> **WARNING:** This document describes only the change applied in this PR.
> It may already be outdated once the next PR is merged.
> Historic PR-documentation is not maintained along with new PRs — treat it as a snapshot, not as current documentation.

## The Problem

Since 2026-10-01 every Testcontainers test of hs.hsadmin.ng fails on vm4006 with "Connection to localhost:<port> refused".
The rootless Docker daemon there runs with the `slirp4netns` port driver now: its unit was rewritten on 2026-09-23 and took effect at a reboot.
With this driver, `docker-proxy` listens on the child address `10.0.2.100` inside the daemon's network namespace, not on `localhost`.
A build container with `network: host` lives in that namespace, so Testcontainers must connect to `10.0.2.100`.
The host set `TESTCONTAINERS_HOST_OVERRIDE: "10.0.2.100"` in `docker.env`, but `DockerBuildRunner` appended its own `TESTCONTAINERS_HOST_OVERRIDE=localhost` after it, and the last `--env` wins.

## Non-Goals

- No detection of the port driver; the host knows its daemon, and one line in the machine config says so.
- No change to the default for hosts that set nothing.

## The Scenarios

### Feature: the host decides where Testcontainers reaches its ports

#### Scenario#85.01: A host override in docker.env wins

So that a host whose daemon publishes ports elsewhere can say so, and undo it by deleting the line.

- **Given** a build with `TESTCONTAINERS_HOST_OVERRIDE` in `docker.env`
- **When** Werkator starts its container
- **Then** the container gets that value, once
- **Given** no such entry, **then** the default stays: `localhost` with `network: host`, `host.docker.internal` otherwise

##### Verified by

- [DockerBuildRunnerTest](../../src/test/kotlin/de/hoennig/werkator/build/DockerBuildRunnerTest.kt) — the override from `docker.env` passed once; the existing default tests for host and bridge networks

## The Solution

`DockerBuildRunner.runArgs` appends its default `TESTCONTAINERS_HOST_OVERRIDE` only when `docker.env` has none.
Switching back is a configuration change, not a Werkator update: should the daemon go back to the `builtin` port driver, the host deletes its entry and the default applies again.

## Additional Changes

- `docs/configuration.md` and the architecture skill describe the default and the override.
- Version 1.24.1 with its release note.