docker build --network host -t myapp .

Lets RUN steps reach the host's network directly, bypassing BuildKit's default sandboxed networking. Needed when builds pull from private hosts only the host can see. Slower builds and weaker isolation are the trade-off.