docs: explain automatic jailer isolation in host setup

AGENTS.md

@@ -75,6 +75,10 @@ Rust workspace (`crates/*`) with the docs site under `docs/`.
 - Cron runs may overlap. Editing a crontab reschedules future runs; stopping or replacing its
   deployment cancels and drains active runs before the guest stops. Registry notifications and
   the next due time drive scheduling, without polling or catching up missed runs.
+- Every VMM cold boot and snapshot restore uses the matching embedded Firecracker jailer.
+  Installation reserves the locked nibrunner-jailer account's subordinate UID/GID ranges; startup
+  validates them. There is no jailer configuration or direct-launch fallback. Existing direct
+  VMMs may be readopted during an upgrade, but their snapshots cold boot when woken.
 - Docs site: Biome is strict — one parameter per function (`useMaxParams: 1`; wrap several in an
   object), no magic numbers, braces on every block, components declared with `function`, no barrel
   files, sorted Tailwind classes. `bun run fix:lint` and `bun run fix:format` in `docs/` apply

docs/content/docs/(docs)/getting-started/installation.mdx

@@ -34,6 +34,10 @@ The script:
 exist, it writes one: volumes as files on the local disk, plain HTTP on port 80, no object store,
 and `max_apps` set to what it measured the machine can hold. It does not start anything.
 
+The matching Firecracker jailer is bundled in `nibrunnerd`. Installation creates the locked
+`nibrunner-jailer` system account and reserves the host identities used by each app's VMM.
+This setup is automatic; there are no jailer settings in `config.toml`.
+
 <Callout title="Options">
   - `NIBRUNNER_VERSION=<tag>` before the command installs that release instead of the latest.
   - On a machine without `apt-get`, install `nftables`, `e2fsprogs`, `kmod`, `curl` and
@@ -70,3 +74,9 @@ journalctl -u nibrunnerd -f
 
 </Step>
 </Steps>
+
+## Upgrade an existing host
+
+After updating `nibrunnerd`, run `nibrunnerd install`, then `nibrunnerd start`. Existing microVMs
+keep serving until stopped or redeployed. Redeploy apps to move their next boot into a jail.
+Waking a snapshot from a direct launch cold boots the app while preserving its volume.

docs/content/docs/(docs)/index.mdx

@@ -5,8 +5,9 @@ description: What nibrunner is and how these docs are organized.
 
 nibrunner runs apps in Firecracker microVMs on one Linux machine. It is a single binary,
 `nibrunnerd`. You list the apps you want in a JSON file. The daemon boots each one in its own
-microVM and keeps it running. An app is not a container image. It is a binary, or a filesystem
-image, stacked as a [layer](/docs/guides/layers) on the Debian image the host ships.
+microVM and keeps it running. Each microVM runs through Firecracker's jailer with its own
+filesystem boundary and non-root host identity. An app is not a container image. It is a binary,
+or a filesystem image, stacked as a [layer](/docs/guides/layers) on the Debian image the host ships.
 
 ## Features