diff --git a/docs/plans/newsletter.md b/docs/plans/newsletter.md
new file mode 100644
index 0000000..4f70f66
--- /dev/null
+++ b/docs/plans/newsletter.md
@@ -0,0 +1,345 @@
+# Newsletter signup (weekly updates)
+
+Goal: build an email subscriber list for a weekly "what's changed" update,
+collected from **both** the termic.dev site and inside the termic app.
+
+## Provider: Kit (ConvertKit)
+
+Chosen for the larger free tier (10k subscribers) over Buttondown (100).
+
+Key property that makes this simple: Kit's **public form-subscribe endpoint
+needs no API key**, so the static site and the desktop app can both POST to
+it directly. No backend, no stored secret (which we'd never want to ship in
+a desktop binary anyway).
+
+```
+POST https://app.kit.com/forms/<FORM_ID>/subscriptions
+Content-Type: application/json
+{ "email_address": "user@example.com" }
+```
+
+### One-time setup before implementing
+
+1. Create a Kit account.
+2. Grow, Landing Pages and Forms, create an **inline form**.
+3. The embed URL ends in the form id, e.g. `.../forms/8284615/subscriptions`
+   → `FORM_ID = 8284615`.
+4. Plug that id into the two `<FORM_ID>` placeholders below (one in the
+   Rust const, one in the site form). Same id for both.
+
+## Part 1: termic.dev site (Astro on Cloudflare Pages)
+
+Static host, so the plain-HTML-form pattern works with zero Functions.
+
+- Add a styled `<form action="https://app.kit.com/forms/<FORM_ID>/subscriptions"
+  method="post">` with an `email_address` input.
+- Best home: `src/components/Footer.astro` (alternatively the hero in
+  `src/pages/index.astro`).
+- Match existing CSS (`src/styles/global.css`). Inline success/error via a
+  tiny `<script>` doing `fetch()` + `e.preventDefault()` so the page doesn't
+  navigate to Kit's bare response.
+- Optional spam hardening: pair with **Cloudflare Turnstile** (free, already
+  on CF) since there's no backend to rate-limit.
+
+Site repo lives at `~/r/termic.dev` (see memory: termic-dev-website-repo).
+
+## Part 2: termic app (in-app subscribe)
+
+### Decisions (from the user)
+
+- **Placement:** the bottom-left card slot in the sidebar (same slot as the
+  update / what's-new `UpdateCard`). Shown **only if the user hasn't
+  subscribed** yet. It must **yield to `UpdateCard`** when a real update or
+  unseen release note is live, so the two never stack.
+- **Transport:** a **Rust Tauri command** (not webview `fetch`), to bypass
+  WKWebView CORS and stay reliable. Async so the HTTPS call never blocks the
+  WKWebView event loop (per CLAUDE.md: no synchronous IO-heavy commands).
+
+### 2a. Rust dependency (`src-tauri/Cargo.toml`)
+
+`reqwest` is only in the tree transitively (via `tauri-plugin-updater`), so
+pin it direct. Use rustls to avoid pulling OpenSSL.
+
+```toml
+# Plain HTTPS POST for the newsletter_subscribe command (Kit public form
+# endpoint). Already in the tree via tauri-plugin-updater; pinning it direct
+# with rustls keeps it off OpenSSL.
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
+```
+
+(Insert after the `tauri-plugin-process` line.)
+
+### 2b. Rust command (`src-tauri/src/lib.rs`)
+
+Place after the `notify` command (~line 5933).
+
+```rust
+/// Kit (ConvertKit) public form id. The termic.dev site form posts to the
+/// same id. Public endpoint, no API key needed. Fill once the Kit form
+/// exists (Grow, Landing Pages and Forms, create an inline form, the embed
+/// URL ends in the id).
+const KIT_FORM_ID: &str = "REPLACE_WITH_KIT_FORM_ID";
+
+/// Subscribe an email to the weekly-updates newsletter via Kit's public
+/// form endpoint. Async so the HTTPS call never blocks the WKWebView event
+/// loop. Returns Err(message) on invalid input or network/HTTP failure so
+/// the sidebar card can surface it.
+#[tauri::command]
+async fn newsletter_subscribe(email: String) -> Result<(), String> {
+    let email = email.trim();
+    if email.is_empty() || !email.contains('@') {
+        return Err("Enter a valid email address.".into());
+    }
+    let url = format!("https://app.kit.com/forms/{KIT_FORM_ID}/subscriptions");
+    let resp = reqwest::Client::new()
+        .post(&url)
+        .json(&serde_json::json!({ "email_address": email }))
+        .send()
+        .await
+        .map_err(|e| format!("Network error: {e}"))?;
+    if resp.status().is_success() {
+        Ok(())
+    } else {
+        Err(format!("Subscribe failed ({}). Please try again.", resp.status().as_u16()))
+    }
+}
+```
+
+Register it in the `tauri::generate_handler![...]` block (~line 7169),
+alongside `notify`:
+
+```rust
+notify, newsletter_subscribe, open_path, reveal_path, ...
+```
+
+### 2c. IPC wrapper (`src/lib/ipc.ts`)
+
+Add above the `workspaces` section:
+
+```ts
+// ───────────────────────────── newsletter ─────────────────────────────
+
+/** Subscribe an email to the weekly-updates newsletter (Kit public form).
+ *  Rejects on invalid input or network/HTTP failure (message is shown). */
+export const newsletterSubscribe = (email: string) => invoke<void>("newsletter_subscribe", { email });
+```
+
+### 2d. Store (`src/store/newsletter.ts`, new file)
+
+Tiny dedicated store (app state / one-shot watermark, not a user pref, so
+kept out of `prefs.ts`). localStorage-persisted so the card stays hidden
+once subscribed or dismissed.
+
+```ts
+// Weekly-updates newsletter signup state. Persisted to localStorage so the
+// bottom-left sidebar card stays hidden once the user subscribes (or
+// dismisses it). Kept tiny and separate from prefs.ts — this is app state
+// (a one-shot prompt watermark), not a user-facing preference.
+
+import { create } from "zustand";
+import { newsletterSubscribe } from "@/lib/ipc";
+
+const LS_SUBSCRIBED = "newsletterSubscribed";
+const LS_DISMISSED  = "newsletterDismissed";
+
+function lsGet(k: string): boolean {
+  try { return localStorage.getItem(k) === "1"; } catch { return false; }
+}
+function lsSet(k: string) {
+  try { localStorage.setItem(k, "1"); } catch { /* private mode / quota */ }
+}
+
+type Status = "idle" | "sending" | "error";
+
+interface NewsletterStore {
+  subscribed: boolean;
+  dismissed: boolean;
+  status: Status;
+  error: string | null;
+  subscribe: (email: string) => Promise<void>;
+  dismiss: () => void;
+}
+
+export const useNewsletter = create<NewsletterStore>((set) => ({
+  subscribed: lsGet(LS_SUBSCRIBED),
+  dismissed: lsGet(LS_DISMISSED),
+  status: "idle",
+  error: null,
+  subscribe: async (email) => {
+    set({ status: "sending", error: null });
+    try {
+      await newsletterSubscribe(email);
+      lsSet(LS_SUBSCRIBED);
+      set({ subscribed: true, status: "idle", error: null });
+    } catch (e) {
+      // Tauri rejects with the Rust Err string verbatim.
+      set({ status: "error", error: String(e) });
+    }
+  },
+  dismiss: () => {
+    lsSet(LS_DISMISSED);
+    set({ dismissed: true });
+  },
+}));
+```
+
+### 2e. Card component (`src/components/sidebar/NewsletterCard.tsx`, new file)
+
+Mirrors `UpdateCard` styling exactly (same card shell, dismiss button,
+accent eyebrow, accent-deep submit button). The update-mode resolution is
+duplicated so the card yields the slot when `UpdateCard` would render.
+
+```tsx
+// "Weekly updates" signup card — shares the bottom-left sidebar slot with
+// UpdateCard (just above the footer). Shown ONLY when:
+//   - the sidebar is expanded (compact falls back to nothing),
+//   - the user hasn't subscribed or dismissed it, and
+//   - no update / what's-new card is competing for the slot (that one wins;
+//     a pending update is more urgent than a newsletter nudge).
+//
+// Posts through the newsletter store → newsletter_subscribe Rust command
+// (Kit public form). On success the store flips `subscribed` and the card
+// unmounts itself.
+
+import { useState } from "react";
+import { useApp } from "@/store/app";
+import { useNewsletter } from "@/store/newsletter";
+import { useUpdate, entryFor, cmpVersion } from "@/store/update";
+import { X, Mail, ArrowRight, RotateCw } from "lucide-react";
+
+export function NewsletterCard() {
+  const compact = useApp(s => s.compactSidebar);
+
+  const subscribed = useNewsletter(s => s.subscribed);
+  const dismissed  = useNewsletter(s => s.dismissed);
+  const status     = useNewsletter(s => s.status);
+  const error      = useNewsletter(s => s.error);
+  const subscribe  = useNewsletter(s => s.subscribe);
+  const dismiss    = useNewsletter(s => s.dismiss);
+
+  // Mirror UpdateCard's mode resolution so the two never stack: if an update
+  // or an unseen release note is live, this card yields the slot.
+  const update           = useUpdate(s => s.update);
+  const currentVersion   = useUpdate(s => s.currentVersion);
+  const dismissedVersion = useUpdate(s => s.dismissedVersion);
+  const lastSeenVersion  = useUpdate(s => s.lastSeenVersion);
+  const changelog        = useUpdate(s => s.changelog);
+
+  const [email, setEmail] = useState("");
+
+  if (compact) return null;
+  if (subscribed || dismissed) return null;
+
+  const updateAvailable = !!update && update.version !== dismissedVersion;
+  const whatsNew =
+    !update && !!currentVersion && cmpVersion(currentVersion, lastSeenVersion) > 0 &&
+    !!entryFor(changelog, currentVersion);
+  if (updateAvailable || whatsNew) return null;
+
+  const sending = status === "sending";
+
+  return (
+    <div className="relative mx-2 mb-2 shrink-0 rounded-lg border border-[var(--color-border)] bg-[var(--color-bg-2)] p-3">
+      <button
+        type="button"
+        aria-label="Dismiss"
+        onClick={dismiss}
+        className="absolute right-1.5 top-1.5 rounded p-1 text-[var(--color-fg-faint)] hover:bg-[var(--color-hover)] hover:text-[var(--color-fg)]"
+      >
+        <X className="h-3.5 w-3.5" />
+      </button>
+
+      <div className="mb-1.5 flex items-center gap-1 text-[var(--color-accent)]">
+        <Mail className="h-3.5 w-3.5 shrink-0" />
+        <span className="text-[11px] font-semibold">Weekly updates</span>
+      </div>
+
+      <p className="pr-5 text-[12.5px] leading-snug text-[var(--color-fg-dim)]">
+        Get a short email when new features ship.
+      </p>
+
+      <form
+        className="mt-2 flex flex-col gap-1.5"
+        onSubmit={(e) => {
+          e.preventDefault();
+          if (!sending && email.trim()) void subscribe(email);
+        }}
+      >
+        <input
+          type="email"
+          required
+          value={email}
+          onChange={(e) => setEmail(e.target.value)}
+          placeholder="you@example.com"
+          disabled={sending}
+          className="w-full rounded-md border border-[var(--color-border)] bg-[var(--color-bg)] px-2 py-1.5 text-[12px] text-[var(--color-fg)] placeholder:text-[var(--color-fg-faint)] focus:border-[var(--color-accent)] focus:outline-none disabled:opacity-70"
+        />
+        {error && <p className="text-[11px] text-[var(--color-warn)]">{error}</p>}
+        <button
+          type="submit"
+          disabled={sending || !email.trim()}
+          className="flex w-full items-center justify-center gap-1.5 rounded-md bg-[var(--color-accent-deep)] px-2 py-1.5 text-[12px] font-medium text-white hover:bg-[#8a3a1c] disabled:opacity-70"
+        >
+          {sending ? (
+            <>
+              <RotateCw className="h-3.5 w-3.5 shrink-0 animate-spin" />
+              <span>Subscribing…</span>
+            </>
+          ) : (
+            <>
+              <span>Subscribe</span>
+              <ArrowRight className="h-3 w-3 shrink-0" />
+            </>
+          )}
+        </button>
+      </form>
+    </div>
+  );
+}
+```
+
+### 2f. Wire into the Sidebar (`src/components/sidebar/Sidebar.tsx`)
+
+The remaining step (not yet written). Render `NewsletterCard` in the same
+absolute bottom-left container that holds `UpdateCard` (~line 693):
+
+```tsx
+import { NewsletterCard } from "./NewsletterCard";
+// ...
+<div className="pointer-events-none absolute inset-x-0 bottom-[var(--bottom-bar-h)] z-20">
+  <div className="pointer-events-auto">
+    <UpdateCard />
+    <NewsletterCard />
+  </div>
+</div>
+```
+
+Both cards self-hide via internal returns; `NewsletterCard` additionally
+yields when `UpdateCard` is live (2e), so at most one renders.
+
+## Notes / conventions
+
+- **Copy rule:** no em dashes in user-visible strings (CLAUDE.md). All
+  visible copy above complies; em dashes appear only in code comments.
+- Theme vars used all exist: `--color-warn` is the error/danger color
+  (there is no `--color-danger`).
+- Verified theme vars: `--color-accent-deep`, `--color-bg`, `--color-bg-2`,
+  `--color-fg-faint` all present in `src/index.css`.
+- After Rust changes: quit + relaunch (Rust signature change), not just HMR.
+- Do not run e2e proactively (CLAUDE.md) — verify the card manually if
+  needed.
+
+## Future upgrade (optional)
+
+Auto-send the weekly email from `make release` via Kit's authenticated v4
+API (needs an API key kept server-side / in CI secrets, not in the app).
+That would turn the changelog entry into the newsletter body automatically.
+If that path is taken, **Resend Broadcasts** is the more API-friendly
+alternative to Kit for programmatic sends.
+
+## Status
+
+Implemented once, then fully reverted at the user's request (another agent
+was working on the repo concurrently). This doc is the complete record to
+re-apply later. Only step 2f (Sidebar wiring) and Part 1 (site form) were
+never written; everything else is reproduced verbatim above.
diff --git a/src-tauri/assets/Dockerfile.default b/src-tauri/assets/Dockerfile.default
new file mode 100644
index 0000000..91ad738
--- /dev/null
+++ b/src-tauri/assets/Dockerfile.default
@@ -0,0 +1,59 @@
+# termic Docker sandbox — generic image for ALL agents.
+# One image, every supported agent installed. The per-workspace agent is
+# just the command run inside it.
+#
+# Edit the marked regions to customize. Rebuild from termic afterwards.
+#
+# Agents are intentionally UNPINNED (always latest). To upgrade them (and
+# the LTS Node base), rebuild WITHOUT cache:  docker build --no-cache --pull
+# termic exposes this as a one-click "Update agents" / rebuild-no-cache.
+
+# ── Base: current Node LTS (always >=22, satisfies Copilot) + Debian ────
+# node:lts auto-tracks the latest LTS; --pull on rebuild fetches it fresh.
+FROM node:lts-bookworm
+
+# ── System toolchain (git is essential; the rest are common agent deps) ─
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      git \
+      curl \
+      ca-certificates \
+      ripgrep \
+      less \
+      openssh-client \
+    && rm -rf /var/lib/apt/lists/*
+
+# Native-binary installers (grok, agy) drop into ~/.local/bin.
+ENV PATH="/root/.local/bin:${PATH}"
+
+# The workspace is bind-mounted from the host, so its files are owned by a
+# different uid than the container user. Without this, git refuses every
+# operation with "detected dubious ownership". Safe here: the only repos in
+# this throwaway cage are the user's own mounted worktrees.
+RUN git config --global --add safe.directory '*'
+
+# ── Agents (one per line, each preceded by its source / docs page) ──────
+# Can't comment inside a `\`-continued RUN, so one install per line.
+# https://www.npmjs.com/package/@anthropic-ai/claude-code
+RUN npm install -g @anthropic-ai/claude-code
+# https://www.npmjs.com/package/@openai/codex
+RUN npm install -g @openai/codex
+# https://www.npmjs.com/package/@google/gemini-cli
+RUN npm install -g @google/gemini-cli
+# https://www.npmjs.com/package/@github/copilot
+RUN npm install -g @github/copilot
+# grok (xAI Grok Build, native binary -> ~/.grok/bin) https://docs.x.ai/build/cli
+RUN curl -fsSL https://x.ai/cli/install.sh | bash
+# agy (Google Antigravity, native binary -> ~/.local/bin) https://antigravity.google/docs/cli-install
+RUN curl -fsSL https://antigravity.google/cli/install.sh | bash
+
+# ── Add your MCP servers here (installed into the image) ────────────────
+# RUN npm install -g @some/mcp-server
+
+# ── Add CLI tools / system packages here ────────────────────────────────
+# RUN apt-get update && apt-get install -y <pkg> && rm -rf /var/lib/apt/lists/*
+
+# ── Add baked-in skills here ────────────────────────────────────────────
+# COPY my-skills/ /root/.claude/skills/
+
+WORKDIR /workspace
+CMD ["bash"]
diff --git a/src-tauri/src/docker.rs b/src-tauri/src/docker.rs
new file mode 100644
index 0000000..8b1f193
--- /dev/null
+++ b/src-tauri/src/docker.rs
@@ -0,0 +1,591 @@
+// Docker sandbox mode (opt-in, experimental). Parallel to `sandbox.rs`,
+// but the isolation boundary is a Docker container instead of macOS
+// Seatbelt: the agent CLI runs inside `docker run` and can only touch the
+// paths we bind-mount (the worktree, its parent `.git`, composition
+// members, and a persistent per-agent config dir). Default-deny by
+// construction.
+//
+// This module is PURE command construction + image/container lifecycle.
+// No long-running daemon (consistent with the "no backend daemon" rule —
+// we only shell out to the user's `docker`). `render_argv` is the single
+// source of truth: the argv previewed in the UI and the argv actually
+// spawned come from the same function, so they can never drift.
+//
+// Design: docs/plans/docker-sandbox/design.md
+
+use crate::sandbox::{canonicalize_or_keep, parent_git_dir_for_worktree};
+use crate::{data_dir, Workspace};
+use serde::{Deserialize, Serialize};
+use std::collections::hash_map::DefaultHasher;
+use std::hash::{Hash, Hasher};
+use std::path::PathBuf;
+use std::process::Command;
+
+/// Tag prefix for every image we build. Cleanup and listing filter on this.
+const IMAGE_REPO: &str = "termic-sandbox";
+/// Label key stamped on every container we run, so cleanup can find them
+/// robustly even if the `--name` was munged.
+const LABEL_KEY: &str = "termic.workspace";
+
+// ───────────────────────────── Mounts ──────────────────────────────────
+
+/// Why a mount exists — surfaced per-row in the dialog so the user can
+/// always answer "what can this container see, and why?". `Implicit`
+/// mounts are added by termic; `User` mounts come from extra-args / the
+/// editable mount list.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum MountProvenance {
+    Implicit,
+    User,
+}
+
+/// A single bind mount: host path -> container path, with rw/ro and the
+/// human explanation shown in the mount list + command-preview comment.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct Mount {
+    pub host: String,
+    pub container: String,
+    pub read_only: bool,
+    pub provenance: MountProvenance,
+    /// Plain-language reason shown in the dialog row and as the trailing
+    /// `# comment` in the command preview.
+    pub why: String,
+    /// Load-bearing implicit mounts (worktree, parent `.git`) are shown
+    /// but warn-on-remove rather than silently removable.
+    pub load_bearing: bool,
+}
+
+impl Mount {
+    fn implicit(host: String, container: String, read_only: bool, why: &str, load_bearing: bool) -> Self {
+        Mount {
+            host,
+            container,
+            read_only,
+            provenance: MountProvenance::Implicit,
+            why: why.to_string(),
+            load_bearing,
+        }
+    }
+}
+
+// ───────────────────────────── Spec ────────────────────────────────────
+
+/// Everything needed to render one `docker run` invocation for a workspace
+/// agent spawn. Produced by `build_spec`; rendered to argv by `render_argv`.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct DockerSpec {
+    /// `termic-{workspaceId}` (stable, human-facing).
+    pub container_name: String,
+    /// `termic.workspace={workspaceId}` — what cleanup filters on.
+    pub label: String,
+    /// `termic-sandbox:{dockerfileHash}`.
+    pub image: String,
+    /// host -> container bind mounts (rw/ro), with provenance + why.
+    pub mounts: Vec<Mount>,
+    /// Working dir inside the container — MUST equal the host cwd (same
+    /// absolute path) so the worktree `.git` pointer + session cwd-key line up.
+    pub workdir: String,
+    /// Env injected via `-e` (TERM and config-dir relocation only — NEVER
+    /// secrets; credentials arrive via the config-dir mount).
+    pub env: Vec<(String, String)>,
+    /// User-appended `docker run` args, inserted at a defined point.
+    pub extra_args: Vec<String>,
+}
+
+// ─────────────────────── Per-agent config dir ──────────────────────────
+
+/// How a given agent's persistent config dir is wired into the container.
+/// `env_relocation` uses the agent's own relocation env var (cleanest —
+/// folds even HOME-root dotfiles into the one mounted dir); the others are
+/// direct dir mounts. NEVER mount the whole container HOME — it shadows
+/// agent binaries baked into HOME at build time (grok in ~/.grok/bin, agy
+/// in ~/.local/bin). See findings.md.
+struct AgentConfig {
+    /// Container path the config dir is mounted at.
+    container_dir: &'static str,
+    /// `Some((VAR, value))` when the agent supports a config-dir relocation
+    /// env var (claude `CLAUDE_CONFIG_DIR`, codex `CODEX_HOME`).
+    relocation_env: Option<(&'static str, &'static str)>,
+    /// Extra container dirs to also mount from the same host config dir
+    /// (e.g. agy needs `.antigravity` alongside `.gemini`).
+    extra_dirs: &'static [&'static str],
+}
+
+/// Map an agent id to its config-dir wiring. Returns `None` for agents we
+/// don't yet support in Docker mode (grok is the Phase-1 outlier: binary +
+/// skills + config all live under ~/.grok, no clean relocation env).
+fn agent_config(agent_id: &str) -> Option<AgentConfig> {
+    Some(match agent_id {
+        "claude" => AgentConfig {
+            container_dir: "/root/.claude",
+            relocation_env: Some(("CLAUDE_CONFIG_DIR", "/root/.claude")),
+            extra_dirs: &[],
+        },
+        "codex" => AgentConfig {
+            container_dir: "/root/.codex",
+            relocation_env: Some(("CODEX_HOME", "/root/.codex")),
+            extra_dirs: &[],
+        },
+        "gemini" => AgentConfig {
+            container_dir: "/root/.gemini",
+            relocation_env: None,
+            extra_dirs: &[],
+        },
+        "copilot" => AgentConfig {
+            container_dir: "/root/.copilot",
+            relocation_env: None,
+            extra_dirs: &[],
+        },
+        // agy shares the `.gemini` config shape + its own `.antigravity`.
+        // Its binary lives in ~/.local/bin — do NOT mount ~/.local.
+        "agy" | "antigravity" => AgentConfig {
+            container_dir: "/root/.gemini",
+            relocation_env: None,
+            extra_dirs: &["/root/.antigravity"],
+        },
+        // grok deferred from Phase 1 (see design.md "outlier").
+        _ => return None,
+    })
+}
+
+/// Host directory that persists an agent's login + sessions + MCP config
+/// ACROSS every Docker workspace of that agent. The sameness of this path
+/// IS the cross-workspace sharing. termic-owned, never the host's real
+/// `~/.claude` (full isolation from the OS agent).
+pub fn agent_config_host_dir(agent_id: &str) -> PathBuf {
+    // `data_dir()` already respects the dev/prod (`termic_dev`/`termic`)
+    // split, so dev and release don't share login state.
+    let base = data_dir()
+        .map(|d| d.join("docker-agents"))
+        .unwrap_or_else(|_| PathBuf::from("/tmp/termic-docker-agents"));
+    base.join(agent_id)
+}
+
+// ──────────────────────────── build_spec ───────────────────────────────
+
+/// Build the full `DockerSpec` for a workspace agent spawn. `cmd`/`args`
+/// are the agent argv (unchanged from the Seatbelt path); `cwd` is the
+/// host working dir (mounted + `-w` at the identical absolute path).
+pub fn build_spec(
+    ws: &Workspace,
+    agent_id: &str,
+    image: &str,
+    cwd: &str,
+    extra_args: Vec<String>,
+) -> DockerSpec {
+    let mut mounts: Vec<Mount> = Vec::new();
+
+    // 1. The worktree itself, at the SAME absolute path inside the
+    //    container (required for the worktree `.git` pointer + session
+    //    cwd-key to resolve).
+    let ws_path = canonicalize_or_keep(&ws.path);
+    mounts.push(Mount::implicit(
+        ws_path.clone(),
+        ws_path.clone(),
+        false,
+        "your code (the workspace)",
+        true,
+    ));
+
+    // 2. Parent `.git` for a worktree (pointer file holds an absolute
+    //    path into <parent>/.git/worktrees/<name>). Same-path mount or git
+    //    breaks. Reuses the exact Seatbelt logic.
+    if let Some(parent_git) = parent_git_dir_for_worktree(&ws.path) {
+        mounts.push(Mount::implicit(
+            parent_git.clone(),
+            parent_git,
+            false,
+            "git metadata, required for worktrees to work",
+            true,
+        ));
+    }
+
+    // 3. Composition members (linked repos in a multi-repo workspace),
+    //    each at its identical absolute path.
+    for m in &ws.composition {
+        if m.path.is_empty() {
+            continue;
+        }
+        let p = canonicalize_or_keep(&m.path);
+        if p == ws_path {
+            continue; // host member == workspace wrapper, already mounted
+        }
+        mounts.push(Mount::implicit(
+            p.clone(),
+            p,
+            false,
+            "linked repo in this workspace",
+            true,
+        ));
+        if let Some(parent_git) = parent_git_dir_for_worktree(&m.path) {
+            mounts.push(Mount::implicit(
+                parent_git.clone(),
+                parent_git,
+                false,
+                "git metadata for a linked repo",
+                true,
+            ));
+        }
+    }
+
+    // 4. The persistent per-agent config dir (login + sessions + MCP +
+    //    customizations), shared across all Docker workspaces of this
+    //    agent. rw. Plus relocation env if the agent supports it.
+    let mut env: Vec<(String, String)> = vec![
+        ("TERM".to_string(), "xterm-256color".to_string()),
+        ("COLORTERM".to_string(), "truecolor".to_string()),
+    ];
+    if let Some(cfg) = agent_config(agent_id) {
+        let host_cfg = agent_config_host_dir(agent_id).to_string_lossy().into_owned();
+        mounts.push(Mount::implicit(
+            host_cfg.clone(),
+            cfg.container_dir.to_string(),
+            false,
+            "your Docker agent: login, MCP servers, settings, history (shared across all your Docker workspaces)",
+            false,
+        ));
+        for extra in cfg.extra_dirs {
+            // Extra dirs share the same host config dir subtree by name.
+            let sub = PathBuf::from(&host_cfg)
+                .join(extra.trim_start_matches("/root/."))
+                .to_string_lossy()
+                .into_owned();
+            mounts.push(Mount::implicit(
+                sub,
+                extra.to_string(),
+                false,
+                "additional config dir for this agent",
+                false,
+            ));
+        }
+        if let Some((var, val)) = cfg.relocation_env {
+            env.push((var.to_string(), val.to_string()));
+        }
+    }
+
+    DockerSpec {
+        container_name: format!("termic-{}", ws.id),
+        label: format!("{LABEL_KEY}={}", ws.id),
+        image: image.to_string(),
+        mounts,
+        workdir: canonicalize_or_keep(cwd),
+        env,
+        extra_args,
+    }
+}
+
+// ──────────────────────────── render_argv ──────────────────────────────
+
+/// Render the spec to the exact argv we spawn. THE single source of truth:
+/// the UI preview is just this output pretty-printed (see `render_preview`).
+/// Spawned argv == previewed argv, always.
+pub fn render_argv(spec: &DockerSpec, cmd: &str, args: &[String]) -> Vec<String> {
+    let mut argv: Vec<String> = vec![
+        "run".into(),
+        "--rm".into(),
+        "-i".into(),
+        "-t".into(),
+        "--name".into(),
+        spec.container_name.clone(),
+        "--label".into(),
+        spec.label.clone(),
+    ];
+    for m in &spec.mounts {
+        argv.push("-v".into());
+        let suffix = if m.read_only { ":ro" } else { "" };
+        argv.push(format!("{}:{}{}", m.host, m.container, suffix));
+    }
+    argv.push("-w".into());
+    argv.push(spec.workdir.clone());
+    for (k, v) in &spec.env {
+        argv.push("-e".into());
+        argv.push(format!("{k}={v}"));
+    }
+    argv.extend(spec.extra_args.iter().cloned());
+    argv.push(spec.image.clone());
+    argv.push(cmd.to_string());
+    argv.extend(args.iter().cloned());
+    argv
+}
+
+/// Pretty-print the argv for the dialog's command-preview pane: multi-line,
+/// one flag/mount per line with `\` continuations, copy-paste-runnable, and
+/// a trailing `# why` comment on each mount line. Display sugar only — the
+/// spawned argv comes from `render_argv`, unchanged.
+pub fn render_preview(spec: &DockerSpec, cmd: &str, args: &[String]) -> String {
+    let mut lines: Vec<String> = vec!["docker run --rm -it \\".into()];
+    lines.push(format!("  --name {} \\", spec.container_name));
+    lines.push(format!("  --label {} \\", spec.label));
+    for m in &spec.mounts {
+        let suffix = if m.read_only { ":ro" } else { "" };
+        lines.push(format!(
+            "  -v {}:{}{} \\{}",
+            m.host,
+            m.container,
+            suffix,
+            format!("   # {}", m.why),
+        ));
+    }
+    lines.push(format!("  -w {} \\", spec.workdir));
+    for (k, v) in &spec.env {
+        lines.push(format!("  -e {k}={v} \\"));
+    }
+    for ea in &spec.extra_args {
+        lines.push(format!("  {ea} \\"));
+    }
+    lines.push(format!("  {} \\", spec.image));
+    let agent_line = if args.is_empty() {
+        cmd.to_string()
+    } else {
+        format!("{cmd} {}", args.join(" "))
+    };
+    lines.push(format!("  {agent_line}"));
+    lines.join("\n")
+}
+
+// ─────────────────────── Dockerfile storage ────────────────────────────
+
+/// Directory holding the editable Dockerfile + build metadata.
+fn docker_dir() -> PathBuf {
+    data_dir()
+        .map(|d| d.join("docker"))
+        .unwrap_or_else(|_| PathBuf::from("/tmp/termic-docker"))
+}
+
+/// Path to the user-editable Dockerfile (one generic file, all agents).
+pub fn dockerfile_path() -> PathBuf {
+    docker_dir().join("Dockerfile")
+}
+
+/// The shipped default Dockerfile (validated: builds + runs all agents).
+/// Ship this as reset-to-default; the commented regions are the user's
+/// customization surface.
+pub const DEFAULT_DOCKERFILE: &str = include_str!("../assets/Dockerfile.default");
+
+/// Read the current Dockerfile, falling back to (and persisting) the
+/// shipped default on first run / missing file.
+pub fn read_dockerfile() -> String {
+    let path = dockerfile_path();
+    match std::fs::read_to_string(&path) {
+        Ok(s) if !s.trim().is_empty() => s,
+        _ => {
+            let _ = write_dockerfile(DEFAULT_DOCKERFILE);
+            DEFAULT_DOCKERFILE.to_string()
+        }
+    }
+}
+
+/// Persist an edited Dockerfile.
+pub fn write_dockerfile(contents: &str) -> Result<(), String> {
+    let dir = docker_dir();
+    std::fs::create_dir_all(&dir).map_err(|e| e.to_string())?;
+    std::fs::write(dir.join("Dockerfile"), contents).map_err(|e| e.to_string())
+}
+
+// ──────────────────────────── Image build ──────────────────────────────
+
+/// Build the image from the given Dockerfile. Blocking + IO-heavy — the
+/// command layer MUST run this on a background thread (never on the
+/// synchronous Tauri command path, which would freeze the webview). The
+/// spawn path NEVER calls this; build is an explicit Settings action.
+///
+/// `no_cache` => `--no-cache --pull` ("Update agents": refresh the LTS base
+/// and re-fetch the unpinned agents). Returns the built tag on success, or
+/// the combined build log on failure.
+pub fn build_image(dockerfile: &str, no_cache: bool) -> Result<String, String> {
+    let (mut cmd, tag) = build_command(dockerfile, no_cache)?;
+    let output = cmd.output().map_err(|e| {
+        if e.kind() == std::io::ErrorKind::NotFound {
+            "docker binary not found".to_string()
+        } else {
+            e.to_string()
+        }
+    })?;
+    if output.status.success() {
+        Ok(tag)
+    } else {
+        let mut log = String::from_utf8_lossy(&output.stdout).into_owned();
+        log.push_str(&String::from_utf8_lossy(&output.stderr));
+        Err(log)
+    }
+}
+
+/// Construct the `docker build` Command + the tag it will produce, writing
+/// the Dockerfile to disk first. The caller drives execution (the command
+/// layer streams its output line-by-line off a background thread; never on
+/// the synchronous Tauri path). `no_cache` => `--no-cache --pull`.
+pub fn build_command(dockerfile: &str, no_cache: bool) -> Result<(Command, String), String> {
+    let tag = image_tag(dockerfile);
+    let dir = docker_dir();
+    std::fs::create_dir_all(&dir).map_err(|e| e.to_string())?;
+    let df_path = dir.join("Dockerfile");
+    std::fs::write(&df_path, dockerfile).map_err(|e| e.to_string())?;
+
+    let mut cmd = Command::new("docker");
+    // --progress=plain so the streamed log is line-based (not a TTY redraw).
+    cmd.args(["build", "--progress=plain", "-t", &tag, "-f"]);
+    cmd.arg(&df_path);
+    if no_cache {
+        cmd.args(["--no-cache", "--pull"]);
+    }
+    // Build context is the docker dir (lets users `COPY` baked skills etc.
+    // from a path they control next to the Dockerfile).
+    cmd.arg(&dir);
+    Ok((cmd, tag))
+}
+
+// ─────────────────────── Image tag + availability ──────────────────────
+
+/// Content-addressed image tag: `termic-sandbox:{hash}`. Editing the
+/// Dockerfile changes the hash, so a stale build no longer matches —
+/// surfaced as a "rebuild to apply" warning in Settings. DefaultHasher is
+/// fixed-seed (stable across runs); a non-crypto hash is sufficient for
+/// cache-keying (we only need "did the Dockerfile change?").
+pub fn image_tag(dockerfile: &str) -> String {
+    let mut h = DefaultHasher::new();
+    dockerfile.hash(&mut h);
+    format!("{IMAGE_REPO}:{:016x}", h.finish())
+}
+
+/// Result of `docker_check`: is the binary present, is the daemon up?
+#[derive(Clone, Debug, Serialize, Deserialize, Default)]
+pub struct DockerStatus {
+    /// `docker` binary resolvable on PATH.
+    pub binary: bool,
+    /// `docker info` succeeds (daemon reachable).
+    pub daemon: bool,
+    /// `docker --version` string, when available.
+    pub version: Option<String>,
+}
+
+/// Probe for the `docker` binary + a running daemon. Cheap; no build.
+pub fn check() -> DockerStatus {
+    let version = Command::new("docker")
+        .arg("--version")
+        .output()
+        .ok()
+        .filter(|o| o.status.success())
+        .map(|o| String::from_utf8_lossy(&o.stdout).trim().to_string());
+    let binary = version.is_some();
+    let daemon = binary
+        && Command::new("docker")
+            .arg("info")
+            .output()
+            .map(|o| o.status.success())
+            .unwrap_or(false);
+    DockerStatus { binary, daemon, version }
+}
+
+/// Does an image with this tag already exist locally? (Drives dropdown
+/// availability + the "not built / rebuild" Settings state.)
+pub fn image_exists(tag: &str) -> bool {
+    Command::new("docker")
+        .args(["image", "inspect", tag])
+        .output()
+        .map(|o| o.status.success())
+        .unwrap_or(false)
+}
+
+/// File recording the tag of the last successful build. Lets us keep the
+/// last-built image available in the dropdown even after the Dockerfile is
+/// edited (the edit only takes effect on the next build).
+fn last_built_file() -> PathBuf {
+    docker_dir().join("last_built_tag")
+}
+
+/// Record a successfully built tag.
+pub fn record_built_tag(tag: &str) {
+    let _ = std::fs::create_dir_all(docker_dir());
+    let _ = std::fs::write(last_built_file(), tag);
+}
+
+/// The tag of the last successful build, if any.
+pub fn last_built_tag() -> Option<String> {
+    std::fs::read_to_string(last_built_file())
+        .ok()
+        .map(|s| s.trim().to_string())
+        .filter(|s| !s.is_empty())
+}
+
+/// Image state for the Settings Docker section + dropdown gating.
+#[derive(Clone, Debug, Serialize, Deserialize, Default)]
+pub struct DockerImageStatus {
+    /// Content tag of the CURRENT (possibly-edited) Dockerfile.
+    pub current_tag: String,
+    /// Is the current Dockerfile's image built?
+    pub current_built: bool,
+    /// Tag of the last successful build (may differ from current_tag).
+    pub last_built_tag: Option<String>,
+    /// Does the last-built image still exist locally?
+    pub last_built_exists: bool,
+    /// Dockerfile edited since the last successful build (built image is
+    /// stale). Drives the "rebuild to apply" warning in Settings.
+    pub stale: bool,
+    /// Is the current Dockerfile byte-identical to the shipped default?
+    pub is_default: bool,
+    /// Whether Docker mode should be offered in the workspace dropdown at
+    /// all (a usable built image exists).
+    pub available: bool,
+}
+
+/// Compute the current image status from the on-disk Dockerfile + docker.
+pub fn image_status() -> DockerImageStatus {
+    let dockerfile = read_dockerfile();
+    let current_tag = image_tag(&dockerfile);
+    let current_built = image_exists(&current_tag);
+    let last = last_built_tag();
+    let last_built_exists = last.as_deref().map(image_exists).unwrap_or(false);
+    let stale = match &last {
+        Some(t) => last_built_exists && *t != current_tag,
+        None => false,
+    };
+    DockerImageStatus {
+        current_tag,
+        current_built,
+        is_default: dockerfile == DEFAULT_DOCKERFILE,
+        // Dropdown availability: any usable built image (current OR the
+        // last-built one we keep around after an edit).
+        available: current_built || last_built_exists,
+        last_built_tag: last,
+        last_built_exists,
+        stale,
+    }
+}
+
+/// The tag a spawn should actually run: prefer the current Dockerfile's
+/// image; fall back to the last-built image (kept available after an edit).
+/// `None` => nothing usable is built; the spawn must refuse.
+pub fn spawn_image_tag() -> Option<String> {
+    let dockerfile = read_dockerfile();
+    let current = image_tag(&dockerfile);
+    if image_exists(&current) {
+        return Some(current);
+    }
+    last_built_tag().filter(|t| image_exists(t))
+}
+
+// ──────────────────────────── Cleanup ──────────────────────────────────
+
+/// `docker rm -f` every container labeled for this workspace. Non-fatal.
+pub fn cleanup_workspace(ws_id: &str) {
+    rm_by_filter(&format!("label={LABEL_KEY}={ws_id}"));
+}
+
+/// `docker rm -f` every termic-labeled container (app quit). Non-fatal.
+pub fn cleanup_all() {
+    rm_by_filter(&format!("label={LABEL_KEY}"));
+}
+
+fn rm_by_filter(filter: &str) {
+    let ids = Command::new("docker")
+        .args(["ps", "-aq", "--filter", filter])
+        .output()
+        .ok()
+        .filter(|o| o.status.success())
+        .map(|o| String::from_utf8_lossy(&o.stdout).trim().to_string())
+        .unwrap_or_default();
+    for id in ids.lines().filter(|l| !l.trim().is_empty()) {
+        let _ = Command::new("docker").args(["rm", "-f", id]).output();
+    }
+}
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index b0eec13..293b8fd 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -31,6 +31,7 @@ use tauri::{AppHandle, Emitter, State};
 use uuid::Uuid;
 
 mod sandbox;
+mod docker;
 mod proxy;
 mod repo_config;
 mod shell_env;
@@ -326,6 +327,20 @@ pub struct Workspace {
     /// semantics. Shell tabs are excluded (no session to resume).
     #[serde(default)]
     pub right_split_tabs: Vec<PersistedTab>,
+    /// Docker sandbox mode for this workspace. Mutually exclusive with the
+    /// Seatbelt sandbox: when true, the agent PTY runs inside `docker run`
+    /// (the container is the isolation boundary) instead of `sandbox-exec`,
+    /// and the Seatbelt path is forced off. Only meaningful when the global
+    /// `Settings::docker_sandbox_enabled` master switch is on AND the image
+    /// is built. See docs/plans/docker-sandbox/design.md.
+    #[serde(default)]
+    pub docker_sandbox_enabled: bool,
+    /// User-appended `docker run` args for this workspace (e.g. `--memory
+    /// 4g`, `-e FOO=bar`, an extra `-v`). Inserted at a fixed point in the
+    /// rendered argv. Phase 1 offers extra-args only (no full override); the
+    /// computed mounts/workdir/config-dir stay termic-owned.
+    #[serde(default)]
+    pub docker_extra_args: Vec<String>,
 }
 
 /// One durable agent tab. `session_id` is termic's own per-tab session
@@ -898,12 +913,44 @@ fn pty_spawn(
         })
         .map_err(|e| e.to_string())?;
 
+    // ── Docker sandbox branch ──────────────────────────────────────
+    // If the workspace is in Docker mode (and the global master switch is
+    // on), the container is the isolation boundary: rewrite the spawn to
+    // `docker run ...` and skip the Seatbelt path entirely (the two are
+    // mutually exclusive). Build is NEVER triggered here — if no usable
+    // image is built, refuse loudly rather than spawning unsandboxed.
+    let docker_ws = args
+        .workspace_id
+        .as_deref()
+        .and_then(|wid| load_workspaces().into_iter().find(|w| w.id == wid))
+        .filter(|w| w.docker_sandbox_enabled && load_settings_inner().docker_sandbox_enabled);
+    let docker_argv: Option<Vec<String>> = if let Some(ws) = docker_ws {
+        let agent = args.agent_id.clone().unwrap_or_else(|| ws.cli.clone());
+        let image = docker::spawn_image_tag().ok_or_else(|| {
+            "Docker image not built. Open Settings → Docker sandbox and build it first.".to_string()
+        })?;
+        // Belt-and-suspenders: remove any stale same-named container left
+        // by an unclean shutdown so `--name` doesn't collide on respawn.
+        docker::cleanup_workspace(&ws.id);
+        let spec = docker::build_spec(&ws, &agent, &image, &args.cwd, ws.docker_extra_args.clone());
+        let argv = docker::render_argv(&spec, &args.cmd, &args.args);
+        dlog(&format!("[pty_spawn] docker ws={} agent={} image={} argv={argv:?}", ws.id, agent, image));
+        Some(argv)
+    } else {
+        None
+    };
+    let is_docker = docker_argv.is_some();
+
     // ── Sandbox wrap, if applicable ────────────────────────────────
     // If the workspace is flagged sandbox_enabled, provision a fresh
     // seatbelt profile + network proxy and rewrite (cmd, args) to go through
     // `sandbox-exec`. The bundle gets parked on the PtySlot so its
     // Drop impl SIGKILLs the proxy when the PTY closes.
-    let (effective_cmd, effective_args, sandbox_bundle) = match args
+    // Docker mode short-circuits this: the container IS the cage, so the
+    // program becomes `docker` with the rendered run-argv, no seatbelt bundle.
+    let (effective_cmd, effective_args, sandbox_bundle) = if let Some(argv) = docker_argv {
+        ("docker".to_string(), argv, None)
+    } else { match args
         .workspace_id
         .as_deref()
         .and_then(|wid| load_workspaces().into_iter().find(|w| w.id == wid))
@@ -940,7 +987,7 @@ fn pty_spawn(
             dlog(&format!("[pty_spawn] sandbox=OFF cmd={} args={:?}", args.cmd, args.args));
             (args.cmd.clone(), args.args.clone(), None)
         },
-    };
+    } };
 
     let mut cmd = CommandBuilder::new(&effective_cmd);
     for a in &effective_args {
@@ -970,7 +1017,10 @@ fn pty_spawn(
     // tabs, or sandbox=off agents) the CLI is exec'd directly, so without
     // this it would miss $EDITOR etc. (#17). The per-spawn overlay below
     // still wins, so explicit overrides hold.
-    if sandbox_bundle.is_none() {
+    // Skip for Docker too: the host `docker` process doesn't need the
+    // secret-bearing login delta (the container only sees what we pass via
+    // `-e`, which is TERM + config-dir relocation, never secrets).
+    if sandbox_bundle.is_none() && !is_docker {
         for (k, v) in shell_env::login_env() {
             cmd.env(k, v);
         }
@@ -1020,7 +1070,9 @@ fn pty_spawn(
     // path watcher uses this to filter system-wide deny noise: only
     // denies whose PID (or some ancestor) is in this set get counted
     // against this workspace.
-    if let (Some(pid), Some(wid)) = (child_pid, args.workspace_id.as_deref()) {
+    // Docker isolates by namespace, not PID ancestry — the seatbelt path
+    // watcher doesn't apply, so skip registration in Docker mode.
+    if let (Some(pid), Some(wid), false) = (child_pid, args.workspace_id.as_deref(), is_docker) {
         sandbox::register_root_pid(wid, pid);
     }
 
@@ -1663,6 +1715,8 @@ fn workspace_open_repo(project_id: String, cli: Option<String>, name: Option<Str
         resume_override: None,
         persisted_tabs: Vec::new(),
         right_split_tabs: Vec::new(),
+        docker_sandbox_enabled: false,
+        docker_extra_args: Vec::new(),
     };
     save_workspace(&ws).map_err(|e| e.to_string())?;
     Ok(ws)
@@ -1846,6 +1900,8 @@ fn workspace_import_worktree(
         resume_override: None,
         persisted_tabs: Vec::new(),
         right_split_tabs: Vec::new(),
+        docker_sandbox_enabled: false,
+        docker_extra_args: Vec::new(),
     };
     save_workspace(&ws).map_err(|e| e.to_string())?;
     Ok(ws)
@@ -2083,6 +2139,8 @@ fn workspace_create_sync(app: AppHandle, args: CreateWorkspaceArgs) -> Result<Wo
         resume_override: None,
         persisted_tabs: Vec::new(),
         right_split_tabs: Vec::new(),
+        docker_sandbox_enabled: false,
+        docker_extra_args: Vec::new(),
     };
     save_workspace(&ws).map_err(|e| e.to_string())?;
 
@@ -2448,6 +2506,8 @@ fn workspace_create_multi_sync(app: AppHandle, args: CreateMultiArgs) -> Result<
         resume_override: None,
         persisted_tabs: Vec::new(),
         right_split_tabs: Vec::new(),
+        docker_sandbox_enabled: false,
+        docker_extra_args: Vec::new(),
     };
     save_workspace(&ws).map_err(|e| e.to_string())?;
 
@@ -3310,6 +3370,30 @@ fn workspace_set_yolo(id: String, yolo: bool) -> Result<(), String> {
     Ok(())
 }
 
+/// Persist a workspace's Docker sandbox choice + extra args. Mutually
+/// exclusive with the Seatbelt cage: enabling Docker forces the Seatbelt
+/// mode off (and vice versa) so the two never co-apply. On disable, any
+/// live container for this workspace is removed.
+#[tauri::command]
+fn workspace_set_docker(id: String, enabled: bool, extra_args: Vec<String>) -> Result<(), String> {
+    let mut list = load_workspaces();
+    let w = list.iter_mut().find(|w| w.id == id).ok_or("no such ws")?;
+    w.docker_sandbox_enabled = enabled;
+    w.docker_extra_args = extra_args;
+    if enabled {
+        // Docker is the cage now — turn the Seatbelt path off so the two
+        // are never both active (effective_sandbox_mode / pty_spawn both
+        // key off these).
+        w.sandbox_enabled = false;
+        w.sandbox_mode = Some(SandboxMode::Off);
+    } else {
+        // No longer in Docker mode — tear down any container we left.
+        docker::cleanup_workspace(&id);
+    }
+    save_workspace(w).map_err(|e| e.to_string())?;
+    Ok(())
+}
+
 /// Increment + persist the workspace's `spawn_count`. Historical metric
 /// only — resume gating now uses `has_resumable_history` instead.
 #[tauri::command]
@@ -3386,6 +3470,11 @@ fn workspace_archive_sync(id: String, delete_branch: bool) -> Result<(), String>
     // polling thread will keep trying to sync a worktree that no longer exists.
     spotlight_stop_for_ws(&id);
 
+    // Remove any Docker containers for this workspace (non-fatal). `--rm`
+    // handles the clean-exit case; this covers crashes / kills where it
+    // never fired, before we tear down the worktree the container mounts.
+    docker::cleanup_workspace(&id);
+
     let mut list = load_workspaces();
     let w = list.iter_mut().find(|w| w.id == id).ok_or("workspace not found")?;
     let proj = load_projects().into_iter().find(|p| p.id == w.project_id);
@@ -5978,6 +6067,12 @@ pub struct Settings {
     /// tree across every project. Unioned with each project's committed
     /// `.termic.yaml` `exclude` list. `.git` is always hidden regardless.
     pub file_tree_exclude: Vec<String>,
+    /// Master switch for the experimental Docker sandbox mode. While off,
+    /// no Docker UI appears anywhere and Docker is never invoked. A
+    /// workspace's `docker_sandbox_enabled` only takes effect when this is
+    /// also on. See docs/plans/docker-sandbox/design.md.
+    #[serde(default)]
+    pub docker_sandbox_enabled: bool,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
@@ -6491,6 +6586,146 @@ fn settings_save(s: Settings) -> Result<(), String> {
         .map_err(|e| e.to_string())
 }
 
+// ─────────────────────────── Docker sandbox ────────────────────────────
+
+/// Probe for the `docker` binary + a running daemon. Cheap; no build.
+#[tauri::command]
+fn docker_check() -> docker::DockerStatus {
+    docker::check()
+}
+
+/// Current image build state (current/last-built tags, stale flag,
+/// dropdown availability). Drives the Settings section + cage dropdown.
+#[tauri::command]
+fn docker_image_status() -> docker::DockerImageStatus {
+    docker::image_status()
+}
+
+/// The editable Dockerfile (falls back to the shipped default on first run).
+#[tauri::command]
+fn docker_get_dockerfile() -> String {
+    docker::read_dockerfile()
+}
+
+/// The shipped default Dockerfile (for "Reset to default").
+#[tauri::command]
+fn docker_default_dockerfile() -> String {
+    docker::DEFAULT_DOCKERFILE.to_string()
+}
+
+/// Persist an edited Dockerfile. Does NOT build — build is an explicit,
+/// separate action so the (slow, 2.8GB) build never blocks the UI.
+#[tauri::command]
+fn docker_set_dockerfile(contents: String) -> Result<(), String> {
+    docker::write_dockerfile(&contents)
+}
+
+/// Build the image in the background. Streams build output line-by-line as
+/// `docker-build://log` and emits `docker-build://done` with `{ success,
+/// tag, error }` when finished. Returns immediately. `no_cache` =>
+/// `--no-cache --pull` ("Update agents": refresh base + re-fetch agents).
+///
+/// IO-heavy + slow, so it runs on a background thread (NEVER the sync Tauri
+/// path, which would freeze WKWebView per CLAUDE.md).
+#[tauri::command]
+fn docker_build_image(app: AppHandle, no_cache: bool) -> Result<(), String> {
+    use std::io::{BufRead, BufReader};
+    use std::process::Stdio;
+    let dockerfile = docker::read_dockerfile();
+    let (mut cmd, tag) = docker::build_command(&dockerfile, no_cache)?;
+    cmd.stdout(Stdio::piped()).stderr(Stdio::piped());
+    thread::spawn(move || {
+        let mut child = match cmd.spawn() {
+            Ok(c) => c,
+            Err(e) => {
+                let msg = if e.kind() == std::io::ErrorKind::NotFound {
+                    "docker binary not found".to_string()
+                } else {
+                    e.to_string()
+                };
+                let _ = app.emit("docker-build://log", serde_json::json!({ "line": format!("[spawn error] {msg}") }));
+                let _ = app.emit("docker-build://done", serde_json::json!({ "success": false, "tag": tag, "error": msg }));
+                return;
+            }
+        };
+        let stdout = child.stdout.take();
+        let stderr = child.stderr.take();
+        let app_o = app.clone();
+        let t_out = stdout.map(|s| thread::spawn(move || {
+            for line in BufReader::new(s).lines().map_while(|r| r.ok()) {
+                let _ = app_o.emit("docker-build://log", serde_json::json!({ "line": line }));
+            }
+        }));
+        let app_e = app.clone();
+        let t_err = stderr.map(|s| thread::spawn(move || {
+            // `docker build` writes its progress to stderr — stream it too.
+            for line in BufReader::new(s).lines().map_while(|r| r.ok()) {
+                let _ = app_e.emit("docker-build://log", serde_json::json!({ "line": line }));
+            }
+        }));
+        let status = child.wait();
+        if let Some(t) = t_out { let _ = t.join(); }
+        if let Some(t) = t_err { let _ = t.join(); }
+        let success = status.map(|s| s.success()).unwrap_or(false);
+        if success {
+            docker::record_built_tag(&tag);
+        }
+        let _ = app.emit("docker-build://done", serde_json::json!({
+            "success": success,
+            "tag": tag,
+            "error": if success { serde_json::Value::Null } else { serde_json::Value::String("build failed (see log)".into()) },
+        }));
+    });
+    Ok(())
+}
+
+/// Render the exact `docker run` argv + the pretty multi-line preview for a
+/// workspace + agent, without spawning. Preview == the real spawn (same
+/// `render_argv`), so the dialog is honest.
+#[tauri::command]
+fn docker_preview_command(workspace_id: String, agent_id: Option<String>) -> Result<DockerPreview, String> {
+    let ws = load_workspaces()
+        .into_iter()
+        .find(|w| w.id == workspace_id)
+        .ok_or_else(|| "workspace not found".to_string())?;
+    let settings = load_settings_inner();
+    let agent = resolve_agent_id(&settings, &agent_id, &ws);
+    let (cmd, args) = agent_spawn_cmd(&settings, &agent);
+    let image = docker::spawn_image_tag().unwrap_or_else(|| "termic-sandbox:<not-built>".to_string());
+    let spec = docker::build_spec(&ws, &agent, &image, &ws.path, ws.docker_extra_args.clone());
+    Ok(DockerPreview {
+        argv: docker::render_argv(&spec, &cmd, &args),
+        preview: docker::render_preview(&spec, &cmd, &args),
+        mounts: spec.mounts.clone(),
+        image_built: docker::spawn_image_tag().is_some(),
+    })
+}
+
+#[derive(Serialize)]
+struct DockerPreview {
+    argv: Vec<String>,
+    preview: String,
+    mounts: Vec<docker::Mount>,
+    image_built: bool,
+}
+
+/// Resolve the agent id to actually run for a workspace (explicit override,
+/// else the workspace's `cli`).
+fn resolve_agent_id(_settings: &Settings, agent_id: &Option<String>, ws: &Workspace) -> String {
+    agent_id.clone().unwrap_or_else(|| ws.cli.clone())
+}
+
+/// The base (cmd, args) for an agent id from the registry. Representative
+/// for the preview; the live spawn adds resume args on top.
+fn agent_spawn_cmd(settings: &Settings, agent_id: &str) -> (String, Vec<String>) {
+    settings
+        .agents
+        .iter()
+        .find(|a| a.id == agent_id)
+        .map(|a| (a.command.clone(), a.args.clone()))
+        .unwrap_or_else(|| (agent_id.to_string(), Vec::new()))
+}
+
 /// Replace just the agents list, preserving the rest of settings (repos_dir,
 /// welcomed, etc.). Used by the Settings → Agents page so the user can edit
 /// CLI commands, args, and YOLO flags without us shipping a new release every
@@ -6933,6 +7168,7 @@ pub fn run() {
             pty_spawn, pty_write, pty_resize, pty_kill,
             notify, open_path, reveal_path, home_dir, default_shell, path_exists, path_is_git_repo, log_line, pty_debug_append, terminal_stage_file, install_notification_sound, play_completion_sound,
             settings_load, settings_save, agents_save, agents_defaults, discover_repos, detect_clis,
+            docker_check, docker_image_status, docker_get_dockerfile, docker_default_dockerfile, docker_set_dockerfile, docker_build_image, docker_preview_command, workspace_set_docker,
             automation::automation_result,
             automation::automation_armed,
             list_monospace_fonts,
@@ -6959,6 +7195,10 @@ pub fn run() {
 /// so main is left clean.
 fn cleanup_children(app: &tauri::AppHandle) {
     use tauri::Manager;
+    // 0a. Docker containers — `docker rm -f` every termic-labeled container
+    //     (non-fatal). Belt-and-suspenders for the `--rm`-never-fired case
+    //     (crash / SIGKILL) so quitting never orphans a container.
+    docker::cleanup_all();
     // 0. Spotlight sessions — revert main for every active session so the
     //    user's repo is left in a clean state after the app exits.
     //    Drop each session (which stops its polling thread) and revert.
diff --git a/src-tauri/src/sandbox.rs b/src-tauri/src/sandbox.rs
index b7e6925..3230627 100644
--- a/src-tauri/src/sandbox.rs
+++ b/src-tauri/src/sandbox.rs
@@ -1821,7 +1821,7 @@ fn compute_home_denies(home: &str, user_allowed: &[String], runtime: &[String])
 /// Resolve symlinks so the SBPL rules match what the kernel sees.
 /// Seatbelt evaluates the *canonical* path; a worktree symlinked
 /// somewhere else would otherwise fail writes through the symlink.
-fn canonicalize_or_keep(p: &str) -> String {
+pub(crate) fn canonicalize_or_keep(p: &str) -> String {
     fs::canonicalize(p)
         .map(|c| c.to_string_lossy().into_owned())
         .unwrap_or_else(|_| p.to_string())
@@ -1838,7 +1838,7 @@ fn canonicalize_or_keep(p: &str) -> String {
 ///   2. Expect `gitdir: <abs path to /<parent>/.git/worktrees/<name>>`.
 ///   3. Walk up to `<parent>/.git` (i.e. trim `/worktrees/<name>` suffix).
 ///   4. Canonicalize and return.
-fn parent_git_dir_for_worktree(workspace_root: &str) -> Option<String> {
+pub(crate) fn parent_git_dir_for_worktree(workspace_root: &str) -> Option<String> {
     let dot_git = std::path::Path::new(workspace_root).join(".git");
     // For a regular checkout (is_repo_root), `.git` is a directory and
     // we don't need to widen — the workspace allow already covers it
diff --git a/src/components/dialogs/WorkspaceDockerPanel.tsx b/src/components/dialogs/WorkspaceDockerPanel.tsx
new file mode 100644
index 0000000..fd2bc77
--- /dev/null
+++ b/src/components/dialogs/WorkspaceDockerPanel.tsx
@@ -0,0 +1,147 @@
+// The Docker view inside the workspace sandbox dialog. Three load-bearing
+// ideas are stated outright + always visible (not behind a tooltip):
+//   1. only the mounted paths are visible to the agent,
+//   2. the Docker agent is a SEPARATE identity from the OS agent,
+//   3. one login is saved and shared across all Docker workspaces.
+// Paired with the annotated mount list + the literal command preview, the
+// user can always answer "what can this container see, and why?".
+//
+// See docs/plans/docker-sandbox/design.md ("How it works, explained IN the
+// dialog" + "Mount transparency" + "Command preview formatting").
+
+import { useEffect, useState } from "react";
+import { Container, Lock, FolderGit2, KeyRound, Terminal as TerminalIcon } from "lucide-react";
+import { dockerPreviewCommand, type DockerPreview, type DockerMount } from "@/lib/ipc";
+
+export function WorkspaceDockerPanel({
+  workspaceId,
+  agentId,
+  agentName,
+  extraArgs,
+  onExtraArgsChange,
+}: {
+  workspaceId: string;
+  agentId: string;
+  agentName: string;
+  extraArgs: string;
+  onExtraArgsChange: (next: string) => void;
+}) {
+  const [preview, setPreview] = useState<DockerPreview | null>(null);
+
+  // Re-render the preview whenever the workspace, agent, or extra args
+  // change — the preview is produced by the SAME render_argv the spawn
+  // uses, so what you see is what runs.
+  useEffect(() => {
+    let alive = true;
+    dockerPreviewCommand(workspaceId, agentId)
+      .then(p => { if (alive) setPreview(p); })
+      .catch(() => {});
+    return () => { alive = false; };
+  }, [workspaceId, agentId, extraArgs]);
+
+  return (
+    <div className="flex flex-col gap-4">
+      {/* How it works — always visible explainer. */}
+      <div className="rounded-lg border border-[var(--color-accent)]/25 bg-[var(--color-accent)]/[0.06] p-3.5 text-[13px] leading-relaxed text-[var(--color-fg-dim)]">
+        <div className="mb-1.5 flex items-center gap-1.5 text-[var(--color-fg)]">
+          <Container className="h-4 w-4 text-[var(--color-accent)]" />
+          <b>Docker sandbox</b>
+        </div>
+        <p>
+          This agent runs inside a Docker container. It can only touch the files listed below.
+          Everything else on your Mac is invisible to it.
+        </p>
+        <p className="mt-1.5">
+          <b className="text-[var(--color-fg)]">It is a separate agent from your normal one.</b>{" "}
+          Your Docker {agentName} has its own login, MCP servers, settings, and chat history, kept apart
+          from the {agentName} you run outside Docker.
+        </p>
+        <p className="mt-1.5">
+          <b className="text-[var(--color-fg)]">Log in once.</b>{" "}
+          The first time, run <code className="mono">/login</code> inside the agent. Your login, MCP servers,
+          and history are saved and shared across all your Docker workspaces for this agent, so you set it up
+          only once.
+        </p>
+        <p className="mt-1.5">Your conversations resume the same way they do today.</p>
+      </div>
+
+      {/* Mount transparency — every mount, with rw/ro + why + provenance. */}
+      <div>
+        <div className="mb-1 text-[13px] font-medium text-[var(--color-fg)]">What the container can see</div>
+        <div className="flex flex-col gap-1.5">
+          {(preview?.mounts ?? []).map((m, i) => <MountRow key={i} mount={m} />)}
+          {preview && preview.mounts.length === 0 && (
+            <div className="text-[12.5px] text-[var(--color-fg-faint)]">No mounts computed.</div>
+          )}
+        </div>
+      </div>
+
+      {/* Extra args. */}
+      <div>
+        <div className="text-[13px] font-medium text-[var(--color-fg)]">Extra <code className="mono">docker run</code> args</div>
+        <div className="mt-0.5 text-[12px] text-[var(--color-fg-faint)]">
+          Appended to the command below (e.g. <code className="mono">--memory 4g</code>, <code className="mono">-e FOO=bar</code>, an extra <code className="mono">-v</code>).
+          One token per space, as you'd type them in a shell.
+        </div>
+        <input
+          value={extraArgs}
+          onChange={e => onExtraArgsChange(e.target.value)}
+          placeholder="--memory 4g"
+          className="mt-2 w-full rounded-md border border-[var(--color-border)] bg-[var(--color-bg)] px-2 py-1.5 font-mono text-[13px] text-[var(--color-fg)] outline-none focus:border-[var(--color-accent)]"
+        />
+      </div>
+
+      {/* Command preview — the literal argv, multi-line. */}
+      <div>
+        <div className="mb-1 flex items-center gap-1.5 text-[13px] font-medium text-[var(--color-fg)]">
+          <TerminalIcon className="h-3.5 w-3.5 text-[var(--color-fg-dim)]" />
+          Command preview
+          {preview && !preview.image_built && (
+            <span className="rounded bg-[var(--color-warn)]/15 px-1.5 py-0.5 text-[11px] font-normal text-[var(--color-warn)]">
+              image not built
+            </span>
+          )}
+        </div>
+        <pre className="max-h-56 overflow-auto rounded-md border border-[var(--color-border-soft)] bg-[var(--color-bg)] p-3 font-mono text-[11.5px] leading-relaxed text-[var(--color-fg-dim)]">
+          {preview?.preview ?? "…"}
+        </pre>
+        <div className="mt-1 text-[11.5px] text-[var(--color-fg-faint)]">
+          This is exactly what termic runs. The <code className="mono"># comments</code> are display-only.
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function mountIcon(m: DockerMount) {
+  if (m.why.startsWith("git metadata")) return <FolderGit2 className="h-3.5 w-3.5" />;
+  if (m.why.includes("login")) return <KeyRound className="h-3.5 w-3.5" />;
+  return <Lock className="h-3.5 w-3.5" />;
+}
+
+function MountRow({ mount: m }: { mount: DockerMount }) {
+  return (
+    <div className="flex items-start gap-2.5 rounded-md border border-[var(--color-border-soft)] bg-[var(--color-bg)] px-2.5 py-2">
+      <div className="mt-0.5 text-[var(--color-fg-faint)]">{mountIcon(m)}</div>
+      <div className="min-w-0 flex-1">
+        <div className="flex flex-wrap items-center gap-1.5">
+          <code className="mono break-all text-[12px] text-[var(--color-fg)]">{m.host}</code>
+          <span className="text-[var(--color-fg-faint)]">→</span>
+          <code className="mono break-all text-[12px] text-[var(--color-fg-dim)]">{m.container}</code>
+          <span className={
+            "rounded px-1 py-px text-[10px] " +
+            (m.read_only
+              ? "bg-[var(--color-bg-2)] text-[var(--color-fg-faint)]"
+              : "bg-[var(--color-accent)]/15 text-[var(--color-accent)]")
+          }>
+            {m.read_only ? "read-only" : "read-write"}
+          </span>
+          {m.provenance === "implicit" && (
+            <span className="rounded bg-[var(--color-bg-2)] px-1 py-px text-[10px] text-[var(--color-fg-faint)]">auto</span>
+          )}
+        </div>
+        <div className="mt-0.5 text-[12px] text-[var(--color-fg-dim)]">{m.why}</div>
+      </div>
+    </div>
+  );
+}
diff --git a/src/components/dialogs/WorkspaceSandboxDialog.tsx b/src/components/dialogs/WorkspaceSandboxDialog.tsx
index 6ed4bed..278ed8c 100644
--- a/src/components/dialogs/WorkspaceSandboxDialog.tsx
+++ b/src/components/dialogs/WorkspaceSandboxDialog.tsx
@@ -12,11 +12,12 @@ import { usePrefs } from "@/store/prefs";
 import { AppDialog } from "@/components/ui/Dialog";
 import { Button } from "@/components/ui/Button";
 import { cn } from "@/lib/utils";
-import { settingsLoad, workspaceSetSandbox, sandboxAvailable } from "@/lib/ipc";
+import { settingsLoad, workspaceSetSandbox, workspaceSetDocker, dockerImageStatus, sandboxAvailable } from "@/lib/ipc";
 import { effectiveSandboxMode, type SandboxMode } from "@/lib/types";
-import { AlertTriangle, Shield, Zap, Save, RotateCw } from "lucide-react";
+import { AlertTriangle, Shield, Zap, Save, RotateCw, Container } from "lucide-react";
 import { SandboxModeSelector } from "@/components/SandboxModeSelector";
 import { SANDBOX_PRESETS } from "@/lib/sandboxPresets";
+import { WorkspaceDockerPanel } from "./WorkspaceDockerPanel";
 
 export function WorkspaceSandboxDialog() {
   const wsId = useUI(s => s.sandboxForWsId);
@@ -56,11 +57,33 @@ export function WorkspaceSandboxDialog() {
     sandboxAvailable().then(setOsSandboxOk).catch(() => setOsSandboxOk(false));
   }, []);
 
+  // ── Docker cage state ─────────────────────────────────────────────
+  // The Seatbelt|Docker choice is only OFFERED when the global master
+  // switch is on AND a usable image is built (image-exists gating, so the
+  // user can never pick Docker and then hit a spawn-time "no image"
+  // refusal). `cage` is the active top-level choice.
+  const [dockerOffered, setDockerOffered] = useState(false);
+  const [cage, setCage] = useState<"seatbelt" | "docker">("seatbelt");
+  const [dockerExtra, setDockerExtra] = useState("");
+  useEffect(() => {
+    let alive = true;
+    (async () => {
+      try {
+        const s = await settingsLoad();
+        const img = await dockerImageStatus();
+        if (alive) setDockerOffered(!!s.docker_sandbox_enabled && img.available);
+      } catch { if (alive) setDockerOffered(false); }
+    })();
+    return () => { alive = false; };
+  }, [wsId]);
+
   useEffect(() => {
     if (!ws) return;
     setMode(effectiveSandboxMode(ws));
     setRwText((ws.sandbox_rw_paths ?? []).join("\n"));
     setHostsText((ws.sandbox_allowed_hosts ?? []).join("\n"));
+    setCage(ws.docker_sandbox_enabled ? "docker" : "seatbelt");
+    setDockerExtra((ws.docker_extra_args ?? []).join(" "));
     setErr(null);
     setBusy(false);
   }, [ws?.id]); // eslint-disable-line react-hooks/exhaustive-deps
@@ -76,14 +99,54 @@ export function WorkspaceSandboxDialog() {
     s.split("\n").map(l => l.trim()).filter(Boolean);
   const arrEq = (a: string[], b: string[]) =>
     a.length === b.length && a.every((v, i) => v === b[i]);
-  const dirty = ws ? (
-    mode !== effectiveSandboxMode(ws) ||
-    !arrEq(splitLines(rwText),    ws.sandbox_rw_paths      ?? []) ||
-    !arrEq(splitLines(hostsText), ws.sandbox_allowed_hosts ?? [])
+  const splitArgs = (s: string) => s.split(/\s+/).map(t => t.trim()).filter(Boolean);
+  const wasDocker = !!ws?.docker_sandbox_enabled;
+  const dirty = ws ? (cage === "docker"
+    ? (!wasDocker ||
+       !arrEq(splitArgs(dockerExtra), ws.docker_extra_args ?? []))
+    : (wasDocker ||
+       mode !== effectiveSandboxMode(ws) ||
+       !arrEq(splitLines(rwText),    ws.sandbox_rw_paths      ?? []) ||
+       !arrEq(splitLines(hostsText), ws.sandbox_allowed_hosts ?? []))
   ) : false;
 
   async function save(restart: boolean) {
     if (!ws || busy) return;
+
+    // ── Docker cage save path ──────────────────────────────────────
+    // Mutually exclusive with Seatbelt: workspace_set_docker forces the
+    // Seatbelt mode off when enabling (and the Rust side cleans up any
+    // container when disabling). Killing live PTYs so the next spawn
+    // lands in the container reuses the existing pending-restart plumbing.
+    if (cage === "docker") {
+      const ok = await useUI.getState().askConfirm({
+        title: `Switch "${ws.name}" to the Docker sandbox?`,
+        message: restart
+          ? "The agent will be terminated and AUTO-restarted inside a Docker container. It logs in separately from your normal agent (run /login once inside it)."
+          : "Saved. Any agent currently running keeps its current cage until it next respawns; new tabs launch in Docker.",
+        confirmLabel: restart ? "Save & restart" : "Save without restart",
+      });
+      if (!ok) return;
+      setBusy(true); setErr(null);
+      try {
+        if (restart) useUI.getState().markPendingPtyRestart(ws.id);
+        await workspaceSetDocker(ws.id, true, splitArgs(dockerExtra));
+        await loadAll();
+        close();
+      } catch (e) {
+        setErr(String(e));
+        setBusy(false);
+      }
+      return;
+    }
+
+    // Switching FROM Docker back to a Seatbelt mode: clear the docker
+    // flag first (removes any container), then fall through to the
+    // normal Seatbelt save below.
+    if (wasDocker) {
+      try { await workspaceSetDocker(ws.id, false, []); } catch {}
+    }
+
     // Pre-flight confirm. We don't have a live PTY count on the
     // frontend (the Rust side will tell us when the IPC returns),
     // so the dialog text is generic. The user is explicitly asking
@@ -166,6 +229,47 @@ export function WorkspaceSandboxDialog() {
             the focus ring off the top row of mode cards. A few px of inset
             gives the ring room to render. */}
         <div className="flex flex-1 flex-col gap-5 overflow-y-auto px-0.5 pt-1 pr-1">
+        {/* Cage selector: Seatbelt | Docker. Only shown when the global
+            Docker master switch is on AND a usable image is built (so the
+            user can never pick Docker then hit a spawn-time "no image"
+            refusal). Picking Docker hides the Seatbelt selector + lists. */}
+        {dockerOffered && (
+          <div>
+            <div className="mb-1.5 text-[13px] font-medium text-[var(--color-fg)]">Cage</div>
+            <div className="inline-flex items-stretch rounded-md border border-[var(--color-border)] bg-[var(--color-bg)] p-[3px]">
+              {([
+                ["seatbelt", "Seatbelt", <Shield key="s" className="h-3.5 w-3.5" />],
+                ["docker",   "Docker",   <Container key="d" className="h-3.5 w-3.5" />],
+              ] as const).map(([id, label, icon]) => (
+                <button
+                  key={id}
+                  type="button"
+                  onClick={() => setCage(id)}
+                  className={cn(
+                    "flex h-7 items-center gap-1.5 rounded-[5px] px-3 text-[12.5px] transition-colors",
+                    cage === id
+                      ? "bg-[var(--color-accent-deep)] text-white"
+                      : "text-[var(--color-fg-dim)] hover:text-[var(--color-fg)]",
+                  )}
+                >
+                  {icon}{label}
+                </button>
+              ))}
+            </div>
+          </div>
+        )}
+
+        {cage === "docker" && ws && (
+          <WorkspaceDockerPanel
+            workspaceId={ws.id}
+            agentId={ws.cli}
+            agentName={agent?.display_name || ws.cli}
+            extraArgs={dockerExtra}
+            onExtraArgsChange={setDockerExtra}
+          />
+        )}
+
+        {cage === "seatbelt" && (<>
         {/* On/off panel. Big, color-coded, unambiguous - the prior
             "Unsandboxed" checkbox was a double-negative trap: users
             saw the box checked and assumed the cage was ON. State now
@@ -372,6 +476,7 @@ export function WorkspaceSandboxDialog() {
           </Field>
         )}
         </>)}
+        </>)}
 
         {/* "Recent denies" panel removed — the TerminalPane footer
             now shows a live deny counter chip per workspace, which
diff --git a/src/components/settings/DockerSection.tsx b/src/components/settings/DockerSection.tsx
new file mode 100644
index 0000000..efe062e
--- /dev/null
+++ b/src/components/settings/DockerSection.tsx
@@ -0,0 +1,307 @@
+// Docker sandbox (experimental) — the global, image-level home for the
+// Docker cage. Everything per-machine lives here: the master switch, the
+// `docker` availability probe, the editable Dockerfile, and the only place
+// the image is built or rebuilt. Per-workspace cage selection lives in the
+// workspace sandbox dialog, not here (one image, many workspaces).
+//
+// Build is deliberately decoupled from spawn: the image is built by an
+// explicit action here and never lazily on a PTY spawn (a 2.8GB build on
+// the spawn path would freeze the webview). See docs/plans/docker-sandbox.
+
+import { useEffect, useRef, useState } from "react";
+import { cn } from "@/lib/utils";
+import { Button } from "@/components/ui/Button";
+import { Checkbox } from "@/components/ui/Checkbox";
+import { usePrefs, resolveTheme } from "@/store/prefs";
+import { resolveEditorTheme, editorSurfaceTheme } from "@/lib/editorTheme";
+import { EditorView, keymap } from "@codemirror/view";
+import { EditorState, Compartment } from "@codemirror/state";
+import { defaultKeymap, history, historyKeymap, indentWithTab } from "@codemirror/commands";
+import { StreamLanguage } from "@codemirror/language";
+import { dockerFile } from "@codemirror/legacy-modes/mode/dockerfile";
+import {
+  settingsLoad, settingsSave,
+  dockerCheck, dockerImageStatus, dockerGetDockerfile, dockerDefaultDockerfile,
+  dockerSetDockerfile, dockerBuildImage, onDockerBuildLog, onDockerBuildDone,
+  type DockerStatus, type DockerImageStatus,
+} from "@/lib/ipc";
+import type { Settings } from "@/lib/types";
+import { Loader2, CircleCheck, CircleAlert, Container } from "lucide-react";
+
+export function DockerSection() {
+  const [settings, setSettings] = useState<Settings | null>(null);
+  const [status, setStatus] = useState<DockerStatus | null>(null);
+  const [image, setImage] = useState<DockerImageStatus | null>(null);
+
+  // Dockerfile editor state.
+  const hostRef = useRef<HTMLDivElement>(null);
+  const viewRef = useRef<EditorView | null>(null);
+  const themeComp = useRef(new Compartment());
+  const [dockerfile, setDockerfile] = useState("");
+  const [savedDockerfile, setSavedDockerfile] = useState("");
+  const [dfBusy, setDfBusy] = useState(false);
+
+  // Build state.
+  const [building, setBuilding] = useState(false);
+  const [buildLog, setBuildLog] = useState<string[]>([]);
+  const [showLog, setShowLog] = useState(false);
+  const logEndRef = useRef<HTMLDivElement>(null);
+
+  const themeId = usePrefs(s => s.editorThemeId);
+  const fontSize = usePrefs(s => s.editorFontSize);
+  const themeMode = usePrefs(s => s.themeMode);
+  const appIsLight = resolveTheme(themeMode) === "light";
+
+  const enabled = !!settings?.docker_sandbox_enabled;
+  const dirty = dockerfile !== savedDockerfile;
+
+  // ── Load everything on mount ──────────────────────────────────────
+  const refresh = () => {
+    dockerCheck().then(setStatus).catch(() => {});
+    dockerImageStatus().then(setImage).catch(() => {});
+  };
+  useEffect(() => {
+    settingsLoad().then(setSettings).catch(() => {});
+    dockerGetDockerfile().then(df => { setDockerfile(df); setSavedDockerfile(df); }).catch(() => {});
+    refresh();
+  }, []);
+
+  // ── CodeMirror init (once) ────────────────────────────────────────
+  useEffect(() => {
+    if (!hostRef.current || viewRef.current) return;
+    const view = new EditorView({
+      state: EditorState.create({
+        doc: dockerfile,
+        extensions: [
+          history(),
+          keymap.of([indentWithTab, ...defaultKeymap, ...historyKeymap]),
+          StreamLanguage.define(dockerFile),
+          EditorView.lineWrapping,
+          themeComp.current.of([
+            resolveEditorTheme(themeId, appIsLight),
+            editorSurfaceTheme(fontSize, false),
+          ]),
+          EditorView.updateListener.of(u => {
+            if (u.docChanged) setDockerfile(u.state.doc.toString());
+          }),
+        ],
+      }),
+      parent: hostRef.current,
+    });
+    viewRef.current = view;
+    return () => { view.destroy(); viewRef.current = null; };
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [dockerfile.length > 0]);
+
+  useEffect(() => {
+    viewRef.current?.dispatch({
+      effects: themeComp.current.reconfigure([
+        resolveEditorTheme(themeId, appIsLight),
+        editorSurfaceTheme(fontSize, false),
+      ]),
+    });
+  }, [themeId, fontSize, appIsLight]);
+
+  // ── Build log streaming ───────────────────────────────────────────
+  useEffect(() => {
+    if (!building) return;
+    let unlistenLog: (() => void) | undefined;
+    let unlistenDone: (() => void) | undefined;
+    onDockerBuildLog(line => setBuildLog(l => [...l, line])).then(u => (unlistenLog = u));
+    onDockerBuildDone(({ success }) => {
+      setBuilding(false);
+      setBuildLog(l => [...l, success ? "✓ Build finished." : "✗ Build failed."]);
+      refresh();
+    }).then(u => (unlistenDone = u));
+    return () => { unlistenLog?.(); unlistenDone?.(); };
+  }, [building]);
+
+  useEffect(() => { logEndRef.current?.scrollIntoView({ block: "end" }); }, [buildLog]);
+
+  // ── Actions ───────────────────────────────────────────────────────
+  async function toggleMaster(next: boolean) {
+    if (!settings) return;
+    const updated = { ...settings, docker_sandbox_enabled: next };
+    setSettings(updated);
+    await settingsSave(updated);
+  }
+
+  async function saveDockerfile() {
+    setDfBusy(true);
+    try {
+      await dockerSetDockerfile(dockerfile);
+      setSavedDockerfile(dockerfile);
+      refresh();
+    } finally { setDfBusy(false); }
+  }
+
+  async function resetDockerfile() {
+    const def = await dockerDefaultDockerfile();
+    setEditorDoc(def);
+    setDockerfile(def);
+  }
+
+  function setEditorDoc(text: string) {
+    const v = viewRef.current;
+    if (!v) return;
+    v.dispatch({ changes: { from: 0, to: v.state.doc.length, insert: text } });
+  }
+
+  async function build(noCache: boolean) {
+    // Persist any pending edits first so the build matches the editor.
+    if (dirty) { await dockerSetDockerfile(dockerfile); setSavedDockerfile(dockerfile); }
+    setBuildLog([]);
+    setShowLog(true);
+    setBuilding(true);
+    await dockerBuildImage(noCache);
+  }
+
+  if (!settings) {
+    return <div className="text-[13.5px] text-[var(--color-fg-faint)]">Loading…</div>;
+  }
+
+  return (
+    <div className="flex flex-col gap-7">
+      <div>
+        <h1 className="flex items-center gap-2 text-[20px] font-medium">
+          <Container className="h-5 w-5 text-[var(--color-accent)]" />
+          Docker sandbox
+          <span className="rounded bg-[var(--color-bg-2)] px-1.5 py-0.5 text-[11px] font-normal text-[var(--color-fg-dim)]">experimental</span>
+        </h1>
+        <p className="mt-1 max-w-2xl text-[12.5px] text-[var(--color-fg-dim)]">
+          A stronger cage than Seatbelt: the agent runs inside a Docker container and can only touch the
+          folders termic mounts (the worktree and its git metadata). Everything else on your Mac is invisible
+          to it. One image is shared by every Docker workspace; pick Docker per workspace from its sandbox dialog.
+        </p>
+      </div>
+
+      {/* Master toggle */}
+      <label className="flex items-start gap-3 border-t border-[var(--color-border-soft)] pt-6">
+        <Checkbox checked={enabled} onChange={toggleMaster} />
+        <div className="min-w-0">
+          <div className="text-[14px] font-medium">Enable Docker sandbox</div>
+          <div className="mt-0.5 text-[12.5px] text-[var(--color-fg-dim)]">
+            While off, no Docker UI appears anywhere and Docker is never invoked. Turn it on, then build the
+            image below. Once built, "Docker" becomes selectable in each workspace's sandbox dialog.
+          </div>
+        </div>
+      </label>
+
+      {enabled && (
+        <>
+          {/* Docker availability */}
+          <div className="border-t border-[var(--color-border-soft)] pt-6">
+            <div className="text-[14px] font-medium">Docker status</div>
+            <DockerAvailability status={status} />
+          </div>
+
+          {/* Dockerfile editor */}
+          <div className="border-t border-[var(--color-border-soft)] pt-6">
+            <div className="flex items-center justify-between gap-3">
+              <div>
+                <div className="text-[14px] font-medium">Dockerfile</div>
+                <div className="mt-0.5 max-w-2xl text-[12.5px] text-[var(--color-fg-dim)]">
+                  One generic image for all agents. Edit the commented regions to add MCP servers, CLI tools, or
+                  baked skills. Personal logins (agent auth, MCP OAuth) are NOT set up here, just run the agent and
+                  log in once inside Docker; those persist via your mounted config directory.
+                </div>
+              </div>
+            </div>
+            <div
+              ref={hostRef}
+              className="mt-2 max-h-[420px] overflow-auto rounded-lg border border-[var(--color-border-soft)] bg-[var(--color-bg)]"
+            />
+            <div className="mt-3 flex items-center gap-2">
+              <Button variant="primary" disabled={!dirty || dfBusy} onClick={saveDockerfile}>
+                {dfBusy ? "Saving…" : "Save"}
+              </Button>
+              <Button variant="secondary" disabled={image?.is_default && !dirty} onClick={resetDockerfile}>
+                Reset to default
+              </Button>
+              {dirty && <span className="text-[12px] text-[var(--color-fg-faint)]">Unsaved edits</span>}
+            </div>
+          </div>
+
+          {/* Image build */}
+          <div className="border-t border-[var(--color-border-soft)] pt-6">
+            <div className="text-[14px] font-medium">Image</div>
+            <ImageStatusLine image={image} dirty={dirty} />
+            <div className="mt-3 flex items-center gap-2">
+              <Button
+                variant="primary"
+                disabled={building || !status?.daemon}
+                onClick={() => build(false)}
+              >
+                {building ? <span className="flex items-center gap-1.5"><Loader2 className="h-3.5 w-3.5 animate-spin" /> Building…</span> : "Build image"}
+              </Button>
+              <Button variant="secondary" disabled={building || !status?.daemon} onClick={() => build(true)}>
+                Update agents (rebuild)
+              </Button>
+              {!status?.daemon && (
+                <span className="text-[12px] text-[var(--color-warn,#d08b3a)]">Start Docker to build.</span>
+              )}
+              {buildLog.length > 0 && (
+                <Button variant="ghost" onClick={() => setShowLog(s => !s)}>
+                  {showLog ? "Hide log" : "Show log"}
+                </Button>
+              )}
+            </div>
+            {showLog && buildLog.length > 0 && (
+              <pre className="mt-3 max-h-64 overflow-auto rounded-md border border-[var(--color-border-soft)] bg-[var(--color-bg)] p-3 font-mono text-[11.5px] leading-relaxed text-[var(--color-fg-dim)]">
+                {buildLog.join("\n")}
+                <div ref={logEndRef} />
+              </pre>
+            )}
+          </div>
+        </>
+      )}
+    </div>
+  );
+}
+
+function DockerAvailability({ status }: { status: DockerStatus | null }) {
+  if (!status) return <div className="mt-1 text-[12.5px] text-[var(--color-fg-faint)]">Checking…</div>;
+  if (!status.binary) {
+    return (
+      <div className="mt-1 flex items-center gap-1.5 text-[12.5px] text-[var(--color-warn,#d08b3a)]">
+        <CircleAlert className="h-3.5 w-3.5" /> `docker` not found on PATH. Install Docker Desktop, OrbStack, or colima.
+      </div>
+    );
+  }
+  if (!status.daemon) {
+    return (
+      <div className="mt-1 flex items-center gap-1.5 text-[12.5px] text-[var(--color-warn,#d08b3a)]">
+        <CircleAlert className="h-3.5 w-3.5" /> Docker is installed but the daemon is not running. Start it to build / run.
+      </div>
+    );
+  }
+  return (
+    <div className="mt-1 flex items-center gap-1.5 text-[12.5px] text-[var(--color-fg-dim)]">
+      <CircleCheck className="h-3.5 w-3.5 text-[var(--color-ok,#4caf50)]" /> Ready{status.version ? ` · ${status.version}` : ""}
+    </div>
+  );
+}
+
+function ImageStatusLine({ image, dirty }: { image: DockerImageStatus | null; dirty: boolean }) {
+  if (!image) return null;
+  return (
+    <div className="mt-1 flex flex-col gap-1 text-[12.5px]">
+      {image.available ? (
+        <span className="flex items-center gap-1.5 text-[var(--color-fg-dim)]">
+          <CircleCheck className="h-3.5 w-3.5 text-[var(--color-ok,#4caf50)]" />
+          Built · <code className="font-mono">{image.last_built_tag ?? image.current_tag}</code>
+        </span>
+      ) : (
+        <span className="flex items-center gap-1.5 text-[var(--color-fg-faint)]">
+          <CircleAlert className="h-3.5 w-3.5" /> Not built yet. Build it to use Docker mode in a workspace.
+        </span>
+      )}
+      {(image.stale || dirty) && image.available && (
+        <span className="flex items-center gap-1.5 text-[var(--color-warn,#d08b3a)]">
+          <CircleAlert className="h-3.5 w-3.5" />
+          Dockerfile edited since the last build. Rebuild to apply your changes (workspaces keep using the last built image until then).
+        </span>
+      )}
+    </div>
+  );
+}
diff --git a/src/components/settings/Settings.tsx b/src/components/settings/Settings.tsx
index 673acda..293d47f 100644
--- a/src/components/settings/Settings.tsx
+++ b/src/components/settings/Settings.tsx
@@ -5,7 +5,7 @@
 import { useEffect, useState } from "react";
 import { useApp } from "@/store/app";
 import { Button } from "@/components/ui/Button";
-import { X, Palette, FolderGit2, Settings as SettingsIcon, Keyboard, Terminal, Layers, Library } from "lucide-react";
+import { X, Palette, FolderGit2, Settings as SettingsIcon, Keyboard, Terminal, Layers, Library, Container } from "lucide-react";
 import { cn } from "@/lib/utils";
 import { AppearanceSection } from "./AppearanceSection";
 import { RepositorySection } from "./RepositorySection";
@@ -13,6 +13,7 @@ import { GeneralSection } from "./GeneralSection";
 import { ShortcutsSection } from "./ShortcutsSection";
 import { AgentsSection } from "./AgentsSection";
 import { PromptLibrarySection } from "./PromptLibrarySection";
+import { DockerSection } from "./DockerSection";
 
