diff --git a/AGENTS.md b/AGENTS.md
index 3ee2af7d2..ede82f8bc 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -156,7 +156,7 @@ The codebase follows a modular architecture with clear separation of concerns:
 - **Firewall Exemption:** Allowed unrestricted outbound access via iptables rule `-s 172.30.0.10 -j ACCEPT`
 
 **Copilot Container** (`containers/copilot/`)
-- Based on `ubuntu:22.04` with iptables, curl, git, nodejs, npm, docker-cli
+- Based on `ghcr.io/actions/actions-runner:latest` (GitHub Actions Runner image) with additional packages: iptables, gnupg, dnsutils, net-tools, netcat, and Node.js 22
 - Mounts entire host filesystem at `/host` and user home directory for full access
 - Mounts Docker socket (`/var/run/docker.sock`) for docker-in-docker support
 - `NET_ADMIN` capability required for iptables manipulation
diff --git a/CLAUDE.md b/CLAUDE.md
index 6f55c87c5..8dc891d77 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -176,7 +176,7 @@ The codebase follows a modular architecture with clear separation of concerns:
 - **Firewall Exemption:** Allowed unrestricted outbound access via iptables rule `-s 172.30.0.10 -j ACCEPT`
 
 **Copilot Container** (`containers/copilot/`)
-- Based on `ubuntu:22.04` with iptables, curl, git, nodejs, npm, docker-cli
+- Based on `ghcr.io/actions/actions-runner:latest` (GitHub Actions Runner image) with additional packages: iptables, gnupg, dnsutils, net-tools, netcat, and Node.js 22
 - Mounts entire host filesystem at `/host` and user home directory for full access
 - Mounts Docker socket (`/var/run/docker.sock`) for docker-in-docker support
 - `NET_ADMIN` capability required for iptables manipulation
diff --git a/containers/copilot/Dockerfile b/containers/copilot/Dockerfile
index 693e6bf13..e2390b8a2 100644
--- a/containers/copilot/Dockerfile
+++ b/containers/copilot/Dockerfile
@@ -1,26 +1,29 @@
-FROM ubuntu:22.04
+FROM ghcr.io/actions/actions-runner:latest
 
-# Install required packages and Node.js 22
+# Switch to root to install packages
+USER root
+
+# Install required packages
+# Note: git, curl, and docker-ce-cli are already installed in the GitHub Runner image
 RUN apt-get update && \
+    # Install other required packages
     apt-get install -y --no-install-recommends \
     iptables \
-    curl \
-    ca-certificates \
-    git \
     gnupg \
     dnsutils \
     net-tools \
-    netcat-openbsd && \
-    # Install Node.js 22 from NodeSource
-    curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
-    apt-get install -y nodejs && \
-    # Install Docker CLI for MCP servers that run as containers
-    install -m 0755 -d /etc/apt/keyrings && \
-    curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc && \
-    chmod a+r /etc/apt/keyrings/docker.asc && \
-    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null && \
-    apt-get update && \
-    apt-get install -y docker-ce-cli && \
+    netcat-openbsd \
+    ca-certificates \
+    xz-utils && \
+    # Install Node.js 22 manually from official binaries
+    # Using --insecure due to SSL proxy in build environment
+    NODE_VERSION=22.13.0 && \
+    curl --insecure -fsSL https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz -o /tmp/node.tar.xz && \
+    tar -xJf /tmp/node.tar.xz -C /usr/local --strip-components=1 && \
+    rm /tmp/node.tar.xz && \
+    # Cleanup
+    apt-get remove -y xz-utils && \
+    apt-get autoremove -y && \
     rm -rf /var/lib/apt/lists/*
 
 # Copy iptables setup script and docker wrapper
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index e7f0102e0..d7c4cb39d 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -75,7 +75,7 @@ The firewall uses a containerized architecture with Squid proxy for L7 (HTTP/HTT
 - **Firewall Exemption:** Allowed unrestricted outbound access via iptables rule `-s 172.30.0.10 -j ACCEPT`
 
 ### Copilot Container (`containers/copilot/`)
-- Based on `ubuntu:22.04` with iptables, curl, git, nodejs, npm, docker-cli
+- Based on `ghcr.io/actions/actions-runner:latest` (GitHub Actions Runner image) with additional packages: iptables, gnupg, dnsutils, net-tools, netcat, and Node.js 22
 - Mounts entire host filesystem at `/host` and user home directory for full access
 - Mounts Docker socket (`/var/run/docker.sock`) for docker-in-docker support
 - `NET_ADMIN` capability required for iptables manipulation
diff --git a/package-lock.json b/package-lock.json
index bbdc3a8b3..076b69afb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,11 +1,11 @@
 {
-  "name": "@github/awf",
+  "name": "@github/agentic-workflow-firewall",
   "version": "0.1.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "@github/awf",
+      "name": "@github/agentic-workflow-firewall",
       "version": "0.1.1",
       "license": "MIT",
       "dependencies": {