diff --git a/Dockerfile.orchestrator b/Dockerfile.orchestrator
index daa8129..e81ae3b 100644
--- a/Dockerfile.orchestrator
+++ b/Dockerfile.orchestrator
@@ -1,9 +1,10 @@
-# Orchestrator control-plane image (PRD 0070, #384).
+# Orchestrator control-plane image (PRD 0070, #384) + in-VM agent-image
+# builder (PRD 0069 Stage 3).
 #
 # The per-host orchestrator runs `python3 -m bot_bottle.orchestrator`.
 # The `bot_bottle` package is **stdlib-only** by design, so the control
-# plane needs nothing but a Python runtime — none of the gateway's
-# mitmproxy / git / gitleaks payload (that is the separate
+# plane itself needs nothing but a Python runtime — none of the
+# gateway's mitmproxy / git / gitleaks payload (that is the separate
 # `bot-bottle-gateway` image, Dockerfile.gateway). Splitting them keeps
 # the secret-dense control plane (it concentrates every bottle's egress
 # tokens — see PRD 0070's "secret concentration") on a minimal
@@ -17,9 +18,35 @@
 
 FROM python:3.12-slim
 
-# No third-party deps to install — stdlib only. Kept as an explicit,
-# self-documenting stage so a future confinement step (baking the
-# package, dropping the bind mount) has an obvious home.
+# --- in-VM agent-image builder (PRD 0069 Stage 3) -------------------
+# The Firecracker backend removes the host Docker daemon by building
+# users' agent Dockerfiles *inside the orchestrator VM* with buildah
+# (rootless, daemonless) instead of on the host. The host then needs no
+# Docker daemon and no root-equivalent `docker` group; an untrusted
+# Dockerfile builds inside the confined orchestrator VM, never on the
+# host — strictly more isolated than host `docker build`.
+#
+# `git` lets buildah resolve git-context builds and lets the backend
+# clone/pull; `ca-certificates` is needed for `FROM` pulls over TLS.
+# buildah's runtime helpers (stripped by --no-install-recommends, so
+# listed explicitly): `crun` is the OCI runtime that executes build
+# steps; `netavark` + `aardvark-dns` are the network backend buildah
+# uses to give `FROM` pulls and `RUN` steps network access.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      buildah crun netavark aardvark-dns git ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+
+# vfs storage + chroot isolation: buildah then needs neither
+# fuse-overlayfs / an overlay kernel module nor configured subuid maps
+# (newuidmap/newgidmap), so it works unconditionally as root in a
+# minimal microVM rootfs. vfs copies layers rather than stacking them —
+# slower and heavier than overlay; a build-cache optimization (overlay
+# where available, a persistent cache disk) is tracked for later.
+ENV STORAGE_DRIVER=vfs \
+    BUILDAH_ISOLATION=chroot
+
+# No third-party *Python* deps — the control plane stays stdlib only.
 WORKDIR /app
 
 # Documentation only; lifecycle.py overrides the entrypoint to