diff --git a/.forgejo/workflows/publish-container.yml b/.forgejo/workflows/publish-container.yml
index 467bdb0..282a8a9 100644
--- a/.forgejo/workflows/publish-container.yml
+++ b/.forgejo/workflows/publish-container.yml
@@ -16,8 +16,8 @@ jobs:
   publish:
     runs-on: docker
     env:
-      # Use explicit override when provided, otherwise use the known-good host
-      DOCKER_HOST: ${{ vars.DOCKER_HOST != '' && vars.DOCKER_HOST || 'tcp://172.17.0.1:2375' }}
+      # Allow explicit override from Forgejo variables.
+      DOCKER_HOST: ${{ vars.DOCKER_HOST }}
 
     steps:
       - name: Checkout
@@ -65,29 +65,35 @@ jobs:
           echo "${HOME}/.local/bin" >> "${GITHUB_PATH}"
           "${HOME}/.local/bin/docker" --version
 
-      - name: Ensure Docker Buildx exists
+      - name: Resolve Docker daemon endpoint
         run: |
           set -eu
-          if docker buildx version >/dev/null 2>&1; then
-            docker buildx version
+
+          if [ -n "${DOCKER_HOST:-}" ]; then
+            echo "Using configured DOCKER_HOST=${DOCKER_HOST}"
+            echo "DOCKER_HOST=${DOCKER_HOST}" >> "${GITHUB_ENV}"
             exit 0
           fi
 
-          ARCH="$(uname -m)"
-          case "${ARCH}" in
-            x86_64) BUILDX_ARCH="amd64" ;;
-            aarch64|arm64) BUILDX_ARCH="arm64" ;;
-            *) echo "Unsupported architecture for Docker Buildx bootstrap: ${ARCH}"; exit 1 ;;
-          esac
+          if [ -S /var/run/docker.sock ]; then
+            echo "DOCKER_HOST=unix:///var/run/docker.sock" >> "${GITHUB_ENV}"
+            echo "Resolved DOCKER_HOST from local docker socket"
+            exit 0
+          fi
 
-          BUILDX_VERSION="v0.21.1"
-          mkdir -p "${HOME}/.docker/cli-plugins"
-          curl -fsSL "https://github.com/docker/buildx/releases/download/${BUILDX_VERSION}/buildx-${BUILDX_VERSION}.linux-${BUILDX_ARCH}" -o "${HOME}/.docker/cli-plugins/docker-buildx"
-          chmod +x "${HOME}/.docker/cli-plugins/docker-buildx"
-          docker buildx version
+          # Try a set of common candidate endpoints reachable from inside job containers.
+          CANDIDATES="forgejo-docker-in-docker host.docker.internal 172.17.0.1 172.18.0.1 10.0.2.2"
+          for c in $CANDIDATES; do
+            echo "Testing http://${c}:2375/_ping ..."
+            if curl --silent --max-time 2 "http://${c}:2375/_ping" >/dev/null 2>&1 || curl --silent --max-time 2 "http://${c}:2375/version" >/dev/null 2>&1; then
+              echo "DOCKER_HOST=tcp://${c}:2375" >> "${GITHUB_ENV}"
+              echo "Resolved DOCKER_HOST to tcp://${c}:2375"
+              exit 0
+            fi
+          done
 
-      # Simplified: we trust DOCKER_HOST (default to tcp://172.17.0.1:2375). If you
-      # need a different endpoint, set the Forgejo variable `DOCKER_HOST`.
+          echo "Could not determine a reachable Docker daemon endpoint from candidates. Set vars.DOCKER_HOST explicitly."
+          exit 1
 
       - name: Check Docker daemon connectivity
         run: |
@@ -96,13 +102,6 @@ jobs:
           docker version
           docker info >/dev/null
 
-      - name: Create Buildx builder
-        run: |
-          set -eu
-          docker buildx rm forgejo-builder >/dev/null 2>&1 || true
-          docker buildx create --name forgejo-builder --driver docker-container --use
-          docker buildx inspect --bootstrap
-
       - name: Restore and publish app
         run: dotnet publish src/MaddoScientisto.Web/MaddoScientisto.Web.csproj -c Release -o ./artifacts/publish
 
@@ -110,14 +109,17 @@ jobs:
         run: |
           echo "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" | docker login "${REGISTRY}" -u "${{ secrets.FORGEJO_REGISTRY_USERNAME }}" --password-stdin
 
