Root cause: docker_host auto-mount resolves paths on the HOST filesystem, not inside the runner container. Host has rootless Docker at /run/user/1000/docker.sock, not /var/run/docker.sock. Fix: docker_host="-" (disable auto-mount) + container.options mounts the actual host path into job containers. Also: setup-buildx-action needs driver=docker for rootless Docker (docker-container driver tries to mount sysfs, blocked in rootless).