From f9aba3537a94bef59d13387750d73779d31d3d9e Mon Sep 17 00:00:00 2001
From: Nikita Z <nkzk95@gmail.com>
Date: Thu, 4 Jun 2026 09:51:11 +0200
Subject: [PATCH 01/13] fix(render): do not override function docker-network
 annotation

Signed-off-by: Nikita Z <nkzk95@gmail.com>
---
 cmd/crossplane/render/render.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/cmd/crossplane/render/render.go b/cmd/crossplane/render/render.go
index 5cc373f..25b0be8 100644
--- a/cmd/crossplane/render/render.go
+++ b/cmd/crossplane/render/render.go
@@ -158,7 +158,11 @@ func injectNetworkAnnotation(fns []pkgv1.Function, networkName string) {
 		if fns[i].Annotations == nil {
 			fns[i].Annotations = make(map[string]string)
 		}
-		fns[i].Annotations[AnnotationKeyRuntimeDockerNetwork] = networkName
+
+		_, ok := fns[i].Annotations[AnnotationKeyRuntimeDockerNetwork]
+		if !ok {
+			fns[i].Annotations[AnnotationKeyRuntimeDockerNetwork] = networkName
+		}
 	}
 }
 

From 70f6cdd88b40431ce8bbab45f864383acf63ee41 Mon Sep 17 00:00:00 2001
From: Nikita Z <nkzk95@gmail.com>
Date: Thu, 4 Jun 2026 09:51:11 +0200
Subject: [PATCH 02/13] fix: if AnnotationKeyRuntimeDockerNetwork is set, start
 crossplane container in it

Signed-off-by: Nikita Z <nkzk95@gmail.com>
---
 cmd/crossplane/render/engine.go        |  5 +++--
 cmd/crossplane/render/engine_docker.go | 17 +++++++++++------
 cmd/crossplane/render/op/cmd.go        | 18 ++++++++++++++++--
 cmd/crossplane/render/xr/cmd.go        | 17 +++++++++++++++--
 4 files changed, 45 insertions(+), 12 deletions(-)

diff --git a/cmd/crossplane/render/engine.go b/cmd/crossplane/render/engine.go
index 1e08ce4..aa801fa 100644
--- a/cmd/crossplane/render/engine.go
+++ b/cmd/crossplane/render/engine.go
@@ -61,17 +61,18 @@ type EngineFlags struct {
 	CrossplaneVersion string `help:"Version of the Crossplane image to use for rendering. Defaults to the latest stable version." placeholder:"VERSION" xor:"crossplane-selector"`
 	CrossplaneImage   string `help:"Override the full Crossplane Docker image reference for rendering."                           placeholder:"IMAGE"   xor:"crossplane-selector"`
 	CrossplaneBinary  string `help:"Path to a local crossplane binary to use instead of Docker."                                  placeholder:"PATH"    type:"existingfile"       xor:"crossplane-selector"`
+	Network           string `help:"The network containers should connect to"`
 }
 
 // NewEngineFromFlags creates an Engine from the flag configuration. If a binary
 // path is set, it returns a local engine. Otherwise it returns a Docker engine
 // using the resolved image reference.
-func NewEngineFromFlags(f *EngineFlags, log logging.Logger) Engine {
+func NewEngineFromFlags(f *EngineFlags, network string, log logging.Logger) Engine {
 	if f.CrossplaneBinary != "" {
 		return &localRenderEngine{BinaryPath: f.CrossplaneBinary}
 	}
 
-	return &dockerRenderEngine{image: crossplaneImageFromFlags(f), log: log}
+	return &dockerRenderEngine{image: crossplaneImageFromFlags(f), network: network, log: log}
 }
 
 func crossplaneImageFromFlags(f *EngineFlags) string {
diff --git a/cmd/crossplane/render/engine_docker.go b/cmd/crossplane/render/engine_docker.go
index b67cf54..9bde1fb 100644
--- a/cmd/crossplane/render/engine_docker.go
+++ b/cmd/crossplane/render/engine_docker.go
@@ -83,13 +83,18 @@ func (e *dockerRenderEngine) CheckContextSupport() error {
 // containers also join it. The returned cleanup function removes the
 // network.
 func (e *dockerRenderEngine) Setup(ctx context.Context, fns []pkgv1.Function) (func(), error) {
-	networkID, networkName, err := createRenderNetwork(ctx)
-	if err != nil {
-		return func() {}, errors.Wrap(err, "cannot create Docker network for rendering")
-	}
+	var networkID, networkName string
 
-	e.network = networkName
-	injectNetworkAnnotation(fns, networkName)
+	if e.network == "" {
+		var err error
+		networkID, networkName, err = createRenderNetwork(ctx)
+		if err != nil {
+			return func() {}, errors.Wrap(err, "cannot create Docker network for rendering")
+		}
+		e.network = networkName
+
+		injectNetworkAnnotation(fns, networkName)
+	}
 
 	cleanup := func() { //nolint:contextcheck // Detached context for cleanup.
 		_ = removeRenderNetwork(context.Background(), networkID)
diff --git a/cmd/crossplane/render/op/cmd.go b/cmd/crossplane/render/op/cmd.go
index 04e6bc9..120cc79 100644
--- a/cmd/crossplane/render/op/cmd.go
+++ b/cmd/crossplane/render/op/cmd.go
@@ -22,6 +22,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 	"time"
 
 	"github.com/alecthomas/kong"
@@ -84,7 +85,7 @@ type Cmd struct {
 	fs afero.Fs
 
 	// newEngine constructs the render Engine.
-	newEngine func(*render.EngineFlags, logging.Logger) render.Engine
+	newEngine func(*render.EngineFlags, string, logging.Logger) render.Engine
 }
 
