diff --git a/Tiltfile b/Tiltfile
index 1d593e57..06edc48b 100644
--- a/Tiltfile
+++ b/Tiltfile
@@ -71,12 +71,32 @@ docker_build("backend",
     ],
     dockerfile='./apps/backend/backend-dev.Dockerfile')
 
+# In-cluster registry (DEV / minikube)
+# -------------------------------------
+# No default_registry() call is needed here: the cluster is created by ctlptl
+# (see .devcontainer/post-start.sh -> `ctlptl create cluster minikube
+# --registry=ctlptl-registry`), which publishes the `local-registry-hosting`
+# ConfigMap in kube-public. Tilt auto-detects that and pushes all docker_build
+# images to the ctlptl registry; in-cluster pods pull them from
+# `ctlptl-registry:5000`. See kubernetes_init/registry/ for the rationale,
+# the declarative Registry manifest, and verification commands.
+
 # Build the runner
-docker_build("runner", 
-    context='./apps/runner', 
+docker_build("runner",
+    context='./apps/runner',
     dockerfile='./apps/runner/runner.Dockerfile',
     match_in_env_vars=True)
 
+# Build the runner base image (interpreter + dependency harness layers).
+# The Phase-2 Kaniko build layers user dependencies FROM this base and pushes the
+# result to the in-cluster registry. It is consumed via the backend Deployment's
+# RUNNER_BASE_IMAGE env var (match_in_env_vars below rewrites the bare `runner-base`
+# ref to the pushed image), which is what marks this image as used.
+docker_build("runner-base",
+    context='./apps/runner',
+    dockerfile='./apps/runner/runner-base.Dockerfile',
+    match_in_env_vars=True)
+
 # add a command that will run on tilt down to cleanup the pv's that are made by helm
 if config.tilt_subcommand == 'down':
     local("helm uninstall glados-mongodb")
diff --git a/apps/backend/app.py b/apps/backend/app.py
index 33b62125..2cf8cb9e 100644
--- a/apps/backend/app.py
+++ b/apps/backend/app.py
@@ -2,7 +2,7 @@
 import io
 import threading
 import base64
-from concurrent.futures import ProcessPoolExecutor
+from concurrent.futures import ThreadPoolExecutor
 import os
 from bson.binary import Binary
 from flask import Flask, Response, request, jsonify, send_file
@@ -11,13 +11,18 @@
 from modules.mongo import upload_experiment_aggregated_results, upload_experiment_zip, upload_log_file, verify_mongo_connection, check_insert_default_experiments, download_experiment_file, get_experiment, update_exp_value
 
 from spawn_runner import create_job, create_job_object
+from build_image import build_experiment_image
 flaskApp = Flask(__name__)
 
 config.load_incluster_config()
 BATCH_API = client.BatchV1Api()
+CORE_API = client.CoreV1Api()
 
-MAX_WORKERS = 1
-executor = ProcessPoolExecutor(MAX_WORKERS)
+# Experiment submission runs the (possibly long) build + Job spawn off the request
+# thread. Threads (not processes) so the shared k8s clients above are reused and
+# no experiment payload needs pickling.
+MAX_WORKERS = int(os.getenv("MAX_WORKERS", "4"))
+executor = ThreadPoolExecutor(MAX_WORKERS)
 
 # Mongo Setup
 # create the mongo client
@@ -58,12 +63,46 @@ def get_queue():
 def recv_experiment():
     """The query to run an experiment"""
     data = request.get_json()
-    executor.submit(spawn_job, data)
+    future = executor.submit(spawn_job, data)
+    future.add_done_callback(_log_spawn_result)
     return Response(status=200)
 
+def _log_spawn_result(future):
+    """Surface exceptions raised by the background spawn_job worker.
+
+    ThreadPoolExecutor stores a worker's exception on the Future and never
+    re-raises it, so without this callback a failed experiment launch (e.g. an
+    image build error or a Kubernetes API 403) would vanish silently -- the
+    /experiment request has already returned 200 by the time it runs.
