diff --git a/build-cargo-dep.sh b/build-cargo-dep.sh
index c32e4f8ae..922dfbdf9 100755
--- a/build-cargo-dep.sh
+++ b/build-cargo-dep.sh
@@ -18,7 +18,7 @@ if [ -z "$ARCH" ]; then
 fi
 
 DOCKER_PLATFORM="linux/${ARCH}"
-if [ "$ARCH" = aarch64 ]; then
+if [ "$ARCH" = aarch64 ] || [ "$ARCH" = arm64 ]; then
 	DOCKER_PLATFORM="linux/arm64"
 elif [ "$ARCH" = x86_64 ]; then
 	DOCKER_PLATFORM="linux/amd64"
diff --git a/core/build-containerbox.sh b/core/build-containerbox.sh
index 850edf7be..e81efcc97 100755
--- a/core/build-containerbox.sh
+++ b/core/build-containerbox.sh
@@ -2,13 +2,17 @@
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
-set -e
+set -ea
 shopt -s expand_aliases
 
 if [ -z "$ARCH" ]; then
 	ARCH=$(uname -m)
 fi
 
+if [ "$ARCH" = "arm64" ]; then
+  ARCH="aarch64"
+fi
+
 USE_TTY=
 if tty -s; then
 	USE_TTY="-it"
@@ -26,4 +30,7 @@ alias 'rust-musl-builder'='docker run $USE_TTY --rm -e "RUSTFLAGS=$RUSTFLAGS" -v
 
 echo "FEATURES=\"$FEATURES\""
 echo "RUSTFLAGS=\"$RUSTFLAGS\""
-rust-musl-builder sh -c "cd core && cargo build --release --no-default-features --features container-runtime,$FEATURES --locked --bin containerbox --target=$ARCH-unknown-linux-musl && chown -R $UID:$UID target && chown -R $UID:$UID /root/.cargo"
\ No newline at end of file
+rust-musl-builder sh -c "cd core && cargo build --release --no-default-features --features container-runtime,$FEATURES --locked --bin containerbox --target=$ARCH-unknown-linux-musl"
+if [ "$(ls -nd core/target/$ARCH-unknown-linux-musl/release/containerbox | awk '{ print $3 }')" != "$UID" ]; then
+	rust-musl-builder sh -c "cd core && chown -R $UID:$UID target && chown -R $UID:$UID /root/.cargo"
+fi
\ No newline at end of file
diff --git a/core/build-registrybox.sh b/core/build-registrybox.sh
index 70445af62..3659b372a 100755
--- a/core/build-registrybox.sh
+++ b/core/build-registrybox.sh
@@ -2,13 +2,17 @@
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
-set -e
+set -ea
 shopt -s expand_aliases
 
 if [ -z "$ARCH" ]; then
 	ARCH=$(uname -m)
 fi
 
+if [ "$ARCH" = "arm64" ]; then
+  ARCH="aarch64"
+fi
+
 USE_TTY=
 if tty -s; then
 	USE_TTY="-it"
@@ -26,4 +30,7 @@ alias 'rust-musl-builder'='docker run $USE_TTY --rm -e "RUSTFLAGS=$RUSTFLAGS" -v
 
 echo "FEATURES=\"$FEATURES\""
 echo "RUSTFLAGS=\"$RUSTFLAGS\""
-rust-musl-builder sh -c "cd core && cargo build --release --no-default-features --features cli,registry,$FEATURES --locked --bin registrybox --target=$ARCH-unknown-linux-musl && chown -R $UID:$UID target && chown -R $UID:$UID /root/.cargo"
+rust-musl-builder sh -c "cd core && cargo build --release --no-default-features --features cli,registry,$FEATURES --locked --bin registrybox --target=$ARCH-unknown-linux-musl"
+if [ "$(ls -nd core/target/$ARCH-unknown-linux-musl/release/registrybox | awk '{ print $3 }')" != "$UID" ]; then
+	rust-musl-builder sh -c "cd core && chown -R $UID:$UID target && chown -R $UID:$UID /root/.cargo"
+fi
diff --git a/core/build-startbox.sh b/core/build-startbox.sh
index 872a2613e..9fad6fa3d 100755
--- a/core/build-startbox.sh
+++ b/core/build-startbox.sh
@@ -2,13 +2,17 @@
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
-set -e
+set -ea
 shopt -s expand_aliases
 
