diff --git a/.dockerignore b/.dockerignore
index 326b2a3..a3b8bfb 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -6,12 +6,17 @@ dist/
 third_party/
 backups/
 reports/
-*.o
-*.a
-cst-agent
+**/*.o
+**/*.a
+**/cst-agent
 tests/test_*
 !tests/test_*.c
 app/
 .cursor/
 *.apk
 *.tar.gz
+.gen/
+vendor/sashidown/*.o
+vendor/sashidown/*.a
+vendor/cjson/*.o
+vendor/monocypher/*.o
diff --git a/scripts/Dockerfile.parliament b/scripts/Dockerfile.parliament
index 5c620e0..d5e6270 100644
--- a/scripts/Dockerfile.parliament
+++ b/scripts/Dockerfile.parliament
@@ -1,10 +1,11 @@
 # Build inside Alpine so the binary does not depend on the host Nix store.
 FROM alpine:latest AS build
-RUN apk add --no-cache build-base curl-dev ncurses-dev pkgconf python3
+RUN apk add --no-cache build-base curl-dev ncurses-dev pkgconf python3 \
+      linux-headers
 WORKDIR /src
 COPY . .
-# Skip WebUI asset embedding quirks in minimal images if needed; keep default on.
-RUN make -j"$(nproc)" cst-agent
+# Drop any host objects that slipped past .dockerignore (Nix glibc ≠ musl).
+RUN make clean && make -j"$(nproc)" cst-agent
 
 FROM alpine:latest
 RUN apk add --no-cache libcurl ncurses-libs ca-certificates
diff --git a/src/discover.c b/src/discover.c
index fa08195..0e38b17 100644
--- a/src/discover.c
+++ b/src/discover.c
@@ -32,7 +32,9 @@ static void disc_close(disc_sock_t s) { closesocket(s); }
 #include <errno.h>
 #include <fcntl.h>
 #include <netinet/in.h>
+#include <sys/select.h>
 #include <sys/socket.h>
+#include <sys/time.h>
 #include <unistd.h>
 typedef int disc_sock_t;
 #define DISC_BAD (-1)