diff --git a/! b/!
new file mode 100644
index 0000000..8855f64
--- /dev/null
+++ b/!
@@ -0,0 +1 @@
+#!/bin/zsh /build.zsh
diff --git a/build.zsh b/build.zsh
index f98598c..5df4fc0 100755
--- a/build.zsh
+++ b/build.zsh
@@ -35,45 +35,45 @@ cp -rf ./scpt/mkarchiso ./archiso/archiso/mkarchiso
 
 # Extract and prepare
 tar xf aios-bootstrap*.tar.gz
-mkdir -p root.x86_64/var/lib/machines/aios
-pacstrap -c root.x86_64/var/lib/machines/aios base
+mkdir -p root.x86_64
+pacstrap -c root.x86_64 base
 
 # Configure pacman
 echo -e 'Server = http://mirrors.cat.net/archlinux/$repo/os/$arch
-Server = https://geo.mirror.pkgbuild.com/$repo/os/$arch' >> ./root.x86_64/var/lib/machines/aios/etc/pacman.d/mirrorlist
-sed -i s/CheckSpace/#CheckeSpace/ root.x86_64/var/lib/machines/aios/etc/pacman.conf
+Server = https://geo.mirror.pkgbuild.com/$repo/os/$arch' >> ./root.x86_64/etc/pacman.d/mirrorlist
+sed -i s/CheckSpace/#CheckeSpace/ root.x86_64/etc/pacman.conf
 
 # Initialize pacman keys
-arch-chroot root.x86_64/var/lib/machines/aios /bin/sh -c 'pacman-key --init'
-arch-chroot root.x86_64/var/lib/machines/aios /bin/sh -c 'pacman-key --populate archlinux'
+arch-chroot root.x86_64 /bin/sh -c 'pacman-key --init'
+arch-chroot root.x86_64 /bin/sh -c 'pacman-key --populate archlinux'
 
 # Install base packages (including systemd-container for machinectl)
-arch-chroot root.x86_64/var/lib/machines/aios /bin/sh -c 'pacman -Syu --noconfirm base base-devel linux vim git zsh rust openssh openssl jq go nodejs npm docker podman bc sqlite systemd arch-install-scripts'
+arch-chroot root.x86_64 /bin/sh -c 'pacman -Syu --noconfirm base base-devel linux vim git zsh rust openssh openssl jq go nodejs npm docker podman bc sqlite systemd arch-install-scripts'
 
 # Configure containers
-arch-chroot root.x86_64/var/lib/machines/aios /bin/sh -c 'mkdir -p /etc/containers/registries.conf.d'
-arch-chroot root.x86_64/var/lib/machines/aios /bin/sh -c 'curl -sL -o /etc/containers/registries.conf.d/ai.conf https://git.syui.ai/ai/os/raw/branch/main/cfg/ai.conf'
+arch-chroot root.x86_64 /bin/sh -c 'mkdir -p /etc/containers/registries.conf.d'
+arch-chroot root.x86_64 /bin/sh -c 'curl -sL -o /etc/containers/registries.conf.d/ai.conf https://git.syui.ai/ai/os/raw/branch/main/cfg/ai.conf'
 
 # Set default shell
-arch-chroot root.x86_64/var/lib/machines/aios /bin/sh -c 'chsh -s /bin/zsh'
+arch-chroot root.x86_64 /bin/sh -c 'chsh -s /bin/zsh'
 
 # Install Claude Code
-arch-chroot root.x86_64/var/lib/machines/aios /bin/sh -c 'npm i -g @anthropic-ai/claude-code'
+arch-chroot root.x86_64 /bin/sh -c 'npm i -g @anthropic-ai/claude-code'
 
 # Copy os-release
-cp -rf ./cfg/os-release root.x86_64/var/lib/machines/aios/etc/os-release
+cp -rf ./cfg/os-release root.x86_64/etc/os-release
 
 # Configure sudoers for wheel group
 echo "Configuring sudoers..."
-arch-chroot root.x86_64/var/lib/machines/aios /bin/sh -c 'echo "%wheel ALL=(ALL:ALL) NOPASSWD: /usr/bin/pacman, /usr/bin/pacstrap, /usr/bin/arch-chroot, /usr/bin/rm, /usr/bin/mkdir, /usr/bin/mv, /usr/bin/cp, /usr/bin/poweroff, /usr/bin/reboot, /usr/bin/machinectl, /bin/bash" >> /etc/sudoers'
+arch-chroot root.x86_64 /bin/sh -c 'echo "%wheel ALL=(ALL:ALL) NOPASSWD: /usr/bin/pacman, /usr/bin/pacstrap, /usr/bin/arch-chroot, /usr/bin/rm, /usr/bin/mkdir, /usr/bin/mv, /usr/bin/cp, /usr/bin/poweroff, /usr/bin/reboot, /usr/bin/machinectl, /bin/bash" >> /etc/sudoers'
 