+    """
+    error = future.exception()
+    if error is not None:
+        flaskApp.logger.error("Experiment launch failed in background worker", exc_info=error)
+
 def spawn_job(experiment_data):
-    """Function for creating a job"""
-    job = create_job_object(experiment_data)
+    """Build the per-experiment image (if dependencies are declared) then spawn the runner Job.
+
+    The /experiment payload only carries the experiment id, so the declared
+    dependencies are read from MongoDB and attached before building. If that
+    lookup fails or no dependencies are declared, build_experiment_image returns
+    None and create_job_object falls back to the default runner image (unchanged
+    behaviour for experiments without declared dependencies).
+    """
+    try:
+        stored = get_experiment(experiment_data['experiment']['id'], mongoClient)
+        experiment_data['experiment']['pipRequirements'] = stored.get('pipRequirements')
+        experiment_data['experiment']['aptPackages'] = stored.get('aptPackages')
+    except Exception:
+        # Non-fatal: fall back to the default runner image (no per-experiment build),
+        # but log it so a Mongo/lookup problem is visible rather than silent.
+        flaskApp.logger.warning(
+            "Could not read declared dependencies for experiment %s; proceeding without a per-experiment image",
+            experiment_data.get('experiment', {}).get('id'),
+            exc_info=True,
+        )
+
+    image_override = build_experiment_image(experiment_data, BATCH_API, CORE_API)
+    job = create_job_object(experiment_data, image_override=image_override)
     create_job(BATCH_API, job)
     
 @flaskApp.post("/cancelExperiment")
diff --git a/apps/backend/build_image.py b/apps/backend/build_image.py
new file mode 100644
index 00000000..d3f3c627
--- /dev/null
+++ b/apps/backend/build_image.py
@@ -0,0 +1,249 @@
+"""Phase 2: per-experiment image build orchestration.
+
+When an experiment declares dependencies, the backend builds a small image
+FROM the runner base image with those pip/apt dependencies layered on top, via
+an in-cluster Kaniko Job, and pushes it to the in-cluster registry. The backend
+then spawns the runner Job FROM the built image (see spawn_runner.py).
+
+Key design points:
+- **Backward compatible:** ``build_experiment_image`` returns ``None`` when the
+  experiment declares no dependencies, so the caller falls back to the existing
+  ``IMAGE_RUNNER`` image and behaviour is unchanged for current experiments.
+- **Cached by content:** the built image tag is a hash of the base image plus
+  the rendered build context, so identical dependency sets are built once and
+  reused (the registry is checked before building).
+
+Input contract (populated by the frontend in Phase 1, read defensively here):
+  experiment_data['experiment']['pipRequirements'] : str  -> requirements.txt contents
+  experiment_data['experiment']['aptPackages']     : list[str] | str -> apt packages
+"""
+import hashlib
+import os
+import time
+
+import requests
+import yaml
+from kubernetes import client, config
+from kubernetes.client.rest import ApiException
+
+# ---- Configuration (env-overridable; defaults target the dev/minikube registry) ----
+REGISTRY_HOST = os.getenv("REGISTRY_HOST", "ctlptl-registry:5000")
+RUNNER_BASE_IMAGE = os.getenv("RUNNER_BASE_IMAGE", f"{REGISTRY_HOST}/runner-base:latest")
+# The dev ctlptl registry serves plain HTTP; production (TLS) should set this false.
+REGISTRY_INSECURE = os.getenv("REGISTRY_INSECURE", "true").lower() in ("1", "true", "yes")
+EXP_IMAGE_REPO = os.getenv("EXP_IMAGE_REPO", "glados-exp")
+BUILD_NAMESPACE = os.getenv("BUILD_NAMESPACE", "default")
+KANIKO_BUILD_TIMEOUT_SECONDS = int(os.getenv("KANIKO_BUILD_TIMEOUT_SECONDS", "900"))
+
+BUILDER_TEMPLATE_PATH = os.path.join(os.path.dirname(__file__), "job-builder.yaml")
+
+
+def _normalize_apt_packages(apt_packages):
+    """Accept a list or a whitespace/newline-separated string, return a clean list."""