 // Help prints out the help for the alpha render op command.
@@ -167,7 +168,20 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger, sp terminal.SpinnerPrinte
 		}
 	}
 
-	engine := c.newEngine(&c.EngineFlags, log)
+	network := ""
+	for _, annotation := range c.FunctionAnnotations {
+		parts := strings.SplitN(annotation, "=", 2)
+		if len(parts) != 2 {
+			return errors.Errorf("invalid function annotation format %q, expected key=value", annotation)
+		}
+		key, value := parts[0], parts[1]
+		if key == render.AnnotationKeyRuntimeDockerNetwork {
+			network = value
+			break
+		}
+	}
+
+	engine := c.newEngine(&c.EngineFlags, network, log)
 
 	seedCtx := len(c.ContextValues) > 0 || len(c.ContextFiles) > 0
 	captureCtx := c.IncludeContext
diff --git a/cmd/crossplane/render/xr/cmd.go b/cmd/crossplane/render/xr/cmd.go
index f3995b7..26036f1 100644
--- a/cmd/crossplane/render/xr/cmd.go
+++ b/cmd/crossplane/render/xr/cmd.go
@@ -92,7 +92,7 @@ type Cmd struct {
 	fs afero.Fs
 
 	// newEngine constructs the render Engine.
-	newEngine func(*render.EngineFlags, logging.Logger) render.Engine
+	newEngine func(*render.EngineFlags, string, logging.Logger) render.Engine
 }
 
 // Help prints out the help for the render command.
@@ -224,7 +224,20 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger, sp terminal.SpinnerPrinte
 		}
 	}
 
-	engine := c.newEngine(&c.EngineFlags, log)
+	network := ""
+	for _, annotation := range c.FunctionAnnotations {
+		parts := strings.SplitN(annotation, "=", 2)
+		if len(parts) != 2 {
+			return errors.Errorf("invalid function annotation format %q, expected key=value", annotation)
+		}
+		key, value := parts[0], parts[1]
+		if key == render.AnnotationKeyRuntimeDockerNetwork {
+			network = value
+			break
+		}
+	}
+
+	engine := c.newEngine(&c.EngineFlags, network, log)
 
 	seedCtx := len(c.ContextValues) > 0 || len(c.ContextFiles) > 0
 	captureCtx := c.IncludeContext

From 556ef501c124d9bd1df14800c0059540bedd4902 Mon Sep 17 00:00:00 2001
From: Nikita Z <nkzk95@gmail.com>
Date: Thu, 4 Jun 2026 09:51:11 +0200
Subject: [PATCH 03/13] test: update newEngineFunc signature

Signed-off-by: Nikita Z <nkzk95@gmail.com>
---
 cmd/crossplane/render/op/cmd_test.go | 4 ++--
 cmd/crossplane/render/xr/cmd_test.go | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/cmd/crossplane/render/op/cmd_test.go b/cmd/crossplane/render/op/cmd_test.go
index f17ec0c..6a9e16e 100644
--- a/cmd/crossplane/render/op/cmd_test.go
+++ b/cmd/crossplane/render/op/cmd_test.go
@@ -63,8 +63,8 @@ var includeFunctionResultsOutput string
 //go:embed testdata/cmd/output/include-full-operation.yaml
 var includeFullOperationOutput string
 
-func newEngineFunc(engine render.Engine) func(*render.EngineFlags, logging.Logger) render.Engine {
-	return func(*render.EngineFlags, logging.Logger) render.Engine {
+func newEngineFunc(engine render.Engine) func(*render.EngineFlags, string, logging.Logger) render.Engine {
+	return func(*render.EngineFlags, string, logging.Logger) render.Engine {
 		return engine
 	}
 }
diff --git a/cmd/crossplane/render/xr/cmd_test.go b/cmd/crossplane/render/xr/cmd_test.go
index d57cc14..cf40315 100644
--- a/cmd/crossplane/render/xr/cmd_test.go
+++ b/cmd/crossplane/render/xr/cmd_test.go
@@ -78,8 +78,8 @@ var includeFunctionResultsOutput string
 //go:embed testdata/cmd/output/include-full-xr.yaml
 var includeFullXROutput string
 
-func newEngineFunc(engine render.Engine) func(*render.EngineFlags, logging.Logger) render.Engine {
-	return func(*render.EngineFlags, logging.Logger) render.Engine {
+func newEngineFunc(engine render.Engine) func(*render.EngineFlags, string, logging.Logger) render.Engine {
+	return func(*render.EngineFlags, string, logging.Logger) render.Engine {
 		return engine
 	}
 }

From 9ed0203cb28c8cd52df4501c67a54860b06f6135 Mon Sep 17 00:00:00 2001
From: Nikita Z <nkzk95@gmail.com>
Date: Thu, 4 Jun 2026 12:18:39 +0200
Subject: [PATCH 04/13] fix: remove network from engineflage, use
 dockerRenderEngine

Signed-off-by: Nikita Z <nkzk95@gmail.com>
---
 cmd/crossplane/render/engine.go        | 5 +++--
 cmd/crossplane/render/engine_docker.go | 3 +--
 cmd/crossplane/render/op/cmd.go        | 2 +-
 cmd/crossplane/render/xr/cmd.go        | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/cmd/crossplane/render/engine.go b/cmd/crossplane/render/engine.go
index aa801fa..333fb79 100644
--- a/cmd/crossplane/render/engine.go
+++ b/cmd/crossplane/render/engine.go
@@ -61,12 +61,13 @@ type EngineFlags struct {
 	CrossplaneVersion string `help:"Version of the Crossplane image to use for rendering. Defaults to the latest stable version." placeholder:"VERSION" xor:"crossplane-selector"`
 	CrossplaneImage   string `help:"Override the full Crossplane Docker image reference for rendering."                           placeholder:"IMAGE"   xor:"crossplane-selector"`
 	CrossplaneBinary  string `help:"Path to a local crossplane binary to use instead of Docker."                                  placeholder:"PATH"    type:"existingfile"       xor:"crossplane-selector"`
-	Network           string `help:"The network containers should connect to"`
 }
 
