diff --git a/packages/cli/src/serve/sandbox.test.ts b/packages/cli/src/serve/sandbox.test.ts
index 4b285e7f911..e38ed4e8f24 100644
--- a/packages/cli/src/serve/sandbox.test.ts
+++ b/packages/cli/src/serve/sandbox.test.ts
@@ -84,6 +84,9 @@ describe('start_sandbox', () => {
     await vi.waitFor(() => expect(spawnMock).toHaveBeenCalledTimes(2));
     const args = spawnMock.mock.calls[1]?.[1] as string[];
     const options = spawnMock.mock.calls[1]?.[2];
+    expect(args[args.indexOf('--hostname') + 1]).toBe(
+      args[args.indexOf('--name') + 1],
+    );
     const envFlagIndex = args.indexOf(PRIVATE_ACP_CAPABILITY_ENV);
     expect(args.slice(envFlagIndex - 1, envFlagIndex + 1)).toEqual([
       '--env',
@@ -108,6 +111,46 @@ describe('start_sandbox', () => {
     await expect(result).resolves.toBe(0);
   });
 
+  it('lets the runtime choose a hostname for image-ID containers', async () => {
+    vi.stubEnv('SANDBOX_SET_UID_GID', 'false');
+    vi.stubEnv('QWEN_CODE_WARNINGS_FILE', '');
+    vi.spyOn(fs, 'existsSync').mockReturnValue(true);
+    vi.spyOn(fs, 'realpathSync').mockImplementation((filePath) =>
+      String(filePath),
+    );
+    execSyncMock.mockReturnValue(Buffer.from(''));
+
+    const imageCheck = Object.assign(new EventEmitter(), {
+      stdout: new EventEmitter(),
+    });
+    const child = new EventEmitter();
+    spawnMock
+      .mockImplementationOnce(() => {
+        queueMicrotask(() => {
+          imageCheck.stdout.emit('data', Buffer.from('image-id'));
+          imageCheck.emit('close', 0);
+        });
+        return imageCheck;
+      })
+      .mockReturnValueOnce(child);
+
+    const result = start_sandbox(
+      { command: 'docker', image: `sha256:${'a'.repeat(64)}` },
+      [],
+      undefined,
+      [process.execPath, '/path/to/cli.js', '--acp'],
+    );
+
+    await vi.waitFor(() => expect(spawnMock).toHaveBeenCalledTimes(2));
+    const args = spawnMock.mock.calls[1]?.[1] as string[];
+    const containerName = args[args.indexOf('--name') + 1];
+    expect(containerName.length).toBeGreaterThan(64);
+    expect(args).not.toContain('--hostname');
+
+    child.emit('close', 0);
+    await expect(result).resolves.toBe(0);
+  });
+
   it('omits the warnings file environment variable when it is unset', async () => {
     vi.stubEnv('SANDBOX_SET_UID_GID', 'false');
     vi.stubEnv('QWEN_CODE_WARNINGS_FILE', '');
diff --git a/packages/cli/src/serve/sandbox.ts b/packages/cli/src/serve/sandbox.ts
index efd63a38e1f..e8cfb738e1f 100644
--- a/packages/cli/src/serve/sandbox.ts
+++ b/packages/cli/src/serve/sandbox.ts
@@ -654,7 +654,10 @@ export async function start_sandbox(
     containerName = `${imageName}-${randomBytes(4).toString('hex')}`;
     writeStderrLine(`ContainerName (regular): ${containerName}`);
   }
-  args.push('--name', containerName, '--hostname', containerName);
+  args.push('--name', containerName);
+  if (containerName.length <= 64) {
+    args.push('--hostname', containerName);
+  }
 
   // copy QWEN_CODE_TEST_VAR for integration tests
   if (process.env['QWEN_CODE_TEST_VAR']) {