+    if not apt_packages:
+        return []
+    if isinstance(apt_packages, str):
+        return [pkg for pkg in apt_packages.split() if pkg]
+    return [str(pkg).strip() for pkg in apt_packages if str(pkg).strip()]
+
+
+def render_dockerfile(pip_requirements, apt_packages):
+    """Render the build Dockerfile from the declared dependencies.
+
+    Returns ``(dockerfile_text, context_files)`` where context_files is a dict of
+    filename -> contents that must be present in the build context.
+    """
+    apt_list = _normalize_apt_packages(apt_packages)
+    lines = [f"FROM {RUNNER_BASE_IMAGE}"]
+    context_files = {}
+
+    if apt_list:
+        context_files["apt-packages.txt"] = "\n".join(apt_list) + "\n"
+        lines += [
+            "COPY apt-packages.txt /tmp/apt-packages.txt",
+            "RUN apt-get update && "
+            "xargs -a /tmp/apt-packages.txt apt-get install -y --no-install-recommends && "
+            "rm -rf /var/lib/apt/lists/*",
+        ]
+
+    if pip_requirements and pip_requirements.strip():
+        context_files["requirements.txt"] = pip_requirements
+        lines += [
+            "COPY requirements.txt /tmp/requirements.txt",
+            "RUN pip install --no-cache-dir -r /tmp/requirements.txt",
+        ]
+
+    dockerfile_text = "\n".join(lines) + "\n"
+    context_files["Dockerfile"] = dockerfile_text
+    return dockerfile_text, context_files
+
+
+def _content_tag(context_files):
+    """Deterministic image tag from the base image + full build context."""
+    digest = hashlib.sha256()
+    digest.update(RUNNER_BASE_IMAGE.encode("utf-8"))
+    for name in sorted(context_files):
+        digest.update(b"\0")
+        digest.update(name.encode("utf-8"))
+        digest.update(b"\0")
+        digest.update(context_files[name].encode("utf-8"))
+    return digest.hexdigest()[:16]
+
+
+def image_exists(tag):
+    """Return True if EXP_IMAGE_REPO:tag already exists in the registry."""
+    scheme = "http" if REGISTRY_INSECURE else "https"
+    url = f"{scheme}://{REGISTRY_HOST}/v2/{EXP_IMAGE_REPO}/manifests/{tag}"
+    headers = {
+        "Accept": "application/vnd.docker.distribution.manifest.v2+json, "
+                  "application/vnd.oci.image.manifest.v1+json"
+    }
+    try:
+        resp = requests.get(url, headers=headers, timeout=10)
+        return resp.status_code == 200
+    except requests.RequestException:
+        # Treat an unreachable registry as "not cached"; the build will surface the real error.
+        return False
+
+
+def _kaniko_args(destination):
+    args = [
+        "--dockerfile=/workspace/Dockerfile",
+        "--context=dir:///workspace",
+        f"--destination={destination}",
+        "--verbosity=info",
+    ]
+    if REGISTRY_INSECURE:
+        args += ["--insecure", "--insecure-pull", "--skip-tls-verify", "--skip-tls-verify-pull"]
+    return args
+
+
+def _build_job_body(job_name, configmap_name, destination):
+    with open(BUILDER_TEMPLATE_PATH, encoding="utf-8") as template_file:
+        body = yaml.safe_load(template_file)
+    body["metadata"]["name"] = job_name
+    spec = body["spec"]["template"]["spec"]
+    spec["containers"][0]["args"] = _kaniko_args(destination)
+    for volume in spec["volumes"]:
+        if volume["name"] == "cm":
+            volume["configMap"]["name"] = configmap_name
+    return body
+
+
+def _delete_configmap(core_api, name):
+    try:
+        core_api.delete_namespaced_config_map(name, BUILD_NAMESPACE)
+    except ApiException as err:
+        if err.status != 404:
+            raise
+
+
+def _delete_job(batch_api, name):
+    try:
+        batch_api.delete_namespaced_job(name, BUILD_NAMESPACE, propagation_policy="Background")
+    except ApiException as err:
+        if err.status != 404:
+            raise
+
+
+def _wait_for_job(batch_api, job_name, timeout_seconds):
+    """Poll the build Job until it completes or fails. Returns 'Complete'/'Failed'/'Timeout'."""
