1. Docker bind mount readable metadata but file read EMFILE; no SDK compilation started. Switched to docker cp of only public inputs, no host mount or permissions expansion.
2. Container cap-drop ALL prevented tar archive chown; no configure/compiler started. Kept caps dropped, use tar --no-same-owner.
