Enhance Docker CLI setup in workflow: resolve DOCKER_HOST dynamically and update README

README.md

@@ -59,7 +59,13 @@ The workflow in `.forgejo/workflows/publish-container.yml` runs on pushes to `ma
 
 If the runner image does not contain the `docker` binary, the workflow bootstraps a Docker CLI in user space before login/build/push.
 
-For dind-based runners, ensure the job can reach your daemon over `DOCKER_HOST`.
-With your compose topology, the default `tcp://forgejo-docker-in-docker:2375` should work.
+For dind-based runners, the workflow resolves `DOCKER_HOST` in this order:
 
-If you still get connection failures after the CLI bootstrap step, set a repo variable named `DOCKER_HOST` to the correct daemon endpoint for your runner network.
+- `vars.DOCKER_HOST` if explicitly set
+- `/var/run/docker.sock` if mounted into the job
+- `tcp://forgejo-docker-in-docker:2375` if that DNS name is visible inside the job container
+- `tcp://<job-container-default-gateway>:2375` as a fallback for nested Docker bridge setups
+
+If you still get connection failures after the CLI bootstrap step, set a repo variable named `DOCKER_HOST` to the daemon endpoint that is reachable from inside the job container.
+
+Important: the Compose service name `forgejo-docker-in-docker` is often only resolvable from the outer runner container, not from the inner job container created by the Docker daemon. In that case, use the gateway-based fallback or set `DOCKER_HOST` explicitly.