Switch buildx remote driver from TCP to docker-container

[dash14]

Summary

Switch the buildx remote driver connection from tcp://localhost:1234 to docker-container://buildcage.

Why

The TCP-based connection had several drawbacks:

• Unnecessary network exposure: The BuildKit API had to be exposed on a TCP port (1234) on the host, increasing the attack surface.
• Defensive complexity from TCP exposure: An iptables rule was needed to explicitly block access to the API port from inside the build container (buildkit0). This was a secondary security measure required solely because of the TCP exposure — not an inherently necessary concern.
• Port management overhead: The port parameter, its input/output plumbing, and a health check TCP probe were scattered across multiple files, adding incidental complexity.

The docker-container:// driver communicates through Docker's internal channel, eliminating the need to expose a TCP port entirely. This removes all of the above issues at once.

Changes

• Switch buildx endpoint to docker-container://buildcage
• Remove ports mapping from compose.yml
• Remove --addr tcp://0.0.0.0:1234 from buildkitd CMD
• Remove iptables rules blocking port 1234 access (no longer needed)
• Remove TCP port probe from health check
• Replace port input/output with builder_name input for container name configuration