Fix CI image build failures on runners with isolated DinD DNS.

Copy the Docker CLI from the official image instead of apt, and use
--network=host during docker build so apt and layer pulls can resolve
external registries on standalone runners.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/ci-image.yml

@@ -37,7 +37,7 @@ jobs:
           CI_RUNNER_TOKEN: ${{ secrets.CI_RUNNER_TOKEN }}
         run: |
           echo "$CI_RUNNER_TOKEN" > /tmp/uv_token
-          docker build -f docker/ci/Dockerfile \
+          docker build --network=host -f docker/ci/Dockerfile \
             --secret id=uv_token,src=/tmp/uv_token \
             -t "${IMAGE}:latest" \
             .

docker/ci/Dockerfile

@@ -5,10 +5,10 @@ RUN apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
-        docker.io \
         git \
     && rm -rf /var/lib/apt/lists/*
 
+COPY --from=docker:27-cli /usr/local/bin/docker /usr/local/bin/docker
 COPY --from=ghcr.io/astral-sh/uv:0.7.0 /uv /usr/local/bin/uv
 
 ENV UV_PYTHON_INSTALL_DIR=/opt/uv-python \

scripts/ci/build-ci-image.sh

@@ -52,7 +52,7 @@ cd "$REPO_ROOT"
 
 if [[ "$MODE" == "local" ]]; then
   echo "=== Building local CI image (no push): python-repositories-ci:local ==="
-  docker build -f docker/ci/Dockerfile \
+  docker build --network=host -f docker/ci/Dockerfile \
     --secret "id=uv_token,src=${TOKEN_FILE}" \
     -t python-repositories-ci:local \
     .
@@ -64,7 +64,7 @@ echo "=== Logging in to ${REGISTRY} as ${REGISTRY_USER} ==="
 echo "$CI_RUNNER_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
 
 echo "=== Building ${IMAGE}:latest ==="
-docker build -f docker/ci/Dockerfile \
+docker build --network=host -f docker/ci/Dockerfile \
   --secret "id=uv_token,src=${TOKEN_FILE}" \
   -t "${IMAGE}:latest" \
   .