+    deadline = time.time() + timeout_seconds
+    while time.time() < deadline:
+        # read_namespaced_job (not ..._status): the full Job carries .status and only
+        # needs the "jobs" get permission, avoiding the separate jobs/status subresource.
+        status = batch_api.read_namespaced_job(job_name, BUILD_NAMESPACE).status
+        for condition in (status.conditions or []):
+            if condition.type == "Complete" and condition.status == "True":
+                return "Complete"
+            if condition.type == "Failed" and condition.status == "True":
+                return "Failed"
+        time.sleep(3)
+    return "Timeout"
+
+
+def _kaniko_logs(core_api, job_name):
+    """Best-effort fetch of the kaniko container logs for diagnostics."""
+    try:
+        pods = core_api.list_namespaced_pod(
+            BUILD_NAMESPACE, label_selector=f"job-name={job_name}"
+        )
+        if not pods.items:
+            return "(no build pod found)"
+        pod_name = pods.items[0].metadata.name
+        logs = core_api.read_namespaced_pod_log(pod_name, BUILD_NAMESPACE, container="kaniko")
+        return "\n".join(logs.splitlines()[-20:])
+    except ApiException:
+        return "(could not read build logs)"
+
+
+def build_experiment_image(experiment_data, batch_api, core_api):
+    """Build (or reuse) the per-experiment image and return its full reference.
+
+    Returns ``None`` when the experiment declares no dependencies, signalling the
+    caller to use the default runner image (unchanged current behaviour).
+    """
+    experiment = experiment_data.get("experiment", {})
+    pip_requirements = experiment.get("pipRequirements")
+    apt_packages = experiment.get("aptPackages")
+
+    if not (pip_requirements and pip_requirements.strip()) and not _normalize_apt_packages(apt_packages):
+        # No declared dependencies -> nothing to build; use the default runner image.
+        return None
+
+    _, context_files = render_dockerfile(pip_requirements, apt_packages)
+    tag = _content_tag(context_files)
+    destination = f"{REGISTRY_HOST}/{EXP_IMAGE_REPO}:{tag}"
+
+    # Cache hit: identical dependency set already built.
+    if image_exists(tag):
+        return destination
+
+    exp_id = experiment.get("id", tag)
+    job_name = f"builder-{exp_id}"
+    configmap_name = f"builder-ctx-{exp_id}"
+
+    # Clean any leftovers from a previous attempt for this experiment.
+    _delete_job(batch_api, job_name)
+    _delete_configmap(core_api, configmap_name)
+
+    configmap = client.V1ConfigMap(
+        metadata=client.V1ObjectMeta(name=configmap_name),
+        data=context_files,
+    )
+    core_api.create_namespaced_config_map(BUILD_NAMESPACE, configmap)
+    batch_api.create_namespaced_job(
+        BUILD_NAMESPACE, _build_job_body(job_name, configmap_name, destination)
+    )
+
+    try:
+        result = _wait_for_job(batch_api, job_name, KANIKO_BUILD_TIMEOUT_SECONDS)
+        if result != "Complete":
+            logs = _kaniko_logs(core_api, job_name)
+            raise RuntimeError(
+                f"Image build for experiment {exp_id} did not complete ({result}). "
+                f"Kaniko logs (tail):\n{logs}"
+            )
+        return destination
+    finally:
+        _delete_configmap(core_api, configmap_name)
+        _delete_job(batch_api, job_name)
+
+
+def _ensure_config():
+    """Load in-cluster config when running as a pod, else fall back to local kubeconfig."""
