The mistserver image build piped `curl … | tar xzv` straight from r.mistserver.org, so any transient hiccup (it has been 502ing) either fed a truncated stream to tar or failed outright with no retry — flaking CI's "mistserver image" job repeatedly. Download to a file with retries (`-f --retry 12 --retry-all-errors --retry-delay 10 --retry-max-time 240`) and only extract once the transfer completes. Applied to both the ghcr and compose Dockerfiles. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>