diff --git a/build.zsh b/build.zsh
index 24f71f7..3455346 100755
--- a/build.zsh
+++ b/build.zsh
@@ -63,9 +63,9 @@ arch-chroot root.x86_64 /bin/sh -c 'npm i -g @anthropic-ai/claude-code'
 # Copy os-release
 cp -rf ./cfg/os-release root.x86_64/etc/os-release
 
-# Configure sudoers for wheel group
+# Configure sudoers for wheel group (full access for container operation)
 echo "Configuring sudoers..."
-arch-chroot root.x86_64 /bin/sh -c 'echo "%wheel ALL=(ALL:ALL) NOPASSWD: /usr/bin/pacman, /usr/bin/pacstrap, /usr/bin/arch-chroot, /usr/bin/rm, /usr/bin/mkdir, /usr/bin/mv, /usr/bin/cp, /usr/bin/poweroff, /usr/bin/reboot, /usr/bin/machinectl, /usr/bin/systemd-nspawn, /usr/bin/mount, /usr/bin/chroot, /bin/bash" >> /etc/sudoers'
+arch-chroot root.x86_64 /bin/sh -c 'echo "%wheel ALL=(ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers'
 
 # Install aigpt (aios core package)
 echo "Installing aigpt..."
diff --git a/cfg/install.sh b/cfg/install.sh
index a0c980b..d86ff55 100644
--- a/cfg/install.sh
+++ b/cfg/install.sh
@@ -11,6 +11,17 @@ tar xf "$TARBALL"
 mkdir -p /var/lib/machines
 mv root.x86_64 /var/lib/machines/$NAME
 
+# Create aios.nspawn for network access
+echo "Creating network configuration..."
+mkdir -p /etc/systemd/nspawn
+cat > /etc/systemd/nspawn/$NAME.nspawn <<'EOF'
+[Exec]
+Boot=yes
+
+[Network]
+Private=no
+EOF
+
 echo "=== Installation complete ==="
 echo ""
 echo "Usage:"
diff --git a/cfg/setup-user.sh b/cfg/setup-user.sh
index 68a7bcb..ae68f00 100755
--- a/cfg/setup-user.sh
+++ b/cfg/setup-user.sh
@@ -61,37 +61,24 @@ cp -rf ./cfg/zshrc $ROOTFS/root/.zshrc
 # Copy .zshrc for user 'ai'
 cp -rf ./cfg/zshrc $ROOTFS/home/ai/.zshrc
 
-# Add claude auto-start on login (once, not exec)
+# Add workspace auto-entry and claude auto-start
 cat >> $ROOTFS/home/ai/.zshrc <<'EOF'
 
-# Start claude on login (once)
+# aios: auto-enter workspace container
 if [[ -o login ]] && [[ -o interactive ]]; then
-    if command -v claude &>/dev/null; then
-        claude
+    if [[ -z "$INSIDE_WORKSPACE" ]]; then
+        # Enter workspace container
+        export INSIDE_WORKSPACE=1
+        exec sudo systemd-nspawn -q -D /var/lib/machines/workspace /bin/zsh
+    else
+        # Inside workspace - start claude with skip permissions
+        if command -v claude &>/dev/null; then
+            claude --dangerously-skip-permissions
+        fi
     fi
 fi
 EOF
 
 arch-chroot $ROOTFS /bin/sh -c 'chown ai:ai /home/ai/.zshrc'
 
-# Copy aios startup script
-cp -rf ./cfg/aios.zsh $ROOTFS/usr/local/bin/aios-startup
-arch-chroot $ROOTFS /bin/sh -c 'chmod +x /usr/local/bin/aios-startup'
-
-# Create default config directory and file for user 'ai'
-arch-chroot $ROOTFS /bin/sh -c 'mkdir -p /home/ai/.config/syui/ai/os'
-cat > $ROOTFS/home/ai/.config/syui/ai/os/config.json <<'EOF'
-{
-  "shell": false
-}
-EOF
-arch-chroot $ROOTFS /bin/sh -c 'chown -R ai:ai /home/ai/.config'
-
-# Update .zshrc to source startup script
-cat >> $ROOTFS/home/ai/.zshrc <<'EOF'
-
-# aios startup
-source /usr/local/bin/aios-startup
-EOF
-
 echo "✓ User setup complete"