🥇 export from upstream (c220697)

compose/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   claude:
-    build: ../images/claude
+    image: sandcage-claude:latest
     working_dir: /workspace
     user: "${SANDCAGE_UID}:${SANDCAGE_GID}"
     volumes:
@@ -13,7 +13,7 @@ services:
     stdin_open: true
 
   codex:
-    build: ../images/codex
+    image: sandcage-codex:latest
     working_dir: /workspace
     user: "${SANDCAGE_UID}:${SANDCAGE_GID}"
     volumes:
@@ -26,7 +26,7 @@ services:
     stdin_open: true
 
   shell:
-    build: ../images/base
+    image: sandcage-base:latest
     working_dir: /workspace
     user: "${SANDCAGE_UID}:${SANDCAGE_GID}"
     volumes:

src/docker.rs

@@ -122,8 +122,13 @@ pub fn build_compose_env(workspace: &Path) -> Result<HashMap<String, String>> {
     let home = dirs::home_dir().ok_or(DockerError::NoHomeDir)?;
     let sandcage_home = home.join(".sandcage");
 
-    let uid = id_flag("-u")?;
-    let gid = id_flag("-g")?;
+    // On Windows, UID/GID passthrough is meaningless — use the container's
+    // built-in agent user (1000:1000). On Linux, match the host user.
+    let (uid, gid) = if cfg!(windows) {
+        ("1000".to_string(), "1000".to_string())
+    } else {
+        (id_flag("-u")?, id_flag("-g")?)
+    };
 
     let mut env = HashMap::new();
     env.insert("SANDCAGE_UID".into(), uid);