diff --git a/.gitea/workflows/production-deploy.yml b/.gitea/workflows/production-deploy.yml
index 88c7babd..c8add7e5 100644
--- a/.gitea/workflows/production-deploy.yml
+++ b/.gitea/workflows/production-deploy.yml
@@ -104,11 +104,19 @@ jobs:
       commit_sha: ${{ steps.meta.outputs.commit_sha }}
     steps:
       - name: Install git and setup environment
+        shell: sh
         run: |
           # docker:latest is minimal (Alpine-based), install git and bash
-          apk add --no-cache git bash curl
+          # Note: docker-build image should already have these, but ensure they're available
+          if ! command -v bash >/dev/null 2>&1 || ! command -v git >/dev/null 2>&1; then
+            apk add --no-cache git bash curl
+          fi
+          # Verify installation
+          bash --version
+          git --version
           
       - name: Checkout code
+        shell: bash
         run: |
           REF_NAME="${{ github.ref_name }}"
           REPO="${{ github.repository }}"
@@ -135,9 +143,19 @@ jobs:
           cd /workspace/repo
 
       - name: Setup Docker Buildx
+        shell: bash
         run: |
-          # Buildx ist bereits im docker-build Image installiert
-          docker buildx create --name builder --use || docker buildx use builder
+          # Verifiziere dass Buildx verfügbar ist
+          docker buildx version || echo "Buildx nicht gefunden, versuche Installation..."
+          
+          # Erstelle oder verwende Buildx Builder
+          if ! docker buildx ls | grep -q builder; then
+            docker buildx create --name builder --use
+          else
+            docker buildx use builder
+          fi
+          
+          # Bootstrap Builder
           docker buildx inspect --bootstrap
 
       - name: Generate image metadata
@@ -157,10 +175,112 @@ jobs:
           echo "Generated tag: ${TAG}"
 
       - name: Login to Registry
+        id: login
+        shell: bash
         run: |
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login ${{ env.REGISTRY }} -u ${{ secrets.REGISTRY_USER }} --password-stdin
+          REGISTRY_USER="${{ secrets.REGISTRY_USER }}"
+          REGISTRY_PASSWORD="${{ secrets.REGISTRY_PASSWORD }}"
+          REGISTRY_URL="${{ env.REGISTRY }}"
+          DEPLOYMENT_HOST="${{ env.DEPLOYMENT_HOST }}"
+          
+          # Prüfe ob Secrets gesetzt sind
+          if [ -z "$REGISTRY_USER" ]; then
+            echo "❌ Error: REGISTRY_USER Secret ist nicht gesetzt in Gitea"
+            echo "Bitte gehe zu: Repository → Settings → Secrets"
+            echo "Und füge REGISTRY_USER hinzu (z.B. 'admin')"
+            exit 1
+          fi
+          
+          if [ -z "$REGISTRY_PASSWORD" ]; then
+            echo "❌ Error: REGISTRY_PASSWORD Secret ist nicht gesetzt in Gitea"
+            echo "Bitte gehe zu: Repository → Settings → Secrets"
+            echo "Und füge REGISTRY_PASSWORD hinzu"
+            exit 1
+          fi
+          
+          # Versuche verschiedene Registry-URLs
+          # 1. Externe Domain (HTTPS via Traefik)
+          # 2. Host-IP (HTTPS, falls DNS nicht funktioniert)
+          # 3. Host-IP Port 5000 (HTTP, direkter Zugriff)
+          
+          echo "🔐 Versuche Registry-Login..."
+          echo "📝 Benutzer: $REGISTRY_USER"
+          echo "🌐 Deployment Host: $DEPLOYMENT_HOST"
+          
+          # Teste verschiedene Registry-URLs
+          REGISTRY_URLS=(
+            "$REGISTRY_URL"
+            "$DEPLOYMENT_HOST"
+            "registry.michaelschiemer.de"
+          )
+          
+          LOGIN_SUCCESS=false
+          
+          for TEST_URL in "${REGISTRY_URLS[@]}"; do
+            echo ""
+            echo "🔍 Teste Registry: $TEST_URL"
+            
+            # Teste HTTPS
+            if curl -k -s -f -o /dev/null "https://$TEST_URL/v2/" 2>/dev/null; then
+              echo "✅ Registry erreichbar über HTTPS: https://$TEST_URL"
+              
+              # Versuche Login
+              if echo "$REGISTRY_PASSWORD" | docker login "$TEST_URL" -u "$REGISTRY_USER" --password-stdin 2>&1; then
+                echo "✅ Erfolgreich bei Registry angemeldet: $TEST_URL"
+                REGISTRY_URL="$TEST_URL"
+                LOGIN_SUCCESS=true
+                break
+              else
+                echo "⚠️  Login fehlgeschlagen für $TEST_URL, versuche nächste URL..."
+              fi
+            fi
+            
+            # Teste HTTP (falls HTTPS nicht funktioniert)
+            if curl -s -f -o /dev/null "http://$TEST_URL:5000/v2/" 2>/dev/null; then
+              echo "✅ Registry erreichbar über HTTP: http://$TEST_URL:5000"
+              
+              # Versuche Login mit HTTP
+              if echo "$REGISTRY_PASSWORD" | docker login "$TEST_URL:5000" -u "$REGISTRY_USER" --password-stdin 2>&1; then
+                echo "✅ Erfolgreich bei Registry angemeldet: $TEST_URL:5000"
+                REGISTRY_URL="$TEST_URL:5000"
+                LOGIN_SUCCESS=true
+                break
+              else
+                echo "⚠️  Login fehlgeschlagen für $TEST_URL:5000, versuche nächste URL..."
+              fi
+            fi
+          done
+          
+          if [ "$LOGIN_SUCCESS" = false ]; then
+            echo ""
+            echo "❌ Registry-Login fehlgeschlagen für alle getesteten URLs"
+            echo ""
+            echo "🔍 Debugging-Informationen:"
+            echo "Getestete URLs:"
+            for URL in "${REGISTRY_URLS[@]}"; do
+              echo "  - $URL (HTTPS)"
+              echo "  - $URL:5000 (HTTP)"
+            done
+            echo ""
+            echo "User: $REGISTRY_USER"
+            echo "Password vorhanden: $([ -n "$REGISTRY_PASSWORD" ] && echo 'Ja' || echo 'Nein')"
+            echo ""
+            echo "Mögliche Ursachen:"
+            echo "1. Registry nicht vom Runner-Container aus erreichbar (Netzwerk-Isolation)"
+            echo "2. Falsche Credentials in Gitea Secrets"
+            echo "3. Registry-DNS nicht auflösbar vom Container aus"
+            echo "4. Registry läuft nicht oder ist nicht erreichbar"
+            echo ""
+            echo "Lösung: Prüfe die Secrets in Gitea und stelle sicher, dass die Registry erreichbar ist"
+            exit 1
+          fi
+          
+          echo ""
+          echo "✅ Registry-Login erfolgreich!"
+          echo "📦 Verwendete Registry URL: $REGISTRY_URL"
 