 // NewEngineFromFlags creates an Engine from the flag configuration. If a binary
 // path is set, it returns a local engine. Otherwise it returns a Docker engine
-// using the resolved image reference.
+// using the resolved image reference. The network parameter sets the Docker
+// network the render container should join; it is derived from function
+// annotations (AnnotationKeyRuntimeDockerNetwork) by the caller.
 func NewEngineFromFlags(f *EngineFlags, network string, log logging.Logger) Engine {
 	if f.CrossplaneBinary != "" {
 		return &localRenderEngine{BinaryPath: f.CrossplaneBinary}
diff --git a/cmd/crossplane/render/engine_docker.go b/cmd/crossplane/render/engine_docker.go
index 9bde1fb..83d5059 100644
--- a/cmd/crossplane/render/engine_docker.go
+++ b/cmd/crossplane/render/engine_docker.go
@@ -53,8 +53,7 @@ func (realContainerRunner) Run(ctx context.Context, img string, opts ...docker.R
 type dockerRenderEngine struct {
 	// image is the Crossplane Docker image reference.
 	image string
-	// network is the Docker network to connect the container to. When set,
-	// the container joins this network so it can reach function containers.
+	// network is the Docker network to connect the container to.
 	network string
 
 	log logging.Logger
diff --git a/cmd/crossplane/render/op/cmd.go b/cmd/crossplane/render/op/cmd.go
index 120cc79..ee70914 100644
--- a/cmd/crossplane/render/op/cmd.go
+++ b/cmd/crossplane/render/op/cmd.go
@@ -168,7 +168,7 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger, sp terminal.SpinnerPrinte
 		}
 	}
 
-	network := ""
+	var network string
 	for _, annotation := range c.FunctionAnnotations {
 		parts := strings.SplitN(annotation, "=", 2)
 		if len(parts) != 2 {
diff --git a/cmd/crossplane/render/xr/cmd.go b/cmd/crossplane/render/xr/cmd.go
index 26036f1..70401ef 100644
--- a/cmd/crossplane/render/xr/cmd.go
+++ b/cmd/crossplane/render/xr/cmd.go
@@ -224,7 +224,7 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger, sp terminal.SpinnerPrinte
 		}
 	}
 
-	network := ""
+	var network string
 	for _, annotation := range c.FunctionAnnotations {
 		parts := strings.SplitN(annotation, "=", 2)
 		if len(parts) != 2 {

From 396a2d11a3e2a5852ab925535adcd6b11b1a6740 Mon Sep 17 00:00:00 2001
From: Nikita Z <nkzk95@gmail.com>
Date: Thu, 4 Jun 2026 12:33:12 +0200
Subject: [PATCH 05/13] fix: move cleanup to the empty network branch

Signed-off-by: Nikita Z <nkzk95@gmail.com>
---
 cmd/crossplane/render/engine_docker.go | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/cmd/crossplane/render/engine_docker.go b/cmd/crossplane/render/engine_docker.go
index 83d5059..63ccb3d 100644
--- a/cmd/crossplane/render/engine_docker.go
+++ b/cmd/crossplane/render/engine_docker.go
@@ -93,13 +93,17 @@ func (e *dockerRenderEngine) Setup(ctx context.Context, fns []pkgv1.Function) (f
 		e.network = networkName
 
 		injectNetworkAnnotation(fns, networkName)
-	}
 
-	cleanup := func() { //nolint:contextcheck // Detached context for cleanup.
-		_ = removeRenderNetwork(context.Background(), networkID)
+		cleanup := func() { //nolint:contextcheck // Detached context for cleanup.
+			_ = removeRenderNetwork(context.Background(), networkID)
+		}
+
+		return cleanup, nil
 	}
 
-	return cleanup, nil
+	// e.network was pre-configured by the caller (e.g. from a function
+	// annotation). We don't own the network, so there is nothing to clean up.
+	return func() {}, nil
 }
 
 // Render marshals the request, runs it through a Docker container, and returns

From f30628ac27d2597fa46d3dfc8f98aeca65f2f5d1 Mon Sep 17 00:00:00 2001
From: Nikita Z <nkzk95@gmail.com>
Date: Tue, 9 Jun 2026 13:43:23 +0200
Subject: [PATCH 06/13] refactor: move common annotation logic to
 render/annotation.go

Signed-off-by: Nikita Z <nkzk95@gmail.com>
---
 cmd/crossplane/render/annotation.go | 23 +++++++++++++++++++++++
 cmd/crossplane/render/op/cmd.go     | 14 +++-----------
 cmd/crossplane/render/xr/cmd.go     | 13 +++----------
 3 files changed, 29 insertions(+), 21 deletions(-)
 create mode 100644 cmd/crossplane/render/annotation.go

diff --git a/cmd/crossplane/render/annotation.go b/cmd/crossplane/render/annotation.go
new file mode 100644
index 0000000..e596e7c
--- /dev/null
+++ b/cmd/crossplane/render/annotation.go
@@ -0,0 +1,23 @@
+package render
+
+import "strings"
+
+type Annotations map[string]string
+
+// NewAnnotationsFromStrings parses an array of strings in the format "key=value" into a map.
+// Silently skips strings in incorrect format.
+func NewAnnotationsFromStrings(annotations []string) Annotations {
+	result := make(Annotations, 0)
+	for _, annotation := range annotations {
+		parts := strings.SplitN(annotation, "=", 2)
+
+		if len(parts) != 2 {
+			continue
+		}
+
+		key, value := parts[0], parts[1]
+		result[key] = value
+	}
+
+	return result
+}
diff --git a/cmd/crossplane/render/op/cmd.go b/cmd/crossplane/render/op/cmd.go
index ee70914..032a9df 100644
--- a/cmd/crossplane/render/op/cmd.go
+++ b/cmd/crossplane/render/op/cmd.go
@@ -22,7 +22,6 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"strings"
 	"time"
 
