diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 52a7da3..ea0e72e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -93,7 +93,10 @@ jobs:
           sleep 2
           arch-chroot root.x86_64/var/lib/machines/arch /bin/sh -c 'pkill aigpt'
           arch-chroot root.x86_64/var/lib/machines/arch /bin/sh -c 'if command -v sqlite3 &>/dev/null; then sqlite3 /root/.config/syui/ai/gpt/memory.db "PRAGMA journal_mode=WAL; PRAGMA synchronous=NORMAL;"; fi'
-          tar -zcvf aios-bootstrap.tar.gz root.x86_64/
+          cp -rf ./cfg/aios-ctl.zsh root.x86_64/var/lib/machines/arch/opt/aios-ctl.zsh
+          cp -rf ./cfg/install.sh ./install.sh
+          chmod +x ./install.sh
+          tar -zcvf aios-bootstrap.tar.gz root.x86_64/ install.sh
           tar -C ./root.x86_64 -c . | docker import - ${{ env.IMAGE_NAME }}
           echo "${{ env.DOCKER_TOKEN }}" | docker login -u syui --password-stdin
           docker push ${{ env.IMAGE_NAME }}
diff --git a/build.zsh b/build.zsh
index 2527618..9e7afc8 100755
--- a/build.zsh
+++ b/build.zsh
@@ -99,4 +99,11 @@ sleep 2
 arch-chroot root.x86_64/var/lib/machines/arch /bin/sh -c 'pkill aigpt'
 arch-chroot root.x86_64/var/lib/machines/arch /bin/sh -c 'if command -v sqlite3 &>/dev/null; then sqlite3 /root/.config/syui/ai/gpt/memory.db "PRAGMA journal_mode=WAL; PRAGMA synchronous=NORMAL;"; fi'
 
-tar -zcvf aios-bootstrap.tar.gz root.x86_64/
+# Copy aios-ctl.zsh for host machine control
+cp -rf ./cfg/aios-ctl.zsh root.x86_64/var/lib/machines/arch/opt/aios-ctl.zsh
+
+# Copy install script to root for easy access
+cp -rf ./cfg/install.sh ./install.sh
+chmod +x ./install.sh
+
+tar -zcvf aios-bootstrap.tar.gz root.x86_64/ install.sh
diff --git a/cfg/aios-ctl.zsh b/cfg/aios-ctl.zsh
new file mode 100644
index 0000000..41cfd30
--- /dev/null
+++ b/cfg/aios-ctl.zsh
@@ -0,0 +1,132 @@
+#!/bin/zsh
+# aios machine control commands
+
+NAME="aios"
+BACKUP="${NAME}back"
+
+# Start aios container
+function aios-start() {
+    sudo machinectl start $NAME
+}
+
+# Stop aios container
+function aios-stop() {
+    sudo machinectl poweroff $NAME > /dev/null 2>&1
+    sleep 2
+    sudo machinectl terminate $NAME > /dev/null 2>&1
+}
+
+# Shell into aios container
+function aios-shell() {
+    sudo machinectl shell $NAME
+}
+
+# Login to aios container
+function aios-login() {
+    sudo machinectl login $NAME
+}
+
+# Create backup of current aios
+function aios-backup() {
+    echo "Creating backup: $BACKUP"
+    sudo machinectl poweroff $BACKUP > /dev/null 2>&1
+    sleep 2
+    sudo machinectl terminate $BACKUP > /dev/null 2>&1
+    sleep 2
+    sudo machinectl remove $BACKUP > /dev/null 2>&1
+    sleep 2
+    sudo machinectl clone $NAME $BACKUP
+    echo "Backup created: $BACKUP"
+}
+
+# Reset aios from backup
+function aios-reset() {
+    if ! sudo machinectl list-images | grep -q $BACKUP; then
+        echo "Error: No backup found. Run 'aios-backup' first."
+        return 1
+    fi
+
+    echo "Resetting $NAME from $BACKUP..."
+    sudo machinectl poweroff $NAME > /dev/null 2>&1
+    sleep 2
+    sudo machinectl terminate $NAME > /dev/null 2>&1
+    sleep 2
+    sudo machinectl remove $NAME
+    sleep 2
+    sudo machinectl clone $BACKUP $NAME
+    sleep 2
+    sudo machinectl start $NAME
+    echo "Reset complete"
+}
+
+# Update packages in backup
+function aios-update() {
+    if ! sudo machinectl list-images | grep -q $BACKUP; then
+        echo "Error: No backup found. Run 'aios-backup' first."
+        return 1
+    fi
+
+    echo "Updating $BACKUP..."