       - name: Build and push Docker image
+        shell: bash
         run: |
           cd /workspace/repo
           COMMIT_SHA="${{ github.sha }}"
@@ -178,11 +298,11 @@ jobs:
           docker buildx build \
             --platform linux/amd64 \
             --file ./Dockerfile.production \
-            --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest \
-            --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${TAG} \
-            --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:git-${SHORT_SHA} \
-            --cache-from type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache \
-            --cache-to type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max \
+            --tag ${ACTUAL_REGISTRY}/${{ env.IMAGE_NAME }}:latest \
+            --tag ${ACTUAL_REGISTRY}/${{ env.IMAGE_NAME }}:${TAG} \
+            --tag ${ACTUAL_REGISTRY}/${{ env.IMAGE_NAME }}:git-${SHORT_SHA} \
+            --cache-from type=registry,ref=${ACTUAL_REGISTRY}/${{ env.IMAGE_NAME }}:buildcache \
+            --cache-to type=registry,ref=${ACTUAL_REGISTRY}/${{ env.IMAGE_NAME }}:buildcache,mode=max \
             --build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') \
             --build-arg GIT_COMMIT=${COMMIT_SHA} \
             --build-arg GIT_BRANCH=${REF_NAME} \
@@ -190,6 +310,7 @@ jobs:
             .
 
       - name: Image scan for vulnerabilities
+        shell: bash
         run: |
           echo "✅ Image built successfully: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.tag }}"
 
diff --git a/docker/ci/Dockerfile.build b/docker/ci/Dockerfile.build
index e540e835..be17c339 100644
--- a/docker/ci/Dockerfile.build
+++ b/docker/ci/Dockerfile.build
@@ -10,21 +10,33 @@ RUN apk add --no-cache \
     openssh-client \
     ca-certificates
 
-# Installiere Docker Buildx
-RUN mkdir -p /root/.docker/cli-plugins && \
+# Installiere Docker Buildx (global für alle User)
+RUN mkdir -p /usr/local/lib/docker/cli-plugins && \
     ARCH=$(uname -m) && \
-    if [ "$ARCH" = "x86_64" ]; then ARCH="amd64"; fi && \
-    curl -L "https://github.com/docker/buildx/releases/download/v0.13.2/buildx-v0.13.2.linux-${ARCH}" \
-    -o /root/.docker/cli-plugins/docker-buildx && \
-    chmod +x /root/.docker/cli-plugins/docker-buildx
+    if [ "$ARCH" = "x86_64" ]; then ARCH="amd64"; elif [ "$ARCH" = "aarch64" ]; then ARCH="arm64"; fi && \
+    BUILDX_VERSION="v0.29.1" && \
+    curl -fL "https://github.com/docker/buildx/releases/download/${BUILDX_VERSION}/buildx-${BUILDX_VERSION}.linux-${ARCH}" \
+    -o /usr/local/lib/docker/cli-plugins/docker-buildx && \
+    chmod +x /usr/local/lib/docker/cli-plugins/docker-buildx && \
+    # Verifiziere Download (sollte mindestens 1MB sein)
+    test -f /usr/local/lib/docker/cli-plugins/docker-buildx && \
+    test $(stat -c%s /usr/local/lib/docker/cli-plugins/docker-buildx) -gt 1000000 && \
+    # Auch für root installieren (als Fallback)
+    mkdir -p /root/.docker/cli-plugins && \
+    cp /usr/local/lib/docker/cli-plugins/docker-buildx /root/.docker/cli-plugins/docker-buildx
 
-# Verifiziere Installation (Buildx wird beim ersten Aufruf initialisiert, daher nur Basis-Checks)
+# Verifiziere Installation
 RUN docker --version && \
     git --version && \
-    bash --version
+    bash --version && \
+    docker buildx version
 
 # Arbeitsverzeichnis
 WORKDIR /workspace
 
 # Standard-User für CI (UID/GID 1000)
-RUN addgroup -g 1000 ci && adduser -u 1000 -G ci -D ci
+RUN addgroup -g 1000 ci && adduser -u 1000 -G ci -D ci && \
+    # Installiere Buildx auch für ci-User
+    mkdir -p /home/ci/.docker/cli-plugins && \
+    cp /usr/local/lib/docker/cli-plugins/docker-buildx /home/ci/.docker/cli-plugins/docker-buildx && \
+    chown -R ci:ci /home/ci/.docker