diff --git a/docs/how-it-works/sandboxes/runtimes.mdx b/docs/how-it-works/sandboxes/runtimes.mdx
index f56d194d63..42c47f0d0b 100644
--- a/docs/how-it-works/sandboxes/runtimes.mdx
+++ b/docs/how-it-works/sandboxes/runtimes.mdx
@@ -107,7 +107,7 @@ To pin specific GPUs, pass `cdi_devices` for Docker or Podman, or `gpu_device_id
 
 ## Docker Driver
 
-[Docker](https://www.docker.com/get-started/) runs sandboxes as containers on the Docker daemon host. The gateway accesses the daemon through its configured Unix socket. Docker is also required to build sandbox images from local directories or Dockerfiles.
+[Docker](https://www.docker.com/get-started/) runs sandboxes as containers on the Docker daemon host. The gateway accesses the daemon through its configured Unix socket.
 
 ```toml
 [openshell.gateway]
@@ -362,7 +362,7 @@ On Docker and Podman, set `process.run_as_user` and `process.run_as_group` in th
 
 | Driver | Default identity |
 |---|---|
-| Docker, Podman | The image's `USER`. Images without `USER` must set both fields in policy. |
+| Docker, Podman | The image's `USER`, otherwise `1000`. |
 | Kubernetes | OpenShift SCC namespace annotations, otherwise `1000`. Override with `sandbox_uid` and `sandbox_gid`. |
 | MicroVM | The image's `sandbox` account, otherwise `1000`. Override with `sandbox_uid` and `sandbox_gid`. |
 
diff --git a/examples/bring-your-own-container/Dockerfile b/examples/bring-your-own-container/Dockerfile
index 4b8ccf8abe..60d6ed5fc8 100644
--- a/examples/bring-your-own-container/Dockerfile
+++ b/examples/bring-your-own-container/Dockerfile
@@ -7,11 +7,9 @@
 
 FROM python:3.13-slim
 
-# System tools useful for sandbox networking and debugging.
-# iproute2: required for network namespace management (ip netns, veth pairs)
-# nftables: optional, enables bypass detection (log + reject for direct connections)
+# curl is only for debugging. OpenShell needs no networking tools in the image.
 RUN apt-get update && apt-get install -y --no-install-recommends \
-        curl iproute2 nftables \
+        curl \
     && rm -rf /var/lib/apt/lists/*
 
 RUN groupadd --gid 1500 app \
diff --git a/examples/bring-your-own-container/README.md b/examples/bring-your-own-container/README.md
index a496b0c7a9..88b3a0c65b 100644
--- a/examples/bring-your-own-container/README.md
+++ b/examples/bring-your-own-container/README.md
@@ -71,12 +71,13 @@ key requirements are:
   at runtime.
 - **Declare a non-root OCI `USER`** for Docker and Podman. Use a named account
   such as `app`, a numeric UID with a passwd entry that supplies its primary
-  GID, or a numeric pair such as `1500:1500`. You can instead set both
+  GID, or a numeric pair such as `1500:1500`. You can instead set
   `process.run_as_user` and `process.run_as_group` explicitly in policy.
-- **Prepare `/sandbox` as the workspace.** Until OCI working-directory support
-  is added, create `/sandbox` and make it writable by the selected identity.
-  The example does this with `install -d -o app -g app /sandbox`.
-- **Install `iproute2`** for full network namespace isolation.
+  Images without `USER` run as UID and GID `1000`.
+- **Use `/sandbox` or an existing `WORKDIR` as the workspace.** The driver
+  creates `/sandbox` for the selected identity. On Docker and Podman, an image
+  `WORKDIR` other than `/` or `/sandbox` becomes the workspace instead, and it
+  must exist and be writable by the selected identity.
 - **Use a standard Linux base image** — distroless and `FROM scratch`
   images are not supported.