 if [ -z "$ARCH" ]; then
 	ARCH=$(uname -m)
 fi
 
+if [ "$ARCH" = "arm64" ]; then
+  ARCH="aarch64"
+fi
+
 USE_TTY=
 if tty -s; then
 	USE_TTY="-it"
@@ -26,4 +30,7 @@ alias 'rust-musl-builder'='docker run $USE_TTY --rm -e "RUSTFLAGS=$RUSTFLAGS" -v
 
 echo "FEATURES=\"$FEATURES\""
 echo "RUSTFLAGS=\"$RUSTFLAGS\""
-rust-musl-builder sh -c "cd core && cargo build --release --no-default-features --features cli,daemon,$FEATURES --locked --bin startbox --target=$ARCH-unknown-linux-musl && chown -R $UID:$UID target && chown -R $UID:$UID /root/.cargo"
\ No newline at end of file
+rust-musl-builder sh -c "cd core && cargo build --release --no-default-features --features cli,daemon,$FEATURES --locked --bin startbox --target=$ARCH-unknown-linux-musl"
+if [ "$(ls -nd core/target/$ARCH-unknown-linux-musl/release/startbox | awk '{ print $3 }')" != "$UID" ]; then
+	rust-musl-builder sh -c "cd core && chown -R $UID:$UID target && chown -R $UID:$UID /root/.cargo"
+fi
\ No newline at end of file
diff --git a/core/build-ts.sh b/core/build-ts.sh
index ddcf343ec..c9890bfe7 100755
--- a/core/build-ts.sh
+++ b/core/build-ts.sh
@@ -2,13 +2,17 @@
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
-set -e
+set -ea
 shopt -s expand_aliases
 
 if [ -z "$ARCH" ]; then
 	ARCH=$(uname -m)
 fi
 
+if [ "$ARCH" = "arm64" ]; then
+  ARCH="aarch64"
+fi
+
 USE_TTY=
 if tty -s; then
 	USE_TTY="-it"
@@ -26,4 +30,7 @@ alias 'rust-musl-builder'='docker run $USE_TTY --rm -e "RUSTFLAGS=$RUSTFLAGS" -v
 
 echo "FEATURES=\"$FEATURES\""
 echo "RUSTFLAGS=\"$RUSTFLAGS\""
-rust-musl-builder sh -c "cd core && cargo test --release --features=test,$FEATURES 'export_bindings_' && chown -R $UID:$UID startos/bindings && chown -R $UID:$UID target && chown -R $UID:$UID /root/.cargo"
\ No newline at end of file
+rust-musl-builder sh -c "cd core && cargo test --release --features=test,$FEATURES 'export_bindings_' && chown \$UID:\$UID startos/bindings"
+if [ "$(ls -nd core/startos/bindings | awk '{ print $3 }')" != "$UID" ]; then
+	rust-musl-builder sh -c "cd core && chown -R $UID:$UID startos/bindings && chown -R $UID:$UID target && chown -R $UID:$UID /root/.cargo"
+fi
\ No newline at end of file
diff --git a/core/install-cli.sh b/core/install-cli.sh
index 620600d92..b278947a3 100755
--- a/core/install-cli.sh
+++ b/core/install-cli.sh
@@ -2,14 +2,18 @@
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
-set -e
+set -ea
 shopt -s expand_aliases
 
 web="../web/dist/static"
 [ -d "$web" ] || mkdir -p "$web"
 
 if [ -z "$PLATFORM" ]; then
-  export PLATFORM=$(uname -m)
+  PLATFORM=$(uname -m)
+fi
+
+if [ "$PLATFORM" = "arm64" ]; then
+  PLATFORM="aarch64"
 fi
 
 cargo install --path=./startos --no-default-features --features=cli,docker,registry --bin start-cli --locked
diff --git a/core/run-tests.sh b/core/run-tests.sh
index 8bfe02b77..02ec34d55 100755
--- a/core/run-tests.sh
+++ b/core/run-tests.sh
@@ -2,13 +2,17 @@
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
-set -e
+set -ea
 shopt -s expand_aliases
 
