diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 5113ce8..3464260 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -19,6 +19,8 @@ jobs:
 
       - name: Setup Buf
         uses: bufbuild/buf-setup-action@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Configure Buf Registry
         run: |
diff --git a/dist/post/index.js b/dist/post/index.js
index 4779960..afc1f4f 100644
--- a/dist/post/index.js
+++ b/dist/post/index.js
@@ -36320,6 +36320,43 @@ var external_path_ = __nccwpck_require__(6928);
  */
 async function checkPreviousStepFailures(runnerBasePath) {
     try {
+        // Check if we're running inside a container.
+        // In container jobs, _diag is not mounted and not accessible.
+        const isContainer = await (async () => {
+            // Check for /.dockerenv file (docker-specific).
+            try {
+                await external_fs_.promises.access("/.dockerenv");
+                return true;
+            }
+            catch {
+                // Not a docker container, continue checking.
+            }
+            // Check cgroup for container indicators (works with cgroup v1).
+            try {
+                const cgroup = await external_fs_.promises.readFile("/proc/1/cgroup", "utf-8");
+                if (cgroup.includes("docker") || cgroup.includes("containerd")) {
+                    return true;
+                }
+            }
+            catch {
+                // /proc/1/cgroup unreadable or doesn't exist, continue checking.
+            }
+            // For cgroup v2, check if working directory starts with /__w/.
+            // This is GitHub Actions container-specific workspace mount.
+            const cwd = process.cwd();
+            if (cwd.startsWith("/__w/")) {
+                return true;
+            }
+            return false;
+        })();
+        if (isContainer) {
+            core.debug("Running inside container - _diag directory not accessible, skipping step failure check");
+            return {
+                hasFailures: false,
+                failedCount: 0,
+                // No error field - we want commits to proceed in containers
+            };
+        }
         // If no base path provided, try to detect the runner root
         if (!runnerBasePath) {
             // In GitHub Actions, we're typically in /home/runner/_work/{repo}/{repo}
diff --git a/src/step-checker.ts b/src/step-checker.ts
index 76bb42e..c074181 100644
--- a/src/step-checker.ts
+++ b/src/step-checker.ts
@@ -23,6 +23,48 @@ export async function checkPreviousStepFailures(
   runnerBasePath?: string,
 ): Promise<StepFailureCheck> {
   try {
+    // Check if we're running inside a container.
+    // In container jobs, _diag is not mounted and not accessible.
+    const isContainer = await (async () => {
+      // Check for /.dockerenv file (docker-specific).
+      try {
+        await fs.access("/.dockerenv");
+        return true;
+      } catch {
+        // Not a docker container, continue checking.
+      }
+
+      // Check cgroup for container indicators (works with cgroup v1).
+      try {
+        const cgroup = await fs.readFile("/proc/1/cgroup", "utf-8");
+        if (cgroup.includes("docker") || cgroup.includes("containerd")) {
+          return true;
+        }
+      } catch {
+        // /proc/1/cgroup unreadable or doesn't exist, continue checking.
+      }
+
+      // For cgroup v2, check if working directory starts with /__w/.
+      // This is GitHub Actions container-specific workspace mount.
+      const cwd = process.cwd();
+      if (cwd.startsWith("/__w/")) {
+        return true;
+      }
+
+      return false;
+    })();
+
+    if (isContainer) {
+      core.debug(
+        "Running inside container - _diag directory not accessible, skipping step failure check",
+      );
+      return {
+        hasFailures: false,
+        failedCount: 0,
+        // No error field - we want commits to proceed in containers
+      };
+    }
+
     // If no base path provided, try to detect the runner root
     if (!runnerBasePath) {
       // In GitHub Actions, we're typically in /home/runner/_work/{repo}/{repo}