diff --git a/.gitea/workflows/build-tutorial.yml b/.gitea/workflows/build-tutorial.yml
index 14e6008..4638c99 100644
--- a/.gitea/workflows/build-tutorial.yml
+++ b/.gitea/workflows/build-tutorial.yml
@@ -13,6 +13,8 @@ on:
 env:
   YARN_NPM_REGISTRY_SERVER: https://registry.npmmirror.com
   API: https://gitea.idealjs.com/api/v1/repos/idealjs/stack
+  # runner 是套娃容器——buildah 的 OCI runtime(runc/crun)在内部过不了 cgroup 关,钉死 chroot 隔离
+  BUILDAH_ISOLATION: chroot
 
 jobs:
   build:
@@ -30,7 +32,8 @@ jobs:
           command -v buildah >/dev/null && exit 0
           # 服务器在阿里云——apk 走阿里镜像源（dl-cdn 直连极慢）
           sed -i 's#https://dl-cdn.alpinelinux.org#https://mirrors.aliyun.com#g' /etc/apk/repositories
-          apk add --no-cache buildah
+          # netavark: buildah 配容器网络的助手,alpine 不会随 buildah 自动装
+          apk add --no-cache buildah netavark
 
       - name: buildah 登录阿里云镜像仓（基座为私有 idealjs/node）
         env: