Seems like CodeBuild is the real villain here, even with SCIE_BASE pointed out running

pants

still triggers download attempts in AWS CodeBuild, while docker locally works with

--network none

...