diff --git a/src/devx/molecule/start_docker.py b/src/devx/molecule/start_docker.py
index 61f85ae..867c8e5 100644
--- a/src/devx/molecule/start_docker.py
+++ b/src/devx/molecule/start_docker.py
@@ -39,6 +39,12 @@ DEFAULT_TIMEOUT = 30
 DOCKER_SOCK = "/var/run/docker.sock"
 # Rootless socket fallback (e.g. /run/user/994/docker.sock)
 ROOTLESS_SOCK = f"/run/user/{os.getuid()}/docker.sock"
+# Host Docker socket mounted by gitea_runner config (see runner config
+# ``options: "-v /run/user/<uid>/docker.sock:/run/host-docker.sock"``).
+# This gives CI containers access to the host's rootless Docker daemon,
+# which has the full host filesystem (e.g. 455 GB) instead of the
+# container's limited overlay (e.g. 38 GB).
+HOST_DOCKER_SOCK = "/run/host-docker.sock"
 # Minimum free bytes for a Docker daemon to be considered usable.
 # Below this, image pulls and container creation will fail with ENOSPC.
 # 20 GB leaves room for molecule-test-base (~500 MB) + a few containers.
@@ -184,6 +190,11 @@ def start_docker_daemon(timeout: int = DEFAULT_TIMEOUT) -> bool:
 
     # Collect candidate rootless sockets
     candidates: list[str] = []
+    # The host Docker socket is mounted by the gitea_runner config.
+    # This is the preferred candidate — it has access to the host's
+    # full filesystem instead of the container's limited overlay.
+    if os.path.exists(HOST_DOCKER_SOCK):
+        candidates.append(HOST_DOCKER_SOCK)
     if os.path.exists(ROOTLESS_SOCK):
         candidates.append(ROOTLESS_SOCK)
     for sock in sorted(glob.glob("/run/user/*/docker.sock")):