Stage 1 (alpine/arm64) downloads the official Arch Linux ARM rootfs via curl — Docker caches this layer so it only runs once. Stage 2 (scratch) COPYs the extracted filesystem in, then builds OrionOS natively in that ALARM environment. Also fixes DisableSandbox placement (insert into [options] section via sed, not appended to file end where it lands in [aur] and is ignored). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>