+    try:
+        config.load_incluster_config()
+    except config.ConfigException:
+        config.load_kube_config()
+
+
+if __name__ == "__main__":
+    # Local smoke test against the current kube context (e.g. from the devcontainer):
+    #   python build_image.py
+    _ensure_config()
+    _batch = client.BatchV1Api()
+    _core = client.CoreV1Api()
+    _data = {"experiment": {"id": "localtest", "pipRequirements": "cowsay==6.1\n"}}
+    print("Building test image...")
+    print("Built image reference:", build_experiment_image(_data, _batch, _core))
diff --git a/apps/backend/job-builder.yaml b/apps/backend/job-builder.yaml
new file mode 100644
index 00000000..8894bf7d
--- /dev/null
+++ b/apps/backend/job-builder.yaml
@@ -0,0 +1,48 @@
+# Template for the per-experiment image BUILD Job (Phase 2).
+#
+# The backend (build_image.py) loads this, fills in the Job/ConfigMap names and
+# the Kaniko args (destination + insecure flags), and creates it. A Kaniko Job
+# builds a small image FROM the runner base with the user's declared pip/apt
+# dependencies layered on top, and pushes it to the in-cluster registry. The
+# backend then spawns the runner Job (job-runner.yaml) FROM the built image.
+#
+# The initContainer stages the build context from a ConfigMap into an emptyDir
+# using `cp -L`: ConfigMap volumes expose their files as symlinks, and Kaniko's
+# COPY would otherwise copy a dangling symlink (verified during the Phase 2
+# spike). Kaniko must see real files.
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: builder  # replaced by build_image.py
+  namespace: default
+spec:
+  backoffLimit: 0
+  ttlSecondsAfterFinished: 600
+  template:
+    metadata:
+      labels:
+        app: GLADOS-builder
+    spec:
+      restartPolicy: Never
+      initContainers:
+      - name: stage-context
+        image: busybox:1.36
+        command: ["sh", "-c", "cp -L /cm/* /workspace/ && ls -la /workspace"]
+        volumeMounts:
+        - name: cm
+          mountPath: /cm
+        - name: context
+          mountPath: /workspace
+      containers:
+      - name: kaniko
+        image: gcr.io/kaniko-project/executor:latest
+        args: []  # replaced by build_image.py (dockerfile/context/destination + insecure flags)
+        volumeMounts:
+        - name: context
+          mountPath: /workspace
+      volumes:
+      - name: cm
+        configMap:
+          name: builder-context  # replaced by build_image.py
+      - name: context
+        emptyDir: {}
diff --git a/apps/backend/job-runner.yaml b/apps/backend/job-runner.yaml
index 7212a09f..d40ef11c 100644
--- a/apps/backend/job-runner.yaml
+++ b/apps/backend/job-runner.yaml
@@ -14,7 +14,47 @@ spec:
         image: gladospipeline/glados-runner:main
         imagePullPolicy: Always
         command: []
+        # The runner executes untrusted user-submitted code. It runs non-root
+        # (enforced by the pod securityContext below) with a read-only root
+        # filesystem; all writes go to the emptyDir volumes mounted at /work
+        # (the working dir) and /tmp. Dependencies are baked into the image at
+        # build time, so nothing is installed at runtime.
+        workingDir: /work
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts:
+        - name: work
+          mountPath: /work
+        - name: tmp
+          mountPath: /tmp
+        # Bound resource usage so a single experiment cannot starve its node.
