diff --git a/docker/sandbox.Dockerfile b/docker/sandbox.Dockerfile
new file mode 100644
index 00000000..69c4da15
--- /dev/null
+++ b/docker/sandbox.Dockerfile
@@ -0,0 +1,25 @@
+FROM rust:1.86-slim-bookworm
+
+# Install build dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    bash \
+    ca-certificates \
+    curl \
+    git \
+    pkg-config \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install WASM targets
+RUN rustup target add wasm32-wasip2 wasm32-unknown-unknown
+
+# Install wasm-tools for component manipulation
+RUN cargo install wasm-tools --locked
+
+# Create non-root user for sandbox
+RUN useradd -m -u 1000 sandbox
+USER sandbox
+
+WORKDIR /workspace
+
+# Default command
+CMD ["bash"]