 if [ -z "$ARCH" ]; then
 	ARCH=$(uname -m)
 fi
 
+if [ "$ARCH" = "arm64" ]; then
+  ARCH="aarch64"
+fi
+
 USE_TTY=
 if tty -s; then
 	USE_TTY="-it"
@@ -26,4 +30,7 @@ alias 'rust-musl-builder'='docker run $USE_TTY --rm -e "RUSTFLAGS=$RUSTFLAGS" -v
 
 echo "FEATURES=\"$FEATURES\""
 echo "RUSTFLAGS=\"$RUSTFLAGS\""
-rust-musl-builder sh -c "apt-get update && apt-get install -y rsync && cd core && cargo test --release --features=test,$FEATURES --workspace --locked --target=$ARCH-unknown-linux-musl -- --skip export_bindings_ && chown -R $UID:$UID target && chown -R $UID:$UID /root/.cargo"
\ No newline at end of file
+rust-musl-builder sh -c "apt-get update && apt-get install -y rsync && cd core && cargo test --release --features=test,$FEATURES --workspace --locked --target=$ARCH-unknown-linux-musl -- --skip export_bindings_ && chown \$UID:\$UID target"
+if [ "$(ls -nd core/target | awk '{ print $3 }')" != "$UID" ]; then
+	rust-musl-builder sh -c "cd core && chown -R $UID:$UID target && chown -R $UID:$UID /root/.cargo"
+fi
\ No newline at end of file
diff --git a/core/startos/Cargo.toml b/core/startos/Cargo.toml
index b5c81c56c..d0228ba31 100644
--- a/core/startos/Cargo.toml
+++ b/core/startos/Cargo.toml
@@ -39,7 +39,7 @@ path = "src/main.rs"
 
 [features]
 cli = []
-container-runtime = []
+container-runtime = ["procfs", "unshare"]
 daemon = []
 registry = []
 default = ["cli", "daemon"]
@@ -153,7 +153,7 @@ pbkdf2 = "0.12.2"
 pin-project = "1.1.3"
 pkcs8 = { version = "0.10.2", features = ["std"] }
 prettytable-rs = "0.10.0"
-procfs = "0.16.0"
+procfs = { version = "0.16.0", optional = true }
 proptest = "1.3.1"
 proptest-derive = "0.5.0"
 rand = { version = "0.8.5", features = ["std"] }
@@ -208,7 +208,7 @@ ts-rs = { git = "https://github.com/dr-bonez/ts-rs.git", branch = "feature/top-l
 typed-builder = "0.18.0"
 which = "6.0.3"
 unix-named-pipe = "0.2.0"
-unshare = "0.7.0"
+unshare = { version = "0.7.0", optional = true }
 url = { version = "2.4.1", features = ["serde"] }
 urlencoding = "2.1.3"
 uuid = { version = "1.4.1", features = ["v4"] }
diff --git a/core/startos/src/s9pk/v1/manifest.rs b/core/startos/src/s9pk/v1/manifest.rs
index 4a9956f9f..9b3eb9895 100644
--- a/core/startos/src/s9pk/v1/manifest.rs
+++ b/core/startos/src/s9pk/v1/manifest.rs
@@ -21,7 +21,7 @@ pub struct Manifest {
     #[serde(default)]
     pub git_hash: Option<GitHash>,
     pub title: String,
-    pub version: exver::emver::Version,
+    pub version: String,
     pub description: Description,
     #[serde(default)]
     pub assets: Assets,
diff --git a/core/startos/src/s9pk/v2/compat.rs b/core/startos/src/s9pk/v2/compat.rs
index 970cefb0c..8e62c69d0 100644
--- a/core/startos/src/s9pk/v2/compat.rs
+++ b/core/startos/src/s9pk/v2/compat.rs
@@ -1,5 +1,6 @@
 use std::collections::{BTreeMap, BTreeSet};
 use std::path::Path;
+use std::str::FromStr;
 use std::sync::Arc;
 
 use exver::{ExtendedVersion, VersionRange};
@@ -44,9 +45,9 @@ impl S9pk<TmpSource<PackSource>> {
         // manifest.json
         let manifest_raw = reader.manifest().await?;
         let manifest = from_value::<ManifestV1>(manifest_raw.clone())?;
-        let mut new_manifest = Manifest::from(manifest.clone());
+        let mut new_manifest = Manifest::try_from(manifest.clone())?;
 
