diff --git a/router/Containerfile b/router/Containerfile
new file mode 100644
index 0000000..bf9a4b7
--- /dev/null
+++ b/router/Containerfile
@@ -0,0 +1,9 @@
+FROM artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3.22
+
+# hadolint ignore=DL3018
+RUN apk add --no-cache dnsmasq nginx nginx-mod-stream socat
+
+COPY start.sh /usr/local/bin/router-start
+COPY forwarder /usr/local/bin/forwarder
+# The launcher mounts the per-session config at /etc/router.
+ENTRYPOINT ["/usr/local/bin/router-start"]
diff --git a/router/forwarder b/router/forwarder
new file mode 100755
index 0000000..c0564f1
--- /dev/null
+++ b/router/forwarder
@@ -0,0 +1,10 @@
+#!/bin/sh
+# Loopback forwarders in the sandbox netns. FORWARDS holds
+# "bind:port:router:router_port" words.
+set -eu
+for fwd in $FORWARDS; do
+  # shellcheck disable=SC2046
+  set -- $(echo "$fwd" | tr : ' ')
+  socat "TCP-LISTEN:$2,bind=$1,fork,reuseaddr" "TCP:$3:$4" &
+done
+wait
diff --git a/router/start.sh b/router/start.sh
new file mode 100755
index 0000000..5e72ba9
--- /dev/null
+++ b/router/start.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+# Start the per-session router from the launcher's config in /etc/router.
+set -eu
+resolver=$(awk '/^nameserver/ {print $2; exit}' /etc/resolv.conf)
+sed "s/@RESOLVER@/$resolver/" /etc/router/nginx.conf >/tmp/nginx.conf
+dnsmasq --conf-file=/etc/router/dnsmasq.conf
+# ponytail: no supervisor; if dnsmasq dies the session loses DNS, restart the session.
+exec nginx -c /tmp/nginx.conf -g 'daemon off;'