diff --git a/client/client.go b/client/client.go
index e4e339a8..8cbc279d 100644
--- a/client/client.go
+++ b/client/client.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"os"
-	"path/filepath"
 	"strings"
 	"sync"
 
@@ -116,13 +115,9 @@ func (c *Client) buildfn(ctx context.Context, st *state.State, env *environment.
 	lg := log.Ctx(ctx)
 
 	// Scan local dirs to grant access
-	localdirs := env.LocalDirs()
-	for label, dir := range localdirs {
-		abs, err := filepath.Abs(dir)
-		if err != nil {
-			return err
-		}
-		localdirs[label] = abs
+	localdirs, err := env.LocalDirs()
+	if err != nil {
+		return err
 	}
 
 	// buildkit auth provider (registry)
diff --git a/environment/environment.go b/environment/environment.go
index 77200d4b..3bac4433 100644
--- a/environment/environment.go
+++ b/environment/environment.go
@@ -3,6 +3,7 @@ package environment
 import (
 	"context"
 	"fmt"
+	"path/filepath"
 
 	"cuelang.org/go/cue"
 	cueflow "cuelang.org/go/tools/flow"
@@ -75,10 +76,11 @@ func (e *Environment) Computed() *compiler.Value {
 // and return all referenced directory names.
 // This is used by clients to grant access to local directories when they are referenced
 // by user-specified scripts.
-func (e *Environment) LocalDirs() map[string]string {
+func (e *Environment) LocalDirs() (map[string]string, error) {
 	dirs := map[string]string{}
-	localdirs := func(code *compiler.Value) {
-		Analyze(
+
+	localdirs := func(code *compiler.Value) error {
+		return Analyze(
 			func(op *compiler.Value) error {
 				do, err := op.Lookup("do").String()
 				if err != nil {
@@ -91,7 +93,12 @@ func (e *Environment) LocalDirs() map[string]string {
 				if err != nil {
 					return err
 				}
-				dirs[dir] = dir
+				abs, err := filepath.Abs(dir)
+				if err != nil {
+					return err
+				}
+
+				dirs[dir] = abs
 				return nil
 			},
 			code,
@@ -101,10 +108,10 @@ func (e *Environment) LocalDirs() map[string]string {
 	// FIXME: use a common `flow` instance to avoid rescanning the tree.
 	src := compiler.NewValue()
 	if err := src.FillPath(cue.MakePath(), e.plan); err != nil {
-		return nil
+		return nil, err
 	}
 	if err := src.FillPath(cue.MakePath(), e.input); err != nil {
-		return nil
+		return nil, err
 	}
 	flow := cueflow.New(
 		&cueflow.Config{},
@@ -113,10 +120,12 @@ func (e *Environment) LocalDirs() map[string]string {
 	)
 	for _, t := range flow.Tasks() {
 		v := compiler.Wrap(t.Value())
-		localdirs(v.Lookup("#up"))
+		if err := localdirs(v.Lookup("#up")); err != nil {
+			return nil, err
+		}
 	}
 
-	return dirs
+	return dirs, nil
 }
 
 // Up missing values in environment configuration, and write them to state.
diff --git a/stdlib/docker/command.cue b/stdlib/docker/command.cue
index 5d69a2fa..4059dacc 100644
--- a/stdlib/docker/command.cue
+++ b/stdlib/docker/command.cue
@@ -205,9 +205,6 @@ import (
 				}
 			}
 			"mount": {
-				if ssh == _|_ {
-					"/var/run/docker.sock": from: "docker.sock"
-				}
 				if ssh != _|_ {
 					if ssh.key != _|_ {
 						"/key": secret: ssh.key