diff --git a/claude_desktop/CHANGELOG.md b/claude_desktop/CHANGELOG.md
index 593e7b93a6..f7bbb06938 100644
--- a/claude_desktop/CHANGELOG.md
+++ b/claude_desktop/CHANGELOG.md
@@ -1,6 +1,6 @@
  
 ## 1.33 (22-07-2026)
-- Add cowork virtualization support: `qemu-system-x86`, `ovmf`, and `docker.io` (Bookworm main, installed via apt) plus `virtiofsd` for sharing the workspace into the sandbox microVM. `virtiofsd` is only packaged for Debian trixie/sid, not Bookworm or bookworm-backports, and its trixie `.deb` links a newer GLIBC than this add-on's Bookworm runtime — so it now gets built from the pinned crates.io release (`1.14.0`) in a dedicated `virtiofsd-builder` stage, the same GLIBC-safe pattern already used for `rtk` and `tokensave`. Its build deps (`libseccomp-dev`, `libcap-ng-dev`, `pkg-config`, `clang`, `libclang-dev`) live only in that builder stage; only the runtime shared libs (`libseccomp2`, `libcap-ng0`) ship in the final image. The built binary is validated with `--version` at build time alongside `rtk`/`tokensave`, so a GLIBC/ABI mismatch fails the image build instead of surfacing at container start.
+- Add cowork virtualization support: `qemu-system-x86` and `ovmf` (Bookworm main, installed via apt) plus `virtiofsd` for sharing the workspace into the sandbox microVM. `virtiofsd` is only packaged for Debian trixie/sid, not Bookworm or bookworm-backports, and its trixie `.deb` links a newer GLIBC than this add-on's Bookworm runtime — so it now gets built from the pinned crates.io release (`1.14.0`) in a dedicated `virtiofsd-builder` stage, the same GLIBC-safe pattern already used for `rtk` and `tokensave`. Its build deps (`libseccomp-dev`, `libcap-ng-dev`, `pkg-config`, `clang`, `libclang-dev`) live only in that builder stage; only the runtime shared libs (`libseccomp2`, `libcap-ng0`) ship in the final image. The built binary is validated with `--version` at build time alongside `rtk`/`tokensave`, so a GLIBC/ABI mismatch fails the image build instead of surfacing at container start. Docker itself is deliberately not installed: this base image already ships Docker-in-Docker (`docker-ce`/`containerd.io` from Docker's own apt repo, started via the pre-existing `START_DOCKER` env var) — an initial attempt to also `apt-get install docker.io` broke the build, since Debian's package pulls in `containerd`/`runc`, which apt refuses to install alongside the base image's already-installed `containerd.io` (`Conflicts`).
  
 ## ubunturesolute-version-8208e985 (2026-07-21)
 - Update to latest version from linuxserver/docker-baseimage-selkies (changelog : https://github.com/linuxserver/docker-baseimage-selkies/releases)
diff --git a/claude_desktop/Dockerfile b/claude_desktop/Dockerfile
index 32c3c5f4f1..4874372a7c 100644
--- a/claude_desktop/Dockerfile
+++ b/claude_desktop/Dockerfile
@@ -104,9 +104,13 @@ RUN if [ ! -f /bin/sh ] && [ -f /usr/bin/sh ]; then ln -s /usr/bin/sh /bin/sh; f
 # Install Claude Desktop, Claude Code, Python tooling, and lightweight local validators.
 # gnome-keyring provides the Secret Service backend Electron safeStorage needs to persist
 # sign-in and dispatch grants.
-# The cowork virtualization stack (qemu-system-x86 + ovmf firmware + docker.io) lets Claude
-# Code launch its sandbox microVM; libseccomp2 and libcap-ng0 are the shared libraries the
-# source-built virtiofsd daemon links against at runtime.
+# The cowork virtualization stack (qemu-system-x86 + ovmf firmware) lets Claude Code launch
+# its sandbox microVM; libseccomp2 and libcap-ng0 are the shared libraries the source-built
+# virtiofsd daemon links against at runtime. Docker itself is NOT installed here: this base
+# image already ships Docker-in-Docker (docker-ce + containerd.io from Docker's own apt repo,
+# started via the pre-existing START_DOCKER env var) — installing Debian's docker.io package
+# on top pulls in Debian's own containerd/runc, which apt refuses because they Conflict with
+# the base image's already-installed containerd.io.
 RUN install -d -m 0755 /etc/apt/keyrings && \
     curl -fsSLo /usr/share/keyrings/claude-desktop-archive-keyring.asc https://downloads.claude.ai/claude-desktop/key.asc && \
     curl -fsSLo /etc/apt/keyrings/claude-code.asc https://downloads.claude.ai/keys/claude-code.asc && \
@@ -127,7 +131,6 @@ RUN install -d -m 0755 /etc/apt/keyrings && \
         yamllint \
         qemu-system-x86 \
         ovmf \
-        docker.io \
         libseccomp2 \
         libcap-ng0 && \
     test -x /usr/bin/claude && \