Buildkit runs in a docker-container driver where the self-signed CA is not trusted. Instead of mounting certs into buildkit, configure buildkit to push via HTTP — Traefik handles TLS termination at the edge. Uses YAML anchors to DRY up the 5 buildx step configs.