+    sudo machinectl start $BACKUP
+    sleep 5
+    sudo machinectl shell $BACKUP /bin/sh -c 'pacman -Syu --noconfirm'
+    sleep 2
+    sudo machinectl poweroff $BACKUP
+    echo "Update complete"
+}
+
+# Remove aios container
+function aios-remove() {
+    echo "Removing $NAME..."
+    sudo machinectl poweroff $NAME > /dev/null 2>&1
+    sleep 2
+    sudo machinectl terminate $NAME > /dev/null 2>&1
+    sleep 2
+    sudo machinectl remove $NAME
+    echo "Removed $NAME"
+}
+
+# List all machines
+function aios-list() {
+    sudo machinectl list-images
+}
+
+# Show status
+function aios-status() {
+    sudo machinectl status $NAME
+}
+
+# Execute command in aios
+function aios-exec() {
+    if [ -z "$1" ]; then
+        echo "Usage: aios-exec <command>"
+        return 1
+    fi
+    sudo machinectl shell $NAME /bin/sh -c "$*"
+}
+
+# Show help
+function aios-help() {
+    cat <<'EOF'
+aios machine control commands:
+
+  aios-start      Start aios container
+  aios-stop       Stop aios container
+  aios-shell      Open shell in aios container
+  aios-login      Login to aios container console
+  aios-backup     Create backup snapshot (aiosback)
+  aios-reset      Reset aios from backup
+  aios-update     Update packages in backup
+  aios-remove     Remove aios container
+  aios-list       List all machine images
+  aios-status     Show aios status
+  aios-exec       Execute command in aios
+  aios-help       Show this help
+
+Example workflow:
+  1. aios-start          # Start container
+  2. aios-login          # Login and use
+  3. aios-backup         # Create backup before major changes
+  4. aios-reset          # Restore if something breaks
+EOF
+}
diff --git a/cfg/install.sh b/cfg/install.sh
new file mode 100644
index 0000000..c98ef80
--- /dev/null
+++ b/cfg/install.sh
@@ -0,0 +1,82 @@
+#!/bin/bash
+# aios installation script
+
+set -e
+
+NAME="aios"
+BACKUP="${NAME}back"
+TARBALL="aios-bootstrap.tar.gz"
+
+echo "=== aios installation ==="
+echo ""
+
+# Check if running as root
+if [ "$EUID" -ne 0 ]; then
+    echo "Error: This script must be run as root"
+    exit 1
+fi
+
+# Check if tarball exists
+if [ ! -f "$TARBALL" ]; then
+    echo "Error: $TARBALL not found"
+    echo "Please download aios-bootstrap.tar.gz first"
+    exit 1
+fi
+
+# Extract tarball
+echo "1. Extracting $TARBALL..."
+tar xf "$TARBALL"
+
+# Move to /var/lib/machines/
+echo "2. Installing to /var/lib/machines/$NAME..."
+rm -rf /var/lib/machines/$NAME
+mkdir -p /var/lib/machines
+mv root.x86_64/var/lib/machines/arch /var/lib/machines/$NAME
+
+# Copy nspawn configuration
+echo "3. Installing systemd-nspawn configuration..."
+mkdir -p /etc/systemd/nspawn
+cat > /etc/systemd/nspawn/$NAME.nspawn <<'EOF'
+[Exec]
+Boot=yes
+PrivateUsers=pick
+ResolvConf=copy-host
+
+[Files]
+Bind=%h/.config/syui/ai:/root/.config/syui/ai
+
+[Network]
+Private=yes
+VirtualEthernet=yes
+EOF
+
+# Enable systemd-machined
+echo "4. Enabling systemd-machined..."
+systemctl enable --now systemd-machined
+
+# Create initial backup
+echo "5. Creating initial backup image..."
+machinectl clone $NAME $BACKUP
+
+echo ""
+echo "=== Installation complete ==="
+echo ""
+echo "Next steps for each user:"
+echo "  1. Copy control script to your home:"
+echo "     cp /var/lib/machines/$NAME/opt/aios-ctl.zsh ~/.aios-ctl.zsh"
+echo ""
+echo "  2. Add to your .zshrc:"
+echo "     echo 'source ~/.aios-ctl.zsh' >> ~/.zshrc"
+echo "     source ~/.zshrc"
+echo ""
+echo "  3. Start aios:"
+echo "     aios-start"
+echo ""
+echo "  4. Login to aios:"
+echo "     aios-login"
+echo ""
+echo "Available commands:"
+echo "  aios-start, aios-stop, aios-shell, aios-login"
+echo "  aios-backup, aios-reset, aios-update"
+echo "  aios-help for full list"
+echo ""