diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 11b723c..f8489bd 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -153,7 +153,7 @@ jobs:
 
       - name: Build & push mcpd
         run: |
-          buildah --storage-driver vfs bud -t mcpd:latest -f deploy/Dockerfile.mcpd .
+          buildah --storage-driver vfs --isolation chroot bud -t mcpd:latest -f deploy/Dockerfile.mcpd .
           buildah --storage-driver vfs push --tls-verify=false \
             --creds "${{ env.OWNER }}:${{ secrets.PACKAGES_TOKEN }}" \
             mcpd:latest \
@@ -161,7 +161,7 @@ jobs:
 
       - name: Build & push node-runner
         run: |
-          buildah --storage-driver vfs bud -t node-runner:latest -f deploy/Dockerfile.node-runner .
+          buildah --storage-driver vfs --isolation chroot bud -t node-runner:latest -f deploy/Dockerfile.node-runner .
           buildah --storage-driver vfs push --tls-verify=false \
             --creds "${{ env.OWNER }}:${{ secrets.PACKAGES_TOKEN }}" \
             node-runner:latest \
@@ -169,7 +169,7 @@ jobs:
 
       - name: Build & push python-runner
         run: |
-          buildah --storage-driver vfs bud -t python-runner:latest -f deploy/Dockerfile.python-runner .
+          buildah --storage-driver vfs --isolation chroot bud -t python-runner:latest -f deploy/Dockerfile.python-runner .
           buildah --storage-driver vfs push --tls-verify=false \
             --creds "${{ env.OWNER }}:${{ secrets.PACKAGES_TOKEN }}" \
             python-runner:latest \
@@ -177,7 +177,7 @@ jobs:
 
       - name: Build & push docmost-mcp
         run: |
-          buildah --storage-driver vfs bud -t docmost-mcp:latest -f deploy/Dockerfile.docmost-mcp .
+          buildah --storage-driver vfs --isolation chroot bud -t docmost-mcp:latest -f deploy/Dockerfile.docmost-mcp .
           buildah --storage-driver vfs push --tls-verify=false \
             --creds "${{ env.OWNER }}:${{ secrets.PACKAGES_TOKEN }}" \
             docmost-mcp:latest \