+        # Tune these to your workloads; too-low limits will kill legitimate runs
+        # (the memory limit in particular triggers an OOM-kill).
+        #
+        # NOTE: no CPU *limit* is set on purpose. A hard CPU limit is enforced via
+        # the cgroup CFS quota (cpu.cfs_quota_us), which the WSL2 kernel used by
+        # the minikube dev environment rejects with EINVAL ("invalid argument"),
+        # crashing the pod at container init. The CPU *request* below still gives
+        # the scheduler fair-share weighting, and the memory limit is what
+        # actually protects the node from a runaway untrusted experiment. If you
+        # deploy on a cluster whose kernel supports CFS quota, you can add a
+        # `cpu:` under limits here.
+        resources:
+          requests:
+            cpu: "250m"
+            memory: "256Mi"
+          limits:
+            memory: "10Gi"
         env:
+        # Writable HOME on the tmp volume (the root filesystem is read-only).
+        - name: HOME
+          value: /tmp
         - name: MONGODB_PORT
           valueFrom:
             secretKeyRef:
@@ -30,6 +70,18 @@ spec:
             secretKeyRef:
               name: secret-env
               key: GMAIL_CREDS
+      # Run as a non-root user; fsGroup makes the emptyDir volumes group-writable
+      # so the process can write to /work and /tmp under readOnlyRootFilesystem.
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      volumes:
+      - name: work
+        emptyDir: {}
+      - name: tmp
+        emptyDir: {}
       restartPolicy: Never
   backoffLimit: 4
   ttlSecondsAfterFinished: 60
diff --git a/apps/backend/spawn_runner.py b/apps/backend/spawn_runner.py
index 6e417ce7..199d6d0d 100644
--- a/apps/backend/spawn_runner.py
+++ b/apps/backend/spawn_runner.py
@@ -10,19 +10,29 @@
 batch_v1 = client.BatchV1Api()
 RUNNER_PATH = "./job-runner.yaml"
 
-def create_job_object(experiment_data):
-    """Function that creates the job object for the runner"""
+def create_job_object(experiment_data, image_override=None):
+    """Function that creates the job object for the runner.
+
+    If image_override is provided (a per-experiment image built with the user's
+    declared dependencies, see build_image.py), the runner Job runs from it.
+    Otherwise the behaviour is unchanged: the IMAGE_RUNNER env image is used if
+    set, else the default image baked into job-runner.yaml.
+    """
     # Configure Pod template container
     job_name = "runner-" + experiment_data['experiment']['id']
-    
-    job_command = ["python3", "runner.py", json.dumps(experiment_data)]
+
+    # Absolute path: the runner Job sets workingDir to a writable volume (/work),
+    # so the script must be referenced by its baked-in location under /app.
+    job_command = ["python3", "/app/runner.py", json.dumps(experiment_data)]
 
     runner_body = get_yaml_file_body(RUNNER_PATH)
 
     runner_body['metadata']['name'] = job_name
     runner_body['spec']['template']['spec']['containers'][0]['command'] = job_command
-    
-    if os.getenv("IMAGE_RUNNER"):
+
+    if image_override:
+        runner_body['spec']['template']['spec']['containers'][0]['image'] = image_override
+    elif os.getenv("IMAGE_RUNNER"):
         # Get the image name
         image_name = str(os.getenv("IMAGE_RUNNER"))
         runner_body['spec']['template']['spec']['containers'][0]['image'] = image_name
diff --git a/apps/frontend/app/components/flows/AddExperiment/NewExperiment.tsx b/apps/frontend/app/components/flows/AddExperiment/NewExperiment.tsx
index 4df63494..5749938d 100644
--- a/apps/frontend/app/components/flows/AddExperiment/NewExperiment.tsx
+++ b/apps/frontend/app/components/flows/AddExperiment/NewExperiment.tsx
@@ -124,6 +124,8 @@ const NewExperiment = ({ formState, setFormState, copyID, setCopyId, isDefault,
