refac

README.md

@@ -234,11 +234,19 @@ and advertise them as disabled in `/api/config`. Values `false`, `0`, and `no`
 (case-insensitive) disable the feature. Restart the server after changing these settings.
 Desktop support still requires its platform dependencies to be available.
 
-Chromium's sandbox is enabled by default, including in Docker. For a deployment
-that cannot support it, set `OPEN_TERMINAL_BROWSER_NO_SANDBOX=true` and restart the
-server. This applies to both managed Browser tabs and Chromium launched from the
-Linux Desktop in the Docker image. It disables Chromium's sandbox; the container's isolation remains
-unchanged. Values `true`, `1`, and `yes` (case-insensitive) enable this override.
+Chromium's sandbox is enabled by default outside Docker. All published Docker image
+variants set `OPEN_TERMINAL_BROWSER_NO_SANDBOX=true` so Browser can start under
+Docker's default security restrictions when Chromium is installed. This applies to
+both managed Browser tabs and Chromium launched from the Linux Desktop in the full
+Docker image. Container isolation remains unchanged, but Chromium's own sandbox
+no longer protects files and processes inside the container from a browser exploit.
+
+To enable Chromium's sandbox in Docker, pass
+`-e OPEN_TERMINAL_BROWSER_NO_SANDBOX=false` when creating the container; the runtime
+must permit Chromium's sandbox operations. Outside Docker, set the variable to
+`true` only if your deployment cannot support the sandbox. Values `true`, `1`, and
+`yes` (case-insensitive) disable the sandbox. Restart or recreate Open Terminal
+after changing this setting.
 
 > [!TIP]
 > Use the system config at `/etc/open-terminal/config.toml` to set site-wide defaults for host and port, and the user config for personal settings like the API key — this keeps the key out of `ps` / `htop`.