml
+++ b/.gitea/workflows/build-kernel.yml
@@ -51,23 +51,31 @@ jobs:
           if [ ! -e /proc/sys/fs/binfmt_misc/qemu-aarch64 ]; then
             docker run --privileged --rm tonistiigi/binfmt --install arm64
           fi
+          # Per-version image tag. The matrix entries can run concurrently on a
+          # single runner sharing one Docker daemon; a fixed tag (e.g. iec-kbuild)
+          # is then a shared mutable name and the builds race — whichever `docker
+          # build` finishes last wins the tag, so both `docker create` calls
+          # resolve to the same image and every job emits the same vermagic.
+          # A unique tag per kernel version isolates them.
+          img="iec-kbuild:${KERNEL_VERSION//[:\/]/-}"
           # Builder image: toolchain + matching raspberrypi kernel headers.
           docker build --platform linux/arm64 \
             --build-arg DEBIAN_SUITE="$DEBIAN_SUITE" \
             --build-arg HEADERS_PKG="$HEADERS_PKG" \
             --build-arg KERNEL_VERSION="$KERNEL_VERSION" \
-            -t iec-kbuild .
+            -t "$img" .
           # Compile inside the container. We use `docker cp` instead of the bind
           # mount that build-in-docker.sh uses for local builds: under the runner's
           # docker-in-docker, /workspace is a volume the host daemon can't see, so
           # `-v "$PWD:/build"` mounts an empty dir and make finds no Makefile.
-          cid=$(docker create --platform linux/arm64 --entrypoint sleep iec-kbuild infinity)
+          cid=$(docker create --platform linux/arm64 --entrypoint sleep "$img" infinity)
           docker start "$cid"
           docker cp ./. "$cid:/build"
           docker exec "$cid" /usr/local/bin/docker-entrypoint.sh clean
           docker exec "$cid" /usr/local/bin/docker-entrypoint.sh
           docker cp "$cid:/build/iec_listener.ko" ./iec_listener.ko
           docker rm -f "$cid"
+          docker rmi "$img" || true
 
       - name: Stage build output (modules/iec_listener_<kernel_version>.ko)
         working-directory: kernel