-        let images: BTreeMap<ImageId, bool> = manifest
+        let images: BTreeSet<(ImageId, bool)> = manifest
             .package_procedures()
             .filter_map(|p| {
                 if let PackageProcedure::Docker(p) = p {
@@ -89,8 +90,6 @@ impl S9pk<TmpSource<PackSource>> {
 
         // images
         for arch in reader.docker_arches().await? {
-            let images_dir = tmp_dir.join("images").join(&arch);
-            tokio::fs::create_dir_all(&images_dir).await?;
             Command::new(CONTAINER_TOOL)
                 .arg("load")
                 .input(Some(&mut reader.docker_images(&arch).await?))
@@ -194,13 +193,18 @@ impl S9pk<TmpSource<PackSource>> {
     }
 }
 
-impl From<ManifestV1> for Manifest {
-    fn from(value: ManifestV1) -> Self {
+impl TryFrom<ManifestV1> for Manifest {
+    type Error = Error;
+    fn try_from(value: ManifestV1) -> Result<Self, Self::Error> {
         let default_url = value.upstream_repo.clone();
-        Self {
+        Ok(Self {
             id: value.id,
             title: value.title.into(),
-            version: ExtendedVersion::from(value.version).into(),
+            version: ExtendedVersion::from(
+                exver::emver::Version::from_str(&value.version)
+                    .with_kind(ErrorKind::Deserialization)?,
+            )
+            .into(),
             satisfies: BTreeSet::new(),
             release_notes: value.release_notes,
             can_migrate_from: VersionRange::any(),
@@ -246,6 +250,6 @@ impl From<ManifestV1> for Manifest {
             git_hash: value.git_hash,
             os_version: value.eos_version,
             has_config: value.config.is_some(),
-        }
+        })
     }
 }
diff --git a/core/startos/src/service/effects/mod.rs b/core/startos/src/service/effects/mod.rs
index 3ec77ef21..e85481e96 100644
--- a/core/startos/src/service/effects/mod.rs
+++ b/core/startos/src/service/effects/mod.rs
@@ -109,20 +109,16 @@ pub fn handler<C: Context>() -> ParentHandler<C> {
             ParentHandler::<C>::new()
                 .subcommand(
                     "launch",
-                    from_fn_blocking(subcontainer::launch::<ContainerCliContext>).no_display(),
+                    from_fn_blocking(subcontainer::launch).no_display(),
                 )
                 .subcommand(
                     "launch-init",
-                    from_fn_blocking(subcontainer::launch_init::<ContainerCliContext>).no_display(),
-                )
-                .subcommand(
-                    "exec",
-                    from_fn_blocking(subcontainer::exec::<ContainerCliContext>).no_display(),
+                    from_fn_blocking(subcontainer::launch_init).no_display(),
                 )
+                .subcommand("exec", from_fn_blocking(subcontainer::exec).no_display())
                 .subcommand(
                     "exec-command",
-                    from_fn_blocking(subcontainer::exec_command::<ContainerCliContext>)
-                        .no_display(),
+                    from_fn_blocking(subcontainer::exec_command).no_display(),
                 )
                 .subcommand(
                     "create-fs",
diff --git a/core/startos/src/service/effects/subcontainer/mod.rs b/core/startos/src/service/effects/subcontainer/mod.rs
index 86e77e196..0375ef6c2 100644
--- a/core/startos/src/service/effects/subcontainer/mod.rs
+++ b/core/startos/src/service/effects/subcontainer/mod.rs
@@ -8,9 +8,15 @@ use crate::rpc_continuations::Guid;
 use crate::service::effects::prelude::*;
 use crate::util::Invoke;
 
+#[cfg(feature = "container-runtime")]
 mod sync;
 
+#[cfg(not(feature = "container-runtime"))]
+mod sync_dummy;
+
 pub use sync::*;
+#[cfg(not(feature = "container-runtime"))]
+use sync_dummy as sync;
 
