diff --git a/.gitea/workflows/runner-docker-diagnostic.yml b/.gitea/workflows/runner-docker-diagnostic.yml
index a655d783..2c29fca5 100644
--- a/.gitea/workflows/runner-docker-diagnostic.yml
+++ b/.gitea/workflows/runner-docker-diagnostic.yml
@@ -12,35 +12,28 @@ jobs:
   diagnostic:
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    services:
-      docker:
-        image: docker@sha256:7c3e797187e43738220462658f4586572cbd3bf009f728b21e34d9c5c06ce431
-        env:
-          DOCKER_TLS_CERTDIR: ""
-        options: --privileged
     env:
-      DOCKER_HOST: tcp://docker:2375
+      DOCKER_HOST: tcp://gitea-runner-dind:2375
       DOCKER_TLS_CERTDIR: ""
     steps:
-      - name: Verify job-private Docker daemon
+      - name: Verify isolated shared runner daemon
         shell: bash
         run: |
           set -euo pipefail
-          echo "DOCKER_HOST=${DOCKER_HOST}"
-          for attempt in $(seq 1 30); do
-            if docker info >/tmp/docker-info.txt 2>&1; then
-              break
-            fi
-            if [[ "$attempt" -eq 30 ]]; then
-              cat /tmp/docker-info.txt
-              exit 1
-            fi
-            sleep 1
-          done
+          docker info >/tmp/docker-info.txt
           docker version
-          initial_containers="$(docker ps -aq | wc -l)"
-          echo "initial-containers=${initial_containers}"
-          test "${initial_containers}" -eq 0
+
+          mapfile -t visible_names < <(docker ps -a --format '{{.Names}}')
+          echo "visible-container-count=${#visible_names[@]}"
+          for name in "${visible_names[@]}"; do
+            case "$name" in
+              GITEA-ACTIONS-TASK-*) ;;
+              *)
+                echo "Unexpected non-Actions container visible: $name" >&2
+                exit 1
+                ;;
+            esac
+          done
 
           workdir="$(mktemp -d)"
           printf 'geo-intel-ci\n' > "${workdir}/proof.txt"
@@ -48,6 +41,7 @@ jobs:
           FROM scratch
           COPY proof.txt /proof.txt
           EOF
-          docker build --pull=false -t geointel-runner-diagnostic:local "${workdir}"
-          docker image inspect geointel-runner-diagnostic:local --format '{{.Id}}'
-          docker image rm geointel-runner-diagnostic:local >/dev/null
+          tag="geointel-runner-diagnostic:${GITHUB_RUN_ID:-local}-${GITHUB_RUN_ATTEMPT:-1}"
+          docker build --pull=false -t "$tag" "${workdir}"
+          docker image inspect "$tag" --format '{{.Id}}'
+          docker image rm "$tag" >/dev/null