 # Install aigpt (aios core package)
 echo "Installing aigpt..."
-arch-chroot root.x86_64/var/lib/machines/aios /bin/sh -c 'git clone https://git.syui.ai/ai/gpt && cd gpt && cargo build --release && cp -rf ./target/release/aigpt /bin/'
+arch-chroot root.x86_64 /bin/sh -c 'git clone https://git.syui.ai/ai/gpt && cd gpt && cargo build --release && cp -rf ./target/release/aigpt /bin/'
 
 # Install aibot (aios core package)
 echo "Installing aibot..."
-arch-chroot root.x86_64/var/lib/machines/aios /bin/sh -c 'git clone https://git.syui.ai/ai/bot && cd bot && cargo build && cp -rf ./target/debug/aibot /bin/ && aibot ai'
+arch-chroot root.x86_64 /bin/sh -c 'git clone https://git.syui.ai/ai/bot && cd bot && cargo build && cp -rf ./target/debug/aibot /bin/ && aibot ai'
 
 echo "✓ Arch Linux base complete"
 echo ""
@@ -92,6 +92,13 @@ echo ""
 bash ./cfg/setup-claude.sh
 echo ""
 
+# ============================================
+# 4. Create child containers (after all configuration)
+# ============================================
+
+bash ./cfg/user-continer.sh
+echo ""
+
 # ============================================
 # Finalize
 # ============================================
@@ -99,17 +106,13 @@ echo ""
 echo "=== Finalizing ==="
 
 # Copy aios-ctl.zsh for host machine control
-cp -rf ./cfg/aios-ctl.zsh root.x86_64/var/lib/machines/aios/opt/aios-ctl.zsh
-
-# Prepare directory for child containers (ai user will create them as needed)
-echo "Preparing directory for child containers..."
-mkdir -p root.x86_64/var/lib/machines/aios/var/lib/machines
+cp -rf ./cfg/aios-ctl.zsh root.x86_64/opt/aios-ctl.zsh
 
 # Copy install script
 cp -rf ./cfg/install.sh ./install.sh
 chmod +x ./install.sh
 
-# Create tarball with aios (ready for child containers)
+# Create tarball with aios (includes child containers)
 echo "Creating tarball..."
 tar -zcvf aios-bootstrap.tar.gz root.x86_64/ install.sh
 
diff --git a/cfg/init-containers.sh b/cfg/init-containers.sh
deleted file mode 100644
index 8a8dac8..0000000
--- a/cfg/init-containers.sh
+++ /dev/null
@@ -1,46 +0,0 @@
-#!/bin/bash
-# Initialize child containers for ai user
-# This script runs once on first login
-
-echo "=== Initializing workspace containers ==="
-echo "This may take a few minutes..."
-
-# Create workspace directory
-mkdir -p /tmp/workspace-init
-
-# Create base workspace
-echo "Creating workspace container..."
-sudo pacstrap -c /tmp/workspace-init base
-
-# Configure workspace
-sudo arch-chroot /tmp/workspace-init /bin/sh -c 'pacman -Syu --noconfirm vim git zsh openssh nodejs npm sqlite'
-
-# Add securetty for pts login
-sudo bash -c 'cat >> /tmp/workspace-init/etc/securetty <<EOF
-pts/0
-pts/1
-pts/2
-pts/3
-pts/4
-pts/5
-EOF'
-
-# Move to /var/lib/machines
-sudo mkdir -p /var/lib/machines
-sudo mv /tmp/workspace-init /var/lib/machines/workspace
-
-# Create restore-img as clean backup
-echo "Creating restore-img (backup)..."
-sudo cp -a /var/lib/machines/workspace /var/lib/machines/restore-img
-
-echo ""
-echo "✓ Initialization complete!"
-echo ""
-echo "Available containers:"
-echo "  workspace    - Working environment"
-echo "  restore-img  - Clean backup"
-echo ""
-echo "Usage:"
-echo "  sudo machinectl start workspace"
-echo "  sudo machinectl shell workspace"
-echo ""
diff --git a/cfg/install.sh b/cfg/install.sh
index b14230b..a0c980b 100644
--- a/cfg/install.sh
+++ b/cfg/install.sh
@@ -9,7 +9,7 @@ echo "=== aios installation ==="
 # Extract and install
 tar xf "$TARBALL"
 mkdir -p /var/lib/machines
-mv root.x86_64/var/lib/machines/aios /var/lib/machines/$NAME
+mv root.x86_64 /var/lib/machines/$NAME
 
 echo "=== Installation complete ==="
 echo ""
diff --git a/cfg/setup-claude.sh b/cfg/setup-claude.sh
index a0a2981..e6ae470 100755
--- a/cfg/setup-claude.sh
+++ b/cfg/setup-claude.sh
@@ -2,7 +2,7 @@
 # Claude Code MCP setup for aios
 # Configures MCP, sets up shared memory
 
-ROOTFS="root.x86_64/var/lib/machines/aios"
+ROOTFS="root.x86_64"
 
 echo "=== Claude MCP Setup ==="
 
