diff --git a/docs/publish.md b/docs/publish.md
index 8306ffe..01cf167 100644
--- a/docs/publish.md
+++ b/docs/publish.md
@@ -278,6 +278,16 @@ meaningful. The workflow (§4.2) pulls `:latest` by default; if you need a
 release to be reproducible against an exact toolchain image, pin the `image:`
 line in `.gitea/workflows/release.yml` to the versioned tag instead.
 
+`run-image.sh` bind-mounts this repo straight into the container, so before
+each run it wipes generated build artifacts (`vice-src`, `vice-libs`,
+`nibtools-src`, `nibtools-libs`, `app/build`, `app/.cxx`, the watch app's
+`build/`) — otherwise leftovers from a previous local run would let
+`build_vice.sh`/`build_nibtools.sh` skip work a real fresh CI checkout always
+does, hiding bugs that only show up in CI. The container also runs as root
+(needed for the baked-in SDK/NDK/Gradle setup), so it chowns the whole repo
+back to your host user on exit — you shouldn't ever need `sudo` to clean up
+after it.
+
 ### 4.2 Runner setup (one-time)
 
 1. Enable Actions for the repo: repo Settings → Actions → enable, if not