 export function Settings() {
   const view = useApp(s => s.view);
@@ -72,6 +73,8 @@ export function Settings() {
           active={tab === "prompts"} onClick={() => openSettings("prompts")} />
         <RailItem icon={<Keyboard className="h-4 w-4" />} label="Shortcuts"
           active={tab === "shortcuts"} onClick={() => openSettings("shortcuts")} />
+        <RailItem icon={<Container className="h-4 w-4" />} label="Docker sandbox"
+          active={tab === "docker"} onClick={() => openSettings("docker")} />
 
         <div className="mt-5 px-2 pb-1 text-[11.5px] uppercase tracking-wider text-[var(--color-fg-faint)]">
           Projects
@@ -106,6 +109,7 @@ export function Settings() {
           {tab === "agents"      && <AgentsSection />}
           {tab === "prompts"     && <PromptLibrarySection />}
           {tab === "shortcuts"   && <ShortcutsSection />}
+          {tab === "docker"      && <DockerSection />}
           {tab === "repositories" && (
             isRepoSelected
               ? <RepositorySection projectId={repoId!} />
diff --git a/src/components/sidebar/Sidebar.tsx b/src/components/sidebar/Sidebar.tsx
index 8e2f19c..8b16b26 100644
--- a/src/components/sidebar/Sidebar.tsx
+++ b/src/components/sidebar/Sidebar.tsx
@@ -6,7 +6,7 @@ import { useApp, useWorkspaceTabs, useActiveTabId } from "@/store/app";
 import { usePrefs } from "@/store/prefs";
 import { Button } from "@/components/ui/Button";
 import { Tip } from "@/components/ui/Tooltip";
-import { LayoutGrid, History, FolderPlus, Settings, Plus, Archive, Layers, Moon, Cog, MoreVertical, GitBranchPlus, FolderGit2, ChevronRight, ChevronDown, Bell, Bug, Mail, Zap, X, Pencil, Copy, ChevronsDownUp, ChevronsUpDown, Check, AudioWaveform, Radio, SquareChevronRight, Loader2, EyeOff } from "lucide-react";
+import { LayoutGrid, History, FolderPlus, Settings, Plus, Archive, Layers, Moon, Cog, MoreVertical, GitBranchPlus, FolderGit2, ChevronRight, ChevronDown, Bell, Bug, Mail, Zap, X, Pencil, Copy, ChevronsDownUp, ChevronsUpDown, Check, AudioWaveform, Radio, SquareChevronRight, Loader2, EyeOff, Container } from "lucide-react";
 import { DropdownRoot, DropdownTrigger, DropdownMenu, DropdownItem, DropdownSeparator, DropdownLabel } from "@/components/ui/Dropdown";
 import { ProjectActionsMenuItems } from "./ProjectActionsMenuItems";
 import { UpdateCard } from "./UpdateCard";
@@ -1141,7 +1141,7 @@ function WorkspaceRow({ w, compact }: { w: Workspace; compact: boolean }) {
                   // the button visible; unless the collapsed attention/done
                   // badge is active — it lives in the same slot and the
                   // status icon would cover it.
-                  (w.sandbox_enabled || (!!w.yolo && !isSandboxEnforced(effectiveSandboxMode(w)))) && !(collapsed && (hasAttention || hasDone || hasWorking))
+                  (w.sandbox_enabled || w.docker_sandbox_enabled || (!!w.yolo && !isSandboxEnforced(effectiveSandboxMode(w)))) && !(collapsed && (hasAttention || hasDone || hasWorking))
                     ? "opacity-100 pointer-events-auto"
                     : "opacity-0 group-hover/wsrow:opacity-100 pointer-events-none group-hover/wsrow:pointer-events-auto",
                   wsRenaming !== null && "pointer-events-none",
@@ -1157,6 +1157,16 @@ function WorkspaceRow({ w, compact }: { w: Workspace; compact: boolean }) {
                 {(() => {
                   const wMode = effectiveSandboxMode(w);
                   const stateOpacity = terminalTabs.length > 0 ? "opacity-100" : "opacity-40";
+                  // Docker mode is its own cage (mutually exclusive with
+                  // Seatbelt) — a distinct whale/container glyph so it's
+                  // obvious at a glance which cage the workspace is in.
+                  if (w.docker_sandbox_enabled) {
+                    return (
+                      <Container
+                        className={cn("absolute h-3.5 w-3.5 text-[var(--color-accent)] transition-opacity group-hover/wsrow:opacity-0", stateOpacity)}
+                      />
+                    );
+                  }
                   if (!!w.yolo && !isSandboxEnforced(wMode)) {
                     return (
                       <Zap
@@ -1182,7 +1192,7 @@ function WorkspaceRow({ w, compact }: { w: Workspace; compact: boolean }) {
                 <MoreVertical
                   className={cn(
                     "h-3.5 w-3.5 text-[var(--color-fg-faint)] transition-opacity",
-                    (w.sandbox_enabled || (!!w.yolo && !isSandboxEnforced(effectiveSandboxMode(w)))) && "opacity-0 group-hover/wsrow:opacity-100",
+                    (w.sandbox_enabled || w.docker_sandbox_enabled || (!!w.yolo && !isSandboxEnforced(effectiveSandboxMode(w)))) && "opacity-0 group-hover/wsrow:opacity-100",
                   )}
                 />
               </button>
diff --git a/src/lib/ipc.ts b/src/lib/ipc.ts
index d59de7a..c97f581 100644
--- a/src/lib/ipc.ts
+++ b/src/lib/ipc.ts
@@ -282,6 +282,45 @@ export const workspaceDiff     = (id: string) => invoke<string>("workspace_diff"
 export const workspaceSendDiffToMain = (id: string) =>
   invoke<{ tracked_files: number; untracked_files: number }>("workspace_send_diff_to_main", { id });
 
+// ─────────────────────────── docker sandbox ──────────────────────────
+
+export interface DockerStatus { binary: boolean; daemon: boolean; version: string | null }
+export interface DockerImageStatus {
+  current_tag: string;
+  current_built: boolean;
+  last_built_tag: string | null;
+  last_built_exists: boolean;
+  stale: boolean;
+  is_default: boolean;
+  available: boolean;
+}
+export interface DockerMount {
+  host: string; container: string; read_only: boolean;
+  provenance: "implicit" | "user"; why: string; load_bearing: boolean;
+}
+export interface DockerPreview {
+  argv: string[]; preview: string; mounts: DockerMount[]; image_built: boolean;
+}
+
+export const dockerCheck            = () => invoke<DockerStatus>("docker_check");
+export const dockerImageStatus      = () => invoke<DockerImageStatus>("docker_image_status");
+export const dockerGetDockerfile    = () => invoke<string>("docker_get_dockerfile");
+export const dockerDefaultDockerfile = () => invoke<string>("docker_default_dockerfile");
+export const dockerSetDockerfile    = (contents: string) => invoke<void>("docker_set_dockerfile", { contents });
+/** Kicks off a background build; stream output via onDockerBuildLog / onDockerBuildDone. */
+export const dockerBuildImage       = (noCache: boolean) => invoke<void>("docker_build_image", { noCache });
+export const dockerPreviewCommand   = (workspaceId: string, agentId?: string) =>
+  invoke<DockerPreview>("docker_preview_command", { workspaceId, agentId });
+export const workspaceSetDocker     = (id: string, enabled: boolean, extraArgs: string[]) =>
+  invoke<void>("workspace_set_docker", { id, enabled, extraArgs });
+
+export function onDockerBuildLog(cb: (line: string) => void): Promise<UnlistenFn> {
+  return listen<{ line: string }>("docker-build://log", e => cb(e.payload.line));
+}
+export function onDockerBuildDone(cb: (d: { success: boolean; tag: string; error: string | null }) => void): Promise<UnlistenFn> {
+  return listen<{ success: boolean; tag: string; error: string | null }>("docker-build://done", e => cb(e.payload));
+}
+
 // ───────────────────────────── spotlight ─────────────────────────────
 
 export const workspaceSpotlightStart   = (id: string) => invoke<void>("workspace_spotlight_start",   { id });
diff --git a/src/lib/types.ts b/src/lib/types.ts
index 0c64380..2b174c7 100644
--- a/src/lib/types.ts
+++ b/src/lib/types.ts
@@ -211,6 +211,14 @@ export interface Workspace {
   persisted_tabs?: PersistedTab[];
   /** Same as `persisted_tabs` but for right-split panel agents. */
   right_split_tabs?: PersistedTab[];
+  /** Docker sandbox mode for this workspace. Mutually exclusive with the
+   *  Seatbelt sandbox: when true, the agent PTY runs inside `docker run`
+   *  instead of `sandbox-exec`. Only effective when the global
+   *  `Settings.docker_sandbox_enabled` is on and the image is built. */
+  docker_sandbox_enabled?: boolean;
+  /** User-appended `docker run` args (e.g. `--memory 4g`, `-e FOO=bar`).
+   *  Inserted at a fixed point in the rendered argv. */
+  docker_extra_args?: string[];
 }
 
 /** One durable agent tab persisted on a workspace. Mirror of
@@ -372,6 +380,10 @@ export interface Settings {
    *  tree across every project. Unioned with each project's committed
    *  `.termic.yaml` `exclude`. `.git` is always hidden regardless. */
   file_tree_exclude?: string[];
+  /** Master switch for the experimental Docker sandbox mode. While off,
+   *  no Docker UI appears and Docker is never invoked. A workspace's
+   *  `docker_sandbox_enabled` only takes effect when this is also on. */
+  docker_sandbox_enabled?: boolean;
 }
 
 export interface DiscoveredRepo {
diff --git a/src/store/app.ts b/src/store/app.ts
index d0fd2ed..ae01848 100644
--- a/src/store/app.ts
+++ b/src/store/app.ts
@@ -17,7 +17,7 @@ interface View {
    *  and panel state all stay intact while it's open. */
   settingsOpen?: boolean;
   /** When the Settings overlay is open, which section is selected. */
-  settingsTab?: "general" | "appearance" | "agents" | "prompts" | "repositories" | "shortcuts";
+  settingsTab?: "general" | "appearance" | "agents" | "prompts" | "repositories" | "shortcuts" | "docker";
   /** When viewing a repository's settings, which project id is active. */
   settingsRepoId?: string;
 }