 	"github.com/alecthomas/kong"
@@ -169,16 +168,9 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger, sp terminal.SpinnerPrinte
 	}
 
 	var network string
-	for _, annotation := range c.FunctionAnnotations {
-		parts := strings.SplitN(annotation, "=", 2)
-		if len(parts) != 2 {
-			return errors.Errorf("invalid function annotation format %q, expected key=value", annotation)
-		}
-		key, value := parts[0], parts[1]
-		if key == render.AnnotationKeyRuntimeDockerNetwork {
-			network = value
-			break
-		}
+	annotations := render.NewAnnotationsFromStrings(c.FunctionAnnotations)
+	if value, ok := annotations[render.AnnotationKeyRuntimeDockerNetwork]; ok {
+		network = value
 	}
 
 	engine := c.newEngine(&c.EngineFlags, network, log)
diff --git a/cmd/crossplane/render/xr/cmd.go b/cmd/crossplane/render/xr/cmd.go
index 70401ef..1ec9bd8 100644
--- a/cmd/crossplane/render/xr/cmd.go
+++ b/cmd/crossplane/render/xr/cmd.go
@@ -225,16 +225,9 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger, sp terminal.SpinnerPrinte
 	}
 
 	var network string
-	for _, annotation := range c.FunctionAnnotations {
-		parts := strings.SplitN(annotation, "=", 2)
-		if len(parts) != 2 {
-			return errors.Errorf("invalid function annotation format %q, expected key=value", annotation)
-		}
-		key, value := parts[0], parts[1]
-		if key == render.AnnotationKeyRuntimeDockerNetwork {
-			network = value
-			break
-		}
+	annotations := render.NewAnnotationsFromStrings(c.FunctionAnnotations)
+	if value, ok := annotations[render.AnnotationKeyRuntimeDockerNetwork]; ok {
+		network = value
 	}
 
 	engine := c.newEngine(&c.EngineFlags, network, log)

From 3eeb4628fe1ffea769828f1df1ddf7a3bf08343a Mon Sep 17 00:00:00 2001
From: Nikita Z <nkzk95@gmail.com>
Date: Wed, 10 Jun 2026 13:38:41 +0200
Subject: [PATCH 07/13] chore: specify that injectNetworkAnnotation does not
 overwrite annotations in comment

Signed-off-by: Nikita Z <nkzk95@gmail.com>
---
 cmd/crossplane/render/render.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/cmd/crossplane/render/render.go b/cmd/crossplane/render/render.go
index 25b0be8..90d406e 100644
--- a/cmd/crossplane/render/render.go
+++ b/cmd/crossplane/render/render.go
@@ -151,7 +151,8 @@ func RewriteAddressesForDocker(fns []*renderv1alpha1.FunctionInput) []*renderv1a
 	return fns
 }
 
-// injectNetworkAnnotation sets the Docker network annotation on all functions
+// injectNetworkAnnotation sets the Docker network annotation
+// on all functions without existing runtime-docker-network annotation
 // so their containers join the specified network.
 func injectNetworkAnnotation(fns []pkgv1.Function, networkName string) {
 	for i := range fns {

From 4a859e9fa76f7dc99b829c69a348e7f6643461e3 Mon Sep 17 00:00:00 2001
From: Nikita Z <nkzk95@gmail.com>
Date: Thu, 11 Jun 2026 11:43:59 +0200
Subject: [PATCH 08/13] refactor(dockerRenderEngine/setup): return early if
 e.network is set

Signed-off-by: Nikita Z <nkzk95@gmail.com>
---
 cmd/crossplane/render/engine_docker.go | 29 +++++++++++++-------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/cmd/crossplane/render/engine_docker.go b/cmd/crossplane/render/engine_docker.go
index 63ccb3d..7815f13 100644
--- a/cmd/crossplane/render/engine_docker.go
+++ b/cmd/crossplane/render/engine_docker.go
@@ -84,26 +84,25 @@ func (e *dockerRenderEngine) CheckContextSupport() error {
 func (e *dockerRenderEngine) Setup(ctx context.Context, fns []pkgv1.Function) (func(), error) {
 	var networkID, networkName string
 
-	if e.network == "" {
-		var err error
-		networkID, networkName, err = createRenderNetwork(ctx)
-		if err != nil {
-			return func() {}, errors.Wrap(err, "cannot create Docker network for rendering")
-		}
-		e.network = networkName
+	if e.network != "" {
+		// e.network was pre-configured, we don't own the network, so there is nothing to clean up.
+		return func() {}, nil
+	}
 
-		injectNetworkAnnotation(fns, networkName)
+	var err error
+	networkID, networkName, err = createRenderNetwork(ctx)
+	if err != nil {
+		return func() {}, errors.Wrap(err, "cannot create Docker network for rendering")
+	}
+	e.network = networkName
 
-		cleanup := func() { //nolint:contextcheck // Detached context for cleanup.
-			_ = removeRenderNetwork(context.Background(), networkID)
-		}
+	injectNetworkAnnotation(fns, networkName)
 
