[indiv0]

Not to be reductive, but why not `docker run` the sha256 of the last successful stage of the build and run the next command manually?

[pid-1]

That's what I generally do, but it's tedious as CI images are written to have as few layers as possible. So debugging often also involves changing Dockerfiles.