The runner (gitea-anouma-runner) runs as a Docker container itself (gitea/runner:3) with the host's docker.sock mounted in, but no `docker` CLI binary. A job with no `container:` runs directly inside that minimal runner image, so `docker login/build/push` failed with "docker: command not found". Using docker:27-cli gives the job the CLI; the runner mounts the same host socket into it automatically (sibling containers), and openssh-client is installed for the deploy step's ssh call. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>