BuildKit sandbox has no network access for DNS resolution. Instead of fighting it, run npm ci in a normal Woodpecker step (which has full network), then COPY the whole frontend dir (including node_modules) into the Docker build context. The Dockerfile just runs npm run build.