public key is not available:
Why this is happening
The Docker image is built on top of debian:sid and immediately runs apt update/apt upgrade during the build process. When apt contacts the sid (unstable) repository, it refuses to continue because the repository metadata is signed with key 6D33866EDD8FFA41, which is missing from the image’s local keyring. This typically happens when the base image was created before Debian switched to the new archive-signing key. As a result, apt can no longer verify the repository, causing it to halt with the “NO_PUBKEY” error you’re seeing.
To resolve it, ensure the new signing key is installed before updating (e.g., install the latest debian-archive-keyring package or import the key manually with apt-key/gpg) or rebuild from a fresher debian:sid image that already contains the updated key.