diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index 83a9f70..d17d33f 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -3,9 +3,6 @@ services:
     build:
       context: ..
       dockerfile: docker/Dockerfile
-      # Build host runs dockerd with bridge:none + iptables:false (PIA killswitch,
-      # no Docker NAT). Image-build RUN steps (emsdk download) use the host netns.
-      network: host
       args:
         # Single source of truth: scripts/common/versions.sh, exported into the env by the scripts
         # that drive compose (docker/build.sh, docker/shell.sh). No default -> the Dockerfile fails
@@ -13,10 +10,6 @@ services:
         EMSCRIPTEN_VERSION: ${EMSCRIPTEN_VERSION:?source scripts/common/versions.sh before docker compose}
     # Container name is auto-generated with project prefix (set in build.sh)
 
-    # The compile container shares the host network namespace so it inherits the
-    # PIA killswitch directly — the build host's dockerd has no bridge/NAT.
-    network_mode: host
-
     # Resource limits. Defaults are sized for a dev Mac (Docker Desktop VM).
     # CI overrides via env: the 32-core Hetzner runner sets KICAD_DOCKER_CPUS=$(nproc)
     # and KICAD_DOCKER_MEM=110G — with the 10-CPU default, run 27226030304 compiled