@@ -45,4 +45,6 @@ sleep 2
 arch-chroot $ROOTFS /bin/sh -c 'pkill aigpt'
 arch-chroot $ROOTFS /bin/sh -c 'if command -v sqlite3 &>/dev/null; then sqlite3 /root/.config/syui/ai/gpt/memory.db "PRAGMA journal_mode=WAL; PRAGMA synchronous=NORMAL;"; fi'
 
+# Note: claude auto-start is configured in ai user's .zshrc (shared with workspace root via bind mount)
+
 echo "✓ Claude MCP setup complete"
diff --git a/cfg/setup-user.sh b/cfg/setup-user.sh
index 583faf7..5b5d014 100755
--- a/cfg/setup-user.sh
+++ b/cfg/setup-user.sh
@@ -2,7 +2,7 @@
 # User setup for aios
 # Creates ai user, configures auto-login, sudo, zshrc
 
-ROOTFS="root.x86_64/var/lib/machines/aios"
+ROOTFS="root.x86_64"
 
 echo "=== User Setup ==="
 
@@ -30,6 +30,22 @@ EOF
 echo "Enabling systemd-machined..."
 arch-chroot $ROOTFS /bin/sh -c 'systemctl enable systemd-machined'
 
+# Create workspace container configuration (bind ai user dir to container root)
+echo "Creating workspace container configuration..."
+mkdir -p $ROOTFS/etc/systemd/nspawn
+cat > $ROOTFS/etc/systemd/nspawn/workspace.nspawn <<'EOF'
+[Exec]
+Boot=yes
+PrivateUsers=pick
+ResolvConf=copy-host
+
+[Files]
+Bind=/home/ai:/root
+
+[Network]
+VirtualEthernet=no
+EOF
+
 # Setup auto-login for user 'ai'
 echo "Setting up auto-login..."
 arch-chroot $ROOTFS /bin/sh -c 'mkdir -p /etc/systemd/system/getty@tty1.service.d'
@@ -46,21 +62,9 @@ cp -rf ./cfg/zshrc $ROOTFS/root/.zshrc
 # Copy .zshrc for user 'ai'
 cp -rf ./cfg/zshrc $ROOTFS/home/ai/.zshrc
 
-# Copy container initialization script
-cp -rf ./cfg/init-containers.sh $ROOTFS/usr/local/bin/init-containers.sh
-arch-chroot $ROOTFS /bin/sh -c 'chmod +x /usr/local/bin/init-containers.sh'
-
-# Add initialization, MCP auto-setup and claude auto-start for ai user (login shell only)
+# Add workspace container auto-start and entry (shared .zshrc for ai user and workspace root)
 cat >> $ROOTFS/home/ai/.zshrc <<'EOF'
 
-# Initialize workspace containers on first login
-if [ ! -f ~/.aios-initialized ]; then
-    echo "First login detected. Initializing workspace containers..."
-    if command -v sudo &>/dev/null && [ -x /usr/local/bin/init-containers.sh ]; then
-        /usr/local/bin/init-containers.sh && touch ~/.aios-initialized
-    fi
-fi
-
 # MCP auto-setup (run once after .claude.json is created)
 if [[ -f ~/.claude.json ]] && ! grep -q '"aigpt"' ~/.claude.json 2>/dev/null; then
     if command -v claude &>/dev/null && command -v aigpt &>/dev/null; then
@@ -68,10 +72,19 @@ if [[ -f ~/.claude.json ]] && ! grep -q '"aigpt"' ~/.claude.json 2>/dev/null; th
     fi
 fi
 
-# Auto-start claude in interactive login shell
+# aios concept: container from start (ai user and workspace root share this .zshrc)
 if [[ -o login ]] && [[ -o interactive ]]; then
-    if command -v claude &>/dev/null; then
-        claude
+    if [[ -z "$INSIDE_WORKSPACE" ]]; then
+        # Running as ai user on aios OS - enter workspace container
+        export INSIDE_WORKSPACE=1
+        sudo machinectl start workspace 2>/dev/null || true
+        sleep 1
+        exec sudo machinectl shell workspace
+    else
+        # Running as root inside workspace container - start claude
+        if command -v claude &>/dev/null; then
+            claude
+        fi
     fi
 fi
 EOF
diff --git a/cfg/user-continer.sh b/cfg/user-continer.sh
new file mode 100644
index 0000000..e28245f
--- /dev/null
+++ b/cfg/user-continer.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+# Create child containers inside aios for ai user
+# Simply copy the aios itself as child containers
+
+ROOTFS="root.x86_64"
+
+echo "=== Creating child containers ==="
+
+# Create directory for child containers
+mkdir -p $ROOTFS/var/lib/machines
+
+# Copy aios as workspace
+echo "Creating workspace container..."
+cp -a $ROOTFS $ROOTFS/var/lib/machines/workspace
+
+# Copy aios as restore-img
+echo "Creating restore-img container..."
+cp -a $ROOTFS $ROOTFS/var/lib/machines/restore-img
+
+echo "✓ Child containers created"