Which means that these variables (DOCKER_HOST, DOCKER_TLS_VERIFY, DOCKER_CERT_PATH) are not part of the docker exec environment, meaning you cannot use a remote server. Of course the whole step probably will not work with a remote server either (since the workspace bind-mount is unlikely to be correct).

The quick fix would be to set these three if present in the host environment.

Probably it is incorrect for the ProcStarter used for docker exec to be suppressing environment variables from the host, but need to investigate why it was done this way to begin with. Can they "leak" into the container process? Perhaps an inherited JENKINS_SERVER_COOKIE was the problem: if you stop the build inside docker exec, you want the kill signal sent only via the decorated launcher's kill method, so that the shell step inside the container receives SIGTERM and is given a chance to shut down cleanly; you do not want docker exec itself to receive SIGTERM.