 #[derive(Debug, Deserialize, Serialize, Parser, TS)]
 #[serde(rename_all = "camelCase")]
diff --git a/core/startos/src/service/effects/subcontainer/sync.rs b/core/startos/src/service/effects/subcontainer/sync.rs
index 513d0b1e5..e18586a54 100644
--- a/core/startos/src/service/effects/subcontainer/sync.rs
+++ b/core/startos/src/service/effects/subcontainer/sync.rs
@@ -14,6 +14,7 @@ use tokio::sync::oneshot;
 use unshare::Command as NSCommand;
 
 use crate::service::effects::prelude::*;
+use crate::service::effects::ContainerCliContext;
 
 const FWD_SIGNALS: &[c_int] = &[
     SIGABRT, SIGALRM, SIGCONT, SIGHUP, SIGINT, SIGIO, SIGPIPE, SIGPROF, SIGQUIT, SIGTERM, SIGTRAP,
@@ -130,8 +131,8 @@ impl ExecParams {
     }
 }
 
-pub fn launch<C: Context>(
-    _: C,
+pub fn launch(
+    _: ContainerCliContext,
     ExecParams {
         env,
         workdir,
@@ -141,6 +142,8 @@ pub fn launch<C: Context>(
     }: ExecParams,
 ) -> Result<(), Error> {
     use unshare::{Namespace, Stdio};
+
+    use crate::service::cli::ContainerCliContext;
     let mut sig = signal_hook::iterator::Signals::new(FWD_SIGNALS)?;
     let mut cmd = NSCommand::new("/usr/bin/start-cli");
     cmd.arg("subcontainer").arg("launch-init");
@@ -262,7 +265,7 @@ pub fn launch<C: Context>(
     }
 }
 
-pub fn launch_init<C: Context>(_: C, params: ExecParams) -> Result<(), Error> {
+pub fn launch_init(_: ContainerCliContext, params: ExecParams) -> Result<(), Error> {
     nix::mount::mount(
         Some("proc"),
         &params.chroot.join("proc"),
@@ -281,8 +284,8 @@ pub fn launch_init<C: Context>(_: C, params: ExecParams) -> Result<(), Error> {
     }
 }
 
-pub fn exec<C: Context>(
-    _: C,
+pub fn exec(
+    _: ContainerCliContext,
     ExecParams {
         env,
         workdir,
@@ -384,6 +387,6 @@ pub fn exec<C: Context>(
     }
 }
 
-pub fn exec_command<C: Context>(_: C, params: ExecParams) -> Result<(), Error> {
+pub fn exec_command(_: ContainerCliContext, params: ExecParams) -> Result<(), Error> {
     params.exec()
 }
diff --git a/core/startos/src/service/effects/subcontainer/sync_dummy.rs b/core/startos/src/service/effects/subcontainer/sync_dummy.rs
new file mode 100644
index 000000000..285bdcbc1
--- /dev/null
+++ b/core/startos/src/service/effects/subcontainer/sync_dummy.rs
@@ -0,0 +1,30 @@
+use crate::service::effects::prelude::*;
+use crate::service::effects::ContainerCliContext;
+
+pub fn launch(_: ContainerCliContext) -> Result<(), Error> {
+    Err(Error::new(
+        eyre!("requires feature container-runtime"),
+        ErrorKind::InvalidRequest,
+    ))
+}
+
+pub fn launch_init(_: ContainerCliContext) -> Result<(), Error> {
+    Err(Error::new(
+        eyre!("requires feature container-runtime"),
+        ErrorKind::InvalidRequest,
+    ))
+}
+
+pub fn exec(_: ContainerCliContext) -> Result<(), Error> {
+    Err(Error::new(
+        eyre!("requires feature container-runtime"),
+        ErrorKind::InvalidRequest,
+    ))
+}
+
+pub fn exec_command(_: ContainerCliContext) -> Result<(), Error> {
+    Err(Error::new(
+        eyre!("requires feature container-runtime"),
+        ErrorKind::InvalidRequest,
+    ))
+}
diff --git a/web/patchdb-ui-seed.json b/web/patchdb-ui-seed.json
index 807483c3a..221b80a3b 100644
--- a/web/patchdb-ui-seed.json
+++ b/web/patchdb-ui-seed.json
@@ -21,5 +21,5 @@
   "ackInstructions": {},
   "theme": "Dark",
   "widgets": [],
-  "ack-welcome": "0.3.6-alpha.4"
+  "ack-welcome": "0.3.6-alpha.5"
 }