-      - name: Build and push image
+      - name: Build image
         run: |
           set -eu
           IMAGE_REF="${REGISTRY}/${IMAGE_NAMESPACE}/${IMAGE_NAME}"
           SHORT_SHA="$(echo "${GITHUB_SHA}" | cut -c1-12)"
-          docker buildx build \
-            --builder forgejo-builder \
-            --tag "${IMAGE_REF}:sha-${SHORT_SHA}" \
-            --tag "${IMAGE_REF}:latest" \
-            --push \
-            .
+          docker build -t "${IMAGE_REF}:sha-${SHORT_SHA}" -t "${IMAGE_REF}:latest" .
+
+      - name: Push image tags
+        run: |
+          set -eu
+          IMAGE_REF="${REGISTRY}/${IMAGE_NAMESPACE}/${IMAGE_NAME}"
+          SHORT_SHA="$(echo "${GITHUB_SHA}" | cut -c1-12)"
+          docker push "${IMAGE_REF}:sha-${SHORT_SHA}"
+          docker push "${IMAGE_REF}:latest"
diff --git a/README.md b/README.md
index 505f6ea..32b860d 100644
--- a/README.md
+++ b/README.md
@@ -34,30 +34,6 @@ docker run --rm -p 8080:80 maddoscientisto-web:local
 
 Open `http://localhost:8080`.
 
-## Docker Compose deployment
-
-A ready-to-use `docker-compose.yml` is included to build and run the site container. By default it maps container port `80` to host port `8002`.
-
-Start the service (builds the image if needed) with:
-
-```bash
-docker compose up --build -d
-```
-
-Verify the site at:
-
-```bash
-curl http://localhost:8002/
-```
-
-To stop and remove the service:
-
-```bash
-docker compose down
-```
-
-You can customize the built image name and tag via environment variables read by Compose (`IMAGE_REGISTRY` and `IMAGE_TAG`), or edit `docker-compose.yml` to change the published host port.
-
 ## Forgejo registry configuration
 
 Set these Forgejo Actions variables:
@@ -74,7 +50,7 @@ Set these Forgejo Actions secrets:
 
 ## Workflow behavior
 
-The workflow in `.forgejo/workflows/publish-container.yml` runs on pushes to `master` (and manual dispatch), bootstraps Docker Buildx if needed, then builds and pushes the container image with BuildKit:
+The workflow in `.forgejo/workflows/publish-container.yml` runs on pushes to `master` (and manual dispatch), builds the container image, and pushes:
 
 - `${FORGEJO_REGISTRY}/${IMAGE_NAMESPACE}/${IMAGE_NAME}:latest`
 - `${FORGEJO_REGISTRY}/${IMAGE_NAMESPACE}/${IMAGE_NAME}:sha-<12-char-commit>`
@@ -83,6 +59,13 @@ The workflow in `.forgejo/workflows/publish-container.yml` runs on pushes to `ma
 
 If the runner image does not contain the `docker` binary, the workflow bootstraps a Docker CLI in user space before login/build/push.
 
-If the runner image does not contain the Buildx plugin, the workflow also installs `docker-buildx` in the Docker CLI plugin directory before creating a builder.
+For dind-based runners, the workflow resolves `DOCKER_HOST` in this order:
 
-For your current dind-based runner, the workflow defaults `DOCKER_HOST` to `tcp://172.17.0.1:2375` unless you set `vars.DOCKER_HOST` explicitly.
+- `vars.DOCKER_HOST` if explicitly set
+- `/var/run/docker.sock` if mounted into the job
+- `tcp://forgejo-docker-in-docker:2375` if that DNS name is visible inside the job container
+- `tcp://<job-container-default-gateway>:2375` as a fallback for nested Docker bridge setups
+
+If you still get connection failures after the CLI bootstrap step, set a repo variable named `DOCKER_HOST` to the daemon endpoint that is reachable from inside the job container.
+
+Important: the Compose service name `forgejo-docker-in-docker` is often only resolvable from the outer runner container, not from the inner job container created by the Docker daemon. In that case, use the gateway-based fallback or set `DOCKER_HOST` explicitly.
diff --git a/docker-compose.yml b/docker-compose.yml
deleted file mode 100644
index ee44f02..0000000
--- a/docker-compose.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-version: '3.8'
-
-services:
-  maddoscientisto-web:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    image: ${IMAGE_REGISTRY:-maddoscientisto-web}:${IMAGE_TAG:-latest}
-    ports:
-      - "8002:80"
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1/ >/dev/null 2>&1 || exit 1"]
-      interval: 30s
-      timeout: 5s
-      retries: 3