The default docker-container driver of docker/setup-buildx-action ignores
driver-opts labels (container created with labels={}) and the Docker API
cannot PATCH labels on existing containers. Start a privileged, labeled
buildkitd ourselves (idempotent, restart unless-stopped) and connect via
driver: remote endpoint docker-container://<name>.
meda