diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..52b3aaa
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,63 @@
+# Release notes
+
+## 1.0.0 — 2026-10-29
+
+Containers now run with rootless Podman instead of Docker.
+
+### Why
+
+Whoever can talk to `/var/run/docker.sock` is root on the host. A single
+`docker run --privileged -v /:/host` edits any file, including
+`/etc/shadow` and your SSH keys. Being in the `docker` group is therefore
+the same as having root, and an agent with that access leaves the project
+directory whenever it likes — the confinement this tool exists for holds
+only against accidents, not against a malicious tool call.
+
+Rootless Podman removes the shortcut: containers run inside a user
+namespace owned by you, and container root maps to a subordinate UID from
+`/etc/subuid` instead of to host root. Nothing outside your own file
+permissions is reachable, and the `docker` group is not needed at all.
+
+### Upgrading
+
+Rootless Podman has to work on the host first:
+
+```sh
+sudo pacman -S podman passt            # or slirp4netns
+grep "^$USER:" /etc/subuid /etc/subgid # expect an entry like 100000:65536
+podman info >/dev/null && echo ok
+```
+
+If the subuid/subgid entries are missing, add them with
+`usermod --add-subuids 100000-165535 --add-subgids 100000-165535 <user>`.
+
+Existing Docker containers and images are not reused. They are left
+untouched, and the first Podman run builds a fresh image
+(`localhost/agent-container:latest`).
+
+1. Rebuild the image with Podman:
+
+   ```sh
+   git pull
+   agent-container update
+   ```
+
+2. Remove the old Docker containers and image:
+
+   ```sh
+   docker ps -a --filter 'name=^ac-' --format '{{.Names}}' | xargs -r docker rm -f
+   docker rmi agent-container:latest
+   ```
+
+3. Use `pi`, `claude`, and `opencode` as before. The first run creates a
+   Podman container per project.
+
+4. Leave the `docker` group once nothing else on the machine needs the
+   socket as your user, then log out and in again:
+
+   ```sh
+   sudo gpasswd -d "$USER" docker
+   ```
+
+Your container home (`$XDG_DATA_HOME/agent-container/container-home`) is
+untouched: logins, settings, and history carry over.