act_runner now runs privileged, and the job image ships docker+dockerd, so the build can happen directly in the job container. Needs vfs as the storage driver since overlay2 doesn't nest inside overlay2 on this host.
pmb