 			status: 'CREATED',
 			experimentExecutable: '',
 			configFileFormat: '',
+			pipRequirements: '',
+			aptPackages: '',
 		},
 		validate: joiResolver(experimentSchema),
 	});
@@ -156,7 +158,9 @@ const NewExperiment = ({ formState, setFormState, copyID, setCopyId, isDefault,
 								file: newFileId,
 								status: 'CREATED',
 								experimentExecutable: expInfo['experimentExecutable'],
-								configFileFormat: expInfo['configFileFormat']
+								configFileFormat: expInfo['configFileFormat'],
+								pipRequirements: expInfo['pipRequirements'] ?? '',
+								aptPackages: expInfo['aptPackages'] ?? ''
 							});
 							setCopyId(null);
 							setStatus(FormStates.Info);
@@ -183,7 +187,9 @@ const NewExperiment = ({ formState, setFormState, copyID, setCopyId, isDefault,
 								file: expInfo['file'],
 								status: 'CREATED',
 								experimentExecutable: expInfo['experimentExecutable'],
-								configFileFormat: expInfo['configFileFormat']
+								configFileFormat: expInfo['configFileFormat'],
+								pipRequirements: expInfo['pipRequirements'] ?? '',
+								aptPackages: expInfo['aptPackages'] ?? ''
 							});
 							setFileId(expInfo['file']);
 							setCopyId(null);
@@ -233,7 +239,9 @@ const NewExperiment = ({ formState, setFormState, copyID, setCopyId, isDefault,
 			status: 'CREATED',
 			sendEmail: expInfo['sendEmail'],
 			experimentExecutable: expInfo['experimentExecutable'],
-			configFileFormat: expInfo['configFileFormat']
+			configFileFormat: expInfo['configFileFormat'],
+			pipRequirements: expInfo['pipRequirements'] ?? '',
+			aptPackages: expInfo['aptPackages'] ?? ''
 		});
 
 		setCopyId(null);
diff --git a/apps/frontend/app/components/flows/AddExperiment/stepComponents/InformationStep.tsx b/apps/frontend/app/components/flows/AddExperiment/stepComponents/InformationStep.tsx
index 124f2891..bdb236ef 100644
--- a/apps/frontend/app/components/flows/AddExperiment/stepComponents/InformationStep.tsx
+++ b/apps/frontend/app/components/flows/AddExperiment/stepComponents/InformationStep.tsx
@@ -163,6 +163,26 @@ export const InformationStep = ({ form, validationErrors, setValidationErrors, .
                         />
                     </div>
                 </InputSection>
+                <InputSection header={'Python Dependencies (requirements.txt)'}>
+                    <div className='sm:col-span-4'>
+                        <textarea
+                            {...form.getInputProps('pipRequirements')}
+                            rows={4}
+                            placeholder={'One pip requirement per line, e.g.\nnumpy==1.26.4\nscipy'}
+                            className='block w-full rounded-md border border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm font-mono'
+                        />
+                    </div>
+                </InputSection>
+                <InputSection header={'System Packages (apt)'}>
+                    <div className='sm:col-span-4'>
+                        <textarea
+                            {...form.getInputProps('aptPackages')}
+                            rows={2}
+                            placeholder={'apt package names, separated by spaces or newlines, e.g.\nffmpeg libgomp1'}
+                            className='block w-full rounded-md border border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm font-mono'
+                        />
+                    </div>
+                </InputSection>
                 <InputSection header={'Config File Format'}>
                     <Menu as='div' className='relative' ref={configMenuRef}>
                         <Menu.Button 
diff --git a/apps/frontend/lib/db_types.ts b/apps/frontend/lib/db_types.ts
index eaf0eec0..66b11731 100644
--- a/apps/frontend/lib/db_types.ts
+++ b/apps/frontend/lib/db_types.ts
@@ -96