Docker "RUN --network=none" Step Fails to Reach the Network in CI
A RUN --mount step ran with --network=none, so it has no network at all. Any command that tries to download - apt-get, pip, npm, curl - fails with a DNS or connection error because networking was deliberately disabled for that step.
What this error means
A RUN --network=none step fails with Could not resolve host, Temporary failure in name resolution, or a connection timeout - while the same command works in a normal RUN. The error is deterministic: the step simply has no network.
#7 [build 3/5] RUN --network=none pip install -r requirements.txt
#7 0.31 Could not resolve host: pypi.org
#7 ERROR: process "/bin/sh -c pip install -r requirements.txt" did not complete successfully: exit code: 1Common causes
The RUN step explicitly disables networking
RUN --network=none is meant for hermetic steps that must not touch the network. Putting a download in such a step guarantees a DNS/connect failure.
A misplaced --network=none on a fetching step
Copy-pasting the flag onto a step that needs to install packages, or sharing it across steps, removes the network from a command that requires it.
How to fix it
Use the default network for steps that download
Drop --network=none (the default is --network=default) so the step can reach the network.
# fetch with the default network:
RUN pip install -r requirements.txt
# reserve --network=none for hermetic, offline steps:
RUN --network=none python build_offline.pyPre-fetch dependencies, then run offline
Download in a networked step (or via a cache mount), then run the hermetic step with no network.
RUN --mount=type=cache,target=/root/.cache/pip pip download -r requirements.txt -d /wheels
RUN --network=none pip install --no-index --find-links=/wheels -r requirements.txtHow to prevent it
- Only use
--network=nonefor steps that genuinely need no network. - Pre-fetch dependencies in a networked step before any offline step.
- Keep the
--networkflag per-step intentional, not copy-pasted.