Fix ARM64 Dockerfile: two-stage build from official ALARM tarball

Stage 1 (alpine/arm64) downloads the official Arch Linux ARM rootfs via
curl — Docker caches this layer so it only runs once. Stage 2 (scratch)
COPYs the extracted filesystem in, then builds OrionOS natively in that
ALARM environment.

Also fixes DisableSandbox placement (insert into [options] section via
sed, not appended to file end where it lands in [aur] and is ignored).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.dockerignore

@@ -9,3 +9,4 @@ launcher/skylauncher
 .DS_Store
 **/.DS_Store
 dist/
+iso/docker/alarm-aarch64.tar.gz

.gitignore

@@ -13,3 +13,4 @@ installer/orioninstall
 installer/orioninstall-gui
 launcher/orionlauncher
 wm/orionwm
+iso/docker/alarm-aarch64.tar.gz

build-iso-arm64.sh

@@ -1,9 +1,6 @@
 #!/usr/bin/env bash
 # OrionOS ARM64 ISO builder — for Apple Silicon Macs (runs natively, no emulation).
-# On Intel Macs, this uses QEMU arm64 emulation (much slower).
-#
-# Requirements: Docker Desktop with "Use Rosetta for x86_64/amd64 emulation" OFF
-#               (Rosetta emulation is for x86, not needed here)
+# First run downloads Arch Linux ARM rootfs (~300MB); cached by Docker afterwards.
 #
 # Usage:  ./build-iso-arm64.sh
 # Output: dist/orionos-arm64-<date>.iso
@@ -16,25 +13,16 @@ ISO_TAG="orionos-arm64-$(date +%Y%m%d)"
 
 # ── preflight ─────────────────────────────────────────────────────────
 if ! command -v docker &>/dev/null; then
-    echo ""
     echo "  Docker is not installed."
     echo "  Install Docker Desktop: https://www.docker.com/products/docker-desktop/"
     exit 1
 fi
 
 if ! docker info &>/dev/null; then
-    echo ""
     echo "  Docker is not running. Open Docker Desktop and re-run."
     exit 1
 fi
 
-# Ensure buildx is available (ships with Docker Desktop)
-if ! docker buildx version &>/dev/null; then
-    echo ""
-    echo "  docker buildx not found. Update Docker Desktop to a recent version."
-    exit 1
-fi
-
 echo ""
 echo "┌─────────────────────────────────────────────┐"
 echo "│       OrionOS ARM64 ISO Builder              │"
@@ -43,8 +31,8 @@ echo "└───────────────────────
 echo ""
 
 # ── build the builder image ───────────────────────────────────────────
-echo "Step 1/3: Building Docker image (ARM64, Arch Linux ARM base)"
-echo "          First run downloads ~400MB — cached afterwards."
+echo "Step 1/3: Building Docker image"
+echo "          First run downloads ALARM rootfs (~300MB) — cached afterwards."
 echo ""
 docker buildx build \
     --platform linux/arm64 \
@@ -93,9 +81,9 @@ echo "│    1. Open UTM → New VM → Virtualize                │"
 echo "│    2. Choose Linux → enable Apple Virtualization     │"
 echo "│    3. Boot ISO: select the file above               │"
 echo "│    4. Display: VirtIO GPU (recommended)             │"
-echo "│    5. Boot — OrionOS will auto-login as 'orion'     │"
+echo "│    5. Boot — OrionOS auto-logs in as 'orion'        │"
 echo "│                                                      │"
 echo "│  Copy-paste between macOS and VM:                    │"
-echo "│    spice-vdagent is pre-installed and auto-started  │"
+echo "│    spice-vdagent runs automatically on login        │"
 echo "└─────────────────────────────────────────────────────┘"
 echo ""

iso/docker/Dockerfile.arm64

@@ -1,19 +1,25 @@
 # OrionOS ARM64 ISO builder
-# Uses Arch Linux ARM as the base — runs natively on Apple Silicon.
-#
-# Build:  ./build-iso-arm64.sh   (wrapper handles docker buildx)
-# Output: dist/orionos-arm64-<date>.iso
+# Stage 1: alpine downloads the official Arch Linux ARM rootfs (~300MB, Docker-cached).
+# Stage 2: builds OrionOS natively inside that ALARM environment.
+# Runs natively on Apple Silicon — no QEMU emulation needed.
 
-FROM lopsided/archlinux:latest
+# ── Stage 1: fetch ALARM rootfs ───────────────────────────────────────
+FROM --platform=linux/arm64 alpine:3.20 AS alarm-fetch
+RUN apk add --no-cache curl
+RUN mkdir /alarm-root && \
+    curl -fL https://os.archlinuxarm.org/os/ArchLinuxARM-aarch64-latest.tar.gz | \
+    tar xzf - -C /alarm-root 2>/dev/null || true
 
-# disable pacman seccomp sandbox (breaks under QEMU / nested containers)
-RUN echo "DisableSandbox" >> /etc/pacman.conf
+# ── Stage 2: Arch Linux ARM build environment ─────────────────────────
+FROM --platform=linux/arm64 scratch
+COPY --from=alarm-fetch /alarm-root/ /
 
-# initialize pacman keys for ALARM
-RUN pacman-key --init && pacman-key --populate archlinuxarm 2>/dev/null || \
-    pacman-key --populate archlinux
+# Add DisableSandbox inside [options] (appending to file-end can land it
+# in a later section like [aur] where it is silently ignored)
+RUN sed -i '/^\[options\]/a DisableSandbox' /etc/pacman.conf
+
+RUN pacman-key --init && pacman-key --populate archlinuxarm
 
-# install build tools
 RUN pacman -Syu --noconfirm && \
     pacman -S --noconfirm \
         archiso \