From f3b6cdbc9e5bc938b6cb40502613a058d29e6c13 Mon Sep 17 00:00:00 2001
From: Brian Bjarke Jensen <bbj@skov.dk>
Date: Fri, 10 Jul 2026 09:16:19 +0200
Subject: [PATCH] Fix CI image build failures on runners with isolated DinD
 DNS.

Copy the Docker CLI from the official image instead of apt, and use
--network=host during docker build so apt and layer pulls can resolve
external registries on standalone runners.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .gitea/workflows/ci-image.yml | 2 +-
 docker/ci/Dockerfile          | 2 +-
 scripts/ci/build-ci-image.sh  | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/ci-image.yml b/.gitea/workflows/ci-image.yml
index 6264980..948b086 100644
--- a/.gitea/workflows/ci-image.yml
+++ b/.gitea/workflows/ci-image.yml
@@ -37,7 +37,7 @@ jobs:
           CI_RUNNER_TOKEN: ${{ secrets.CI_RUNNER_TOKEN }}
         run: |
           echo "$CI_RUNNER_TOKEN" > /tmp/uv_token
-          docker build -f docker/ci/Dockerfile \
+          docker build --network=host -f docker/ci/Dockerfile \
             --secret id=uv_token,src=/tmp/uv_token \
             -t "${IMAGE}:latest" \
             .
diff --git a/docker/ci/Dockerfile b/docker/ci/Dockerfile
index 35762c8..d4b9ed4 100644
--- a/docker/ci/Dockerfile
+++ b/docker/ci/Dockerfile
@@ -5,10 +5,10 @@ RUN apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
-        docker.io \
         git \
     && rm -rf /var/lib/apt/lists/*
 
+COPY --from=docker:27-cli /usr/local/bin/docker /usr/local/bin/docker
 COPY --from=ghcr.io/astral-sh/uv:0.7.0 /uv /usr/local/bin/uv
 
 ENV UV_PYTHON_INSTALL_DIR=/opt/uv-python \
diff --git a/scripts/ci/build-ci-image.sh b/scripts/ci/build-ci-image.sh
index 7c0f3cc..9e99a84 100755
--- a/scripts/ci/build-ci-image.sh
+++ b/scripts/ci/build-ci-image.sh
@@ -52,7 +52,7 @@ cd "$REPO_ROOT"
 
 if [[ "$MODE" == "local" ]]; then
   echo "=== Building local CI image (no push): python-repositories-ci:local ==="
-  docker build -f docker/ci/Dockerfile \
+  docker build --network=host -f docker/ci/Dockerfile \
     --secret "id=uv_token,src=${TOKEN_FILE}" \
     -t python-repositories-ci:local \
     .
@@ -64,7 +64,7 @@ echo "=== Logging in to ${REGISTRY} as ${REGISTRY_USER} ==="
 echo "$CI_RUNNER_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
 
 echo "=== Building ${IMAGE}:latest ==="
-docker build -f docker/ci/Dockerfile \
+docker build --network=host -f docker/ci/Dockerfile \
   --secret "id=uv_token,src=${TOKEN_FILE}" \
   -t "${IMAGE}:latest" \
   .
-- 
2.54.0