-		return cleanup, nil
+	cleanup := func() { //nolint:contextcheck // Detached context for cleanup.
+		_ = removeRenderNetwork(context.Background(), networkID)
 	}
 
-	// e.network was pre-configured by the caller (e.g. from a function
-	// annotation). We don't own the network, so there is nothing to clean up.
-	return func() {}, nil
+	return cleanup, nil
 }
 
 // Render marshals the request, runs it through a Docker container, and returns

From a2deb33ba46d9b9484f0937da74ad5dbcb97bb35 Mon Sep 17 00:00:00 2001
From: Nikita Z <nkzk95@gmail.com>
Date: Thu, 11 Jun 2026 13:41:26 +0200
Subject: [PATCH 09/13] refactor(render/dockerengine): add
 CrossplaneDockerNetwork to engineflags

if empty, default to the first docker-network annotation in the provided functions. If provided, the docker-network annotation in the FunctionAnnotations cli flag takes presedence

Signed-off-by: Nikita Z <nkzk95@gmail.com>
---
 cmd/crossplane/render/engine.go      | 11 ++++++-----
 cmd/crossplane/render/op/cmd.go      | 25 ++++++++++++++++++-------
 cmd/crossplane/render/op/cmd_test.go |  4 ++--
 cmd/crossplane/render/xr/cmd.go      | 24 ++++++++++++++++++------
 cmd/crossplane/render/xr/cmd_test.go |  4 ++--
 5 files changed, 46 insertions(+), 22 deletions(-)

diff --git a/cmd/crossplane/render/engine.go b/cmd/crossplane/render/engine.go
index 333fb79..0c70add 100644
--- a/cmd/crossplane/render/engine.go
+++ b/cmd/crossplane/render/engine.go
@@ -58,9 +58,10 @@ type Engine interface {
 // EngineFlags contains flags for configuring the render engine. It is embedded
 // by render command structs to provide shared engine configuration.
 type EngineFlags struct {
-	CrossplaneVersion string `help:"Version of the Crossplane image to use for rendering. Defaults to the latest stable version." placeholder:"VERSION" xor:"crossplane-selector"`
-	CrossplaneImage   string `help:"Override the full Crossplane Docker image reference for rendering."                           placeholder:"IMAGE"   xor:"crossplane-selector"`
-	CrossplaneBinary  string `help:"Path to a local crossplane binary to use instead of Docker."                                  placeholder:"PATH"    type:"existingfile"       xor:"crossplane-selector"`
+	CrossplaneVersion       string `help:"Version of the Crossplane image to use for rendering. Defaults to the latest stable version." placeholder:"VERSION" xor:"crossplane-selector"`
+	CrossplaneImage         string `help:"Override the full Crossplane Docker image reference for rendering."                           placeholder:"IMAGE"   xor:"crossplane-selector"`
+	CrossplaneBinary        string `help:"Path to a local crossplane binary to use instead of Docker."                                  placeholder:"PATH"    type:"existingfile"       xor:"crossplane-selector,crossplane-docker"`
+	CrossplaneDockerNetwork string `help:"The docker network to start the crossplane container in"                                      xor:"crossplane-docker"`
 }
 
 // NewEngineFromFlags creates an Engine from the flag configuration. If a binary
@@ -68,12 +69,12 @@ type EngineFlags struct {
 // using the resolved image reference. The network parameter sets the Docker
 // network the render container should join; it is derived from function
 // annotations (AnnotationKeyRuntimeDockerNetwork) by the caller.
-func NewEngineFromFlags(f *EngineFlags, network string, log logging.Logger) Engine {
+func NewEngineFromFlags(f *EngineFlags, log logging.Logger) Engine {
 	if f.CrossplaneBinary != "" {
 		return &localRenderEngine{BinaryPath: f.CrossplaneBinary}
 	}
 
-	return &dockerRenderEngine{image: crossplaneImageFromFlags(f), network: network, log: log}
+	return &dockerRenderEngine{image: crossplaneImageFromFlags(f), network: f.CrossplaneDockerNetwork, log: log}
 }
 
 func crossplaneImageFromFlags(f *EngineFlags) string {
diff --git a/cmd/crossplane/render/op/cmd.go b/cmd/crossplane/render/op/cmd.go
index 032a9df..83f5e98 100644
--- a/cmd/crossplane/render/op/cmd.go
+++ b/cmd/crossplane/render/op/cmd.go
@@ -84,7 +84,7 @@ type Cmd struct {
 	fs afero.Fs
 
 	// newEngine constructs the render Engine.
-	newEngine func(*render.EngineFlags, string, logging.Logger) render.Engine
+	newEngine func(*render.EngineFlags, logging.Logger) render.Engine
 }
 
 // Help prints out the help for the alpha render op command.
@@ -167,13 +167,25 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger, sp terminal.SpinnerPrinte
 		}
 	}
 
-	var network string
-	annotations := render.NewAnnotationsFromStrings(c.FunctionAnnotations)
-	if value, ok := annotations[render.AnnotationKeyRuntimeDockerNetwork]; ok {
-		network = value
+	if c.EngineFlags.CrossplaneDockerNetwork == "" {
+		// Default to the first docker-network annotation in the provided functions
+		for _, fn := range fns {
+			if value, ok := fn.Annotations[render.AnnotationKeyRuntimeDockerNetwork]; ok {
+				c.CrossplaneDockerNetwork = value
+				break
+			}
+		}
+
+		// Overwrite with docker-network annotation from function-annotations cli flag if set
+		if len(c.FunctionAnnotations) > 0 {
+			annotations := render.NewAnnotationsFromStrings(c.FunctionAnnotations)
+			if value, ok := annotations[render.AnnotationKeyRuntimeDockerNetwork]; ok {
+				c.EngineFlags.CrossplaneDockerNetwork = value
+			}
+		}
 	}
 
-	engine := c.newEngine(&c.EngineFlags, network, log)
+	engine := c.newEngine(&c.EngineFlags, log)
 
 	seedCtx := len(c.ContextValues) > 0 || len(c.ContextFiles) > 0
 	captureCtx := c.IncludeContext
@@ -404,6 +416,5 @@ func (c *Cmd) loadFunctions(ctx context.Context, log logging.Logger, sp terminal
 	}); err != nil {
 		return nil, errors.Wrap(err, "cannot build embedded functions")
 	}
-
 	return fns, nil
 }
diff --git a/cmd/crossplane/render/op/cmd_test.go b/cmd/crossplane/render/op/cmd_test.go
index 6a9e16e..f17ec0c 100644
--- a/cmd/crossplane/render/op/cmd_test.go
+++ b/cmd/crossplane/render/op/cmd_test.go
@@ -63,8 +63,8 @@ var includeFunctionResultsOutput string
 //go:embed testdata/cmd/output/include-full-operation.yaml
 var includeFullOperationOutput string
 
-func newEngineFunc(engine render.Engine) func(*render.EngineFlags, string, logging.Logger) render.Engine {
-	return func(*render.EngineFlags, string, logging.Logger) render.Engine {
+func newEngineFunc(engine render.Engine) func(*render.EngineFlags, logging.Logger) render.Engine {
+	return func(*render.EngineFlags, logging.Logger) render.Engine {
 		return engine
 	}
 }
diff --git a/cmd/crossplane/render/xr/cmd.go b/cmd/crossplane/render/xr/cmd.go
index 1ec9bd8..160122f 100644
--- a/cmd/crossplane/render/xr/cmd.go
+++ b/cmd/crossplane/render/xr/cmd.go
@@ -92,7 +92,7 @@ type Cmd struct {
 	fs afero.Fs
 
 	// newEngine constructs the render Engine.
-	newEngine func(*render.EngineFlags, string, logging.Logger) render.Engine
+	newEngine func(*render.EngineFlags, logging.Logger) render.Engine
 }
 
 // Help prints out the help for the render command.
@@ -224,13 +224,25 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger, sp terminal.SpinnerPrinte
 		}
 	}
 
-	var network string
-	annotations := render.NewAnnotationsFromStrings(c.FunctionAnnotations)
-	if value, ok := annotations[render.AnnotationKeyRuntimeDockerNetwork]; ok {
-		network = value
+	if c.EngineFlags.CrossplaneDockerNetwork == "" {
+		// Default to the first docker-network annotation in the provided functions
+		for _, fn := range fns {
+			if value, ok := fn.Annotations[render.AnnotationKeyRuntimeDockerNetwork]; ok {
+				c.CrossplaneDockerNetwork = value
+				break
+			}
+		}
+
+		// Overwrite with docker-network annotation from function-annotations cli flag if set
+		if len(c.FunctionAnnotations) > 0 {
+			annotations := render.NewAnnotationsFromStrings(c.FunctionAnnotations)
+			if value, ok := annotations[render.AnnotationKeyRuntimeDockerNetwork]; ok {
+				c.EngineFlags.CrossplaneDockerNetwork = value
+			}
+		}
 	}
 
-	engine := c.newEngine(&c.EngineFlags, network, log)
+	engine := c.newEngine(&c.EngineFlags, log)
 
 	seedCtx := len(c.ContextValues) > 0 || len(c.ContextFiles) > 0
 	captureCtx := c.IncludeContext
diff --git a/cmd/crossplane/render/xr/cmd_test.go b/cmd/crossplane/render/xr/cmd_test.go
index cf40315..d57cc14 100644
--- a/cmd/crossplane/render/xr/cmd_test.go
+++ b/cmd/crossplane/render/xr/cmd_test.go
@@ -78,8 +78,8 @@ var includeFunctionResultsOutput string
 //go:embed testdata/cmd/output/include-full-xr.yaml
 var includeFullXROutput string
 
-func newEngineFunc(engine render.Engine) func(*render.EngineFlags, string, logging.Logger) render.Engine {
-	return func(*render.EngineFlags, string, logging.Logger) render.Engine {
+func newEngineFunc(engine render.Engine) func(*render.EngineFlags, logging.Logger) render.Engine {
+	return func(*render.EngineFlags, logging.Logger) render.Engine {
 		return engine
 	}
 }

From 28cb43e55dda27af9d7dad838ec8034987d26ccd Mon Sep 17 00:00:00 2001
From: Nikita Z <nkzk95@gmail.com>
Date: Thu, 11 Jun 2026 13:44:05 +0200
Subject: [PATCH 10/13] chore: change c.EngineFlags.CrossplaneDockerNetwork
 refs to c.CrossplaneDockerNetwork

Signed-off-by: Nikita Z <nkzk95@gmail.com>
---
 cmd/crossplane/render/op/cmd.go | 2 +-
 cmd/crossplane/render/xr/cmd.go | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/cmd/crossplane/render/op/cmd.go b/cmd/crossplane/render/op/cmd.go
index 83f5e98..1ab57a4 100644
--- a/cmd/crossplane/render/op/cmd.go
+++ b/cmd/crossplane/render/op/cmd.go
@@ -180,7 +180,7 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger, sp terminal.SpinnerPrinte
 		if len(c.FunctionAnnotations) > 0 {
 			annotations := render.NewAnnotationsFromStrings(c.FunctionAnnotations)
 			if value, ok := annotations[render.AnnotationKeyRuntimeDockerNetwork]; ok {
-				c.EngineFlags.CrossplaneDockerNetwork = value
+				c.CrossplaneDockerNetwork = value
 			}
 		}
 	}
diff --git a/cmd/crossplane/render/xr/cmd.go b/cmd/crossplane/render/xr/cmd.go
index 160122f..b61cd3d 100644
--- a/cmd/crossplane/render/xr/cmd.go
+++ b/cmd/crossplane/render/xr/cmd.go
@@ -237,7 +237,7 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger, sp terminal.SpinnerPrinte
 		if len(c.FunctionAnnotations) > 0 {
 			annotations := render.NewAnnotationsFromStrings(c.FunctionAnnotations)
 			if value, ok := annotations[render.AnnotationKeyRuntimeDockerNetwork]; ok {
-				c.EngineFlags.CrossplaneDockerNetwork = value
+				c.CrossplaneDockerNetwork = value
 			}
 		}
 	}

From ba4a1c48392eac6faba155f2745d3929b4532356 Mon Sep 17 00:00:00 2001
From: Nikita Z <nkzk95@gmail.com>
Date: Thu, 11 Jun 2026 13:44:51 +0200
Subject: [PATCH 11/13] chore: add back newline

Signed-off-by: Nikita Z <nkzk95@gmail.com>
---
 cmd/crossplane/render/op/cmd.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cmd/crossplane/render/op/cmd.go b/cmd/crossplane/render/op/cmd.go
index 1ab57a4..4d507cd 100644
--- a/cmd/crossplane/render/op/cmd.go
+++ b/cmd/crossplane/render/op/cmd.go
@@ -416,5 +416,6 @@ func (c *Cmd) loadFunctions(ctx context.Context, log logging.Logger, sp terminal
 	}); err != nil {
 		return nil, errors.Wrap(err, "cannot build embedded functions")
 	}
+
 	return fns, nil
 }

From ce75dc1be718af82d564751307690e5f3502ef99 Mon Sep 17 00:00:00 2001
From: Nikita Z <nkzk95@gmail.com>
Date: Thu, 11 Jun 2026 14:03:47 +0200
Subject: [PATCH 12/13] chore: use c.EngineFlags.CrossplaneDockerNetwork to be
 explicit

Signed-off-by: Nikita Z <nkzk95@gmail.com>
---
 cmd/crossplane/render/engine.go | 4 +---
 cmd/crossplane/render/op/cmd.go | 4 ++--
 cmd/crossplane/render/xr/cmd.go | 4 ++--
 3 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/cmd/crossplane/render/engine.go b/cmd/crossplane/render/engine.go
index 0c70add..9bb55ac 100644
--- a/cmd/crossplane/render/engine.go
+++ b/cmd/crossplane/render/engine.go
@@ -66,9 +66,7 @@ type EngineFlags struct {
 
 // NewEngineFromFlags creates an Engine from the flag configuration. If a binary
 // path is set, it returns a local engine. Otherwise it returns a Docker engine
-// using the resolved image reference. The network parameter sets the Docker
-// network the render container should join; it is derived from function
-// annotations (AnnotationKeyRuntimeDockerNetwork) by the caller.
+// using the resolved image reference.
 func NewEngineFromFlags(f *EngineFlags, log logging.Logger) Engine {
 	if f.CrossplaneBinary != "" {
 		return &localRenderEngine{BinaryPath: f.CrossplaneBinary}
diff --git a/cmd/crossplane/render/op/cmd.go b/cmd/crossplane/render/op/cmd.go
index 4d507cd..a258b0a 100644
--- a/cmd/crossplane/render/op/cmd.go
+++ b/cmd/crossplane/render/op/cmd.go
@@ -171,7 +171,7 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger, sp terminal.SpinnerPrinte
 		// Default to the first docker-network annotation in the provided functions
 		for _, fn := range fns {
 			if value, ok := fn.Annotations[render.AnnotationKeyRuntimeDockerNetwork]; ok {
-				c.CrossplaneDockerNetwork = value
+				c.EngineFlags.CrossplaneDockerNetwork = value
 				break
 			}
 		}
@@ -180,7 +180,7 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger, sp terminal.SpinnerPrinte
 		if len(c.FunctionAnnotations) > 0 {
 			annotations := render.NewAnnotationsFromStrings(c.FunctionAnnotations)
 			if value, ok := annotations[render.AnnotationKeyRuntimeDockerNetwork]; ok {
-				c.CrossplaneDockerNetwork = value
+				c.EngineFlags.CrossplaneDockerNetwork = value
 			}
 		}
 	}
diff --git a/cmd/crossplane/render/xr/cmd.go b/cmd/crossplane/render/xr/cmd.go
index b61cd3d..39ec298 100644
--- a/cmd/crossplane/render/xr/cmd.go
+++ b/cmd/crossplane/render/xr/cmd.go
@@ -228,7 +228,7 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger, sp terminal.SpinnerPrinte
 		// Default to the first docker-network annotation in the provided functions
 		for _, fn := range fns {
 			if value, ok := fn.Annotations[render.AnnotationKeyRuntimeDockerNetwork]; ok {
-				c.CrossplaneDockerNetwork = value
+				c.EngineFlags.CrossplaneDockerNetwork = value
 				break
 			}
 		}
@@ -237,7 +237,7 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger, sp terminal.SpinnerPrinte
 		if len(c.FunctionAnnotations) > 0 {
 			annotations := render.NewAnnotationsFromStrings(c.FunctionAnnotations)
 			if value, ok := annotations[render.AnnotationKeyRuntimeDockerNetwork]; ok {
-				c.CrossplaneDockerNetwork = value
+				c.EngineFlags.CrossplaneDockerNetwork = value
 			}
 		}
 	}

From 5ecd13a0c691e0103eff40db7ad19de1ef3b9f60 Mon Sep 17 00:00:00 2001
From: Nikita Z <nkzk95@gmail.com>
Date: Fri, 12 Jun 2026 08:49:00 +0200
Subject: [PATCH 13/13] chore: fix lints and format

Signed-off-by: Nikita Z <nkzk95@gmail.com>
---
 cmd/crossplane/render/annotation.go | 1 +
 cmd/crossplane/render/engine.go     | 6 +++---
 cmd/crossplane/render/op/cmd.go     | 6 +++---
 cmd/crossplane/render/xr/cmd.go     | 6 +++---
 4 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/cmd/crossplane/render/annotation.go b/cmd/crossplane/render/annotation.go
index e596e7c..f88a55a 100644
--- a/cmd/crossplane/render/annotation.go
+++ b/cmd/crossplane/render/annotation.go
@@ -2,6 +2,7 @@ package render
 
 import "strings"
 
+// Annotations is a type used to store annotations.
 type Annotations map[string]string
 
 // NewAnnotationsFromStrings parses an array of strings in the format "key=value" into a map.
diff --git a/cmd/crossplane/render/engine.go b/cmd/crossplane/render/engine.go
index 9bb55ac..d8ebed0 100644
--- a/cmd/crossplane/render/engine.go
+++ b/cmd/crossplane/render/engine.go
@@ -58,9 +58,9 @@ type Engine interface {
 // EngineFlags contains flags for configuring the render engine. It is embedded
 // by render command structs to provide shared engine configuration.
 type EngineFlags struct {
-	CrossplaneVersion       string `help:"Version of the Crossplane image to use for rendering. Defaults to the latest stable version." placeholder:"VERSION" xor:"crossplane-selector"`
-	CrossplaneImage         string `help:"Override the full Crossplane Docker image reference for rendering."                           placeholder:"IMAGE"   xor:"crossplane-selector"`
-	CrossplaneBinary        string `help:"Path to a local crossplane binary to use instead of Docker."                                  placeholder:"PATH"    type:"existingfile"       xor:"crossplane-selector,crossplane-docker"`
+	CrossplaneVersion       string `help:"Version of the Crossplane image to use for rendering. Defaults to the latest stable version." placeholder:"VERSION"   xor:"crossplane-selector"`
+	CrossplaneImage         string `help:"Override the full Crossplane Docker image reference for rendering."                           placeholder:"IMAGE"     xor:"crossplane-selector"`
+	CrossplaneBinary        string `help:"Path to a local crossplane binary to use instead of Docker."                                  placeholder:"PATH"      type:"existingfile"       xor:"crossplane-selector,crossplane-docker"`
 	CrossplaneDockerNetwork string `help:"The docker network to start the crossplane container in"                                      xor:"crossplane-docker"`
 }
 
diff --git a/cmd/crossplane/render/op/cmd.go b/cmd/crossplane/render/op/cmd.go
index a258b0a..9cace63 100644
--- a/cmd/crossplane/render/op/cmd.go
+++ b/cmd/crossplane/render/op/cmd.go
@@ -167,11 +167,11 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger, sp terminal.SpinnerPrinte
 		}
 	}
 
-	if c.EngineFlags.CrossplaneDockerNetwork == "" {
+	if c.CrossplaneDockerNetwork == "" {
 		// Default to the first docker-network annotation in the provided functions
 		for _, fn := range fns {
 			if value, ok := fn.Annotations[render.AnnotationKeyRuntimeDockerNetwork]; ok {
-				c.EngineFlags.CrossplaneDockerNetwork = value
+				c.CrossplaneDockerNetwork = value
 				break
 			}
 		}
@@ -180,7 +180,7 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger, sp terminal.SpinnerPrinte
 		if len(c.FunctionAnnotations) > 0 {
 			annotations := render.NewAnnotationsFromStrings(c.FunctionAnnotations)
 			if value, ok := annotations[render.AnnotationKeyRuntimeDockerNetwork]; ok {
-				c.EngineFlags.CrossplaneDockerNetwork = value
+				c.CrossplaneDockerNetwork = value
 			}
 		}
 	}
diff --git a/cmd/crossplane/render/xr/cmd.go b/cmd/crossplane/render/xr/cmd.go
index 39ec298..2b80f3b 100644
--- a/cmd/crossplane/render/xr/cmd.go
+++ b/cmd/crossplane/render/xr/cmd.go
@@ -224,11 +224,11 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger, sp terminal.SpinnerPrinte
 		}
 	}
 
-	if c.EngineFlags.CrossplaneDockerNetwork == "" {
+	if c.CrossplaneDockerNetwork == "" {
 		// Default to the first docker-network annotation in the provided functions
 		for _, fn := range fns {
 			if value, ok := fn.Annotations[render.AnnotationKeyRuntimeDockerNetwork]; ok {
-				c.EngineFlags.CrossplaneDockerNetwork = value
+				c.CrossplaneDockerNetwork = value
 				break
 			}
 		}
@@ -237,7 +237,7 @@ func (c *Cmd) Run(k *kong.Context, log logging.Logger, sp terminal.SpinnerPrinte
 		if len(c.FunctionAnnotations) > 0 {
 			annotations := render.NewAnnotationsFromStrings(c.FunctionAnnotations)
 			if value, ok := annotations[render.AnnotationKeyRuntimeDockerNetwork]; ok {
-				c.EngineFlags.CrossplaneDockerNetwork = value
+				c.CrossplaneDockerNetwork = value
 			}
 		}
 	}