Root cause confirmed: BuildKit sandbox creates isolated network namespace that cannot resolve DNS even though the pod itself can. The buildx_flags --driver-opt network=host only affects the buildkit daemon creation, not the actual build steps. Adding network: host passes --network=host to docker buildx build, making RUN steps use host networking.