diff --git a/AGENTS.md b/AGENTS.md
index d5de249d0b..5706fbced7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -118,7 +118,10 @@ Skip extraction: `./gradlew buildRelease -Pskip-debug-extraction=true`
 ### Container-based Testing (Recommended for ASan/Non-Local Environments)
 
 For ASan testing, cross-architecture testing (aarch64), musl libc, or reproducing CI
-environment issues. Defaults to Podman; use `--container=docker` for Docker.
+environment issues. On macOS, run Docker through colima (`brew install colima docker &&
+colima start`, then `--container=docker`): podman aborts every container command because its
+credential-helper lookup for the Datadog registries (ddtool) cannot reach vault outside the
+CI network. Linux CI may keep using podman; the script still defaults to it.
 
 ```bash
 ./utils/run-containers-tests.sh --arch=aarch64 --config=asan --libc=glibc --jdk=21
diff --git a/README.md b/README.md
index 5e50ba6631..338d9aa342 100644
--- a/README.md
+++ b/README.md
@@ -155,7 +155,7 @@ The project includes both Java and C++ unit tests. You can run them using:
 `JAVA_TEST_HOME=<path to test JDK> ./gradlew testDebug`
 
 ### Container-Based Testing (musl/glibc)
-Run tests in containers to test on different libc implementations. The script defaults to Podman; use `--container=docker` to use Docker instead. Uses two-level container image caching for fast subsequent runs:
+Run tests in containers to test on different libc implementations. The script defaults to Podman; on macOS use Docker via colima (`--container=docker`) — podman's credential-helper lookup for the Datadog registries (ddtool) fails outside the CI network and aborts container commands. Uses two-level container image caching for fast subsequent runs:
 1. **Base image** (`java-profiler-base:<libc>-<arch>`) - OS with all build tools + sanitizers
 2. **JDK image** (`java-profiler-test:<libc>-jdk<version>-<arch>`) - Adds JDK + Gradle
 
@@ -180,7 +180,7 @@ By default, the script clones the repository at the current commit for clean bui
 # Run one C++ gtest binary only
 ./utils/run-containers-tests.sh --libc=glibc --config=asan --gtest-task=elfparser_ut
 
-# Use Docker instead of the default Podman runtime
+# Use Docker via colima (recommended on macOS)
 ./utils/run-containers-tests.sh --container=docker --libc=glibc --jdk=21
 
 # Force rebuild of all cached container images
@@ -210,7 +210,7 @@ Supported options:
 - `--jdk=8|11|17|21|25|8-j9|11-j9|17-j9|21-j9|17-graal|21-graal|25-graal|regular|j9|graal|all[,..]` (default: 21)
 - `--arch=x64|aarch64|all[,..]` (default: auto-detect)
 - `--config=debug|release|asan|tsan|all[,..]` (default: debug)
-- `--container=podman|docker` (default: podman)
+- `--container=podman|docker` (default: podman; on macOS use `docker` backed by colima)
 - `--tests="TestPattern"`
 - `--gtest` (enable C++ gtests, disabled by default for faster runs)
 - `--gtest-task=Task` (run one C++ gtest task; matrix runs require a short name like `elfparser_ut`, while single-cell runs also accept a full task path like `:ddprof-lib:gtestAsan_elfparser_ut`)
diff --git a/ddprof-lib/src/test/cpp/thread_teardown_safety_ut.cpp b/ddprof-lib/src/test/cpp/thread_teardown_safety_ut.cpp
index ef2d65d5f0..f5b234798c 100644
--- a/ddprof-lib/src/test/cpp/thread_teardown_safety_ut.cpp
+++ b/ddprof-lib/src/test/cpp/thread_teardown_safety_ut.cpp
@@ -352,9 +352,14 @@ static void *t07_body(void *) {
     pthread_testcancel();
     usleep(100);
   }
+  // The only runtime exit from the loop is cancellation: pthread_testcancel() (or the
+  // cancelled usleep()) calls pthread_exit(PTHREAD_CANCELED), which runs the registered
+  // cleanup handler and terminates the thread, so nothing after the loop is ever reached.
+  // pthread_cleanup_pop is still lexically required to pair with pthread_cleanup_push
+  // (both expand to an open/close of a do/while(0) block on musl); execute=0 because it
+  // is not a normal cleanup site — the handler already ran during cancellation.
   pthread_cleanup_pop(0);
-  ProfiledThread::release();
-  return nullptr;
+  __builtin_unreachable();
 }
 
 #endif  // __GLIBC__
diff --git a/utils/README.md b/utils/README.md
index 6f132e5c8b..bb506349b4 100644
--- a/utils/README.md
+++ b/utils/README.md
@@ -140,7 +140,7 @@ Also invoked interactively from `release.sh` when preparing a patch release.
 
 ### `run-containers-tests.sh`
 
-Runs tests in containers across various OS/libc/JDK combinations, mirroring the CI matrix locally. Defaults to Podman; use `--container=docker` to use Docker.
+Runs tests in containers across various OS/libc/JDK combinations, mirroring the CI matrix locally. Defaults to Podman; on macOS use Docker via colima (`--container=docker`) — podman's credential-helper lookup for the Datadog registries (ddtool) fails outside the CI network and aborts container commands.
 
 **Usage:**
 ```bash
@@ -167,7 +167,7 @@ Examples:
 # Run a single C++ gtest binary in ASan mode
 ./utils/run-containers-tests.sh --config=asan --gtest-task=elfparser_ut
 
-# Use Docker instead of the default Podman runtime
+# Use Docker via colima (recommended on macOS)
 ./utils/run-containers-tests.sh --container=docker --libc=glibc --jdk=21
 
 # Preview selected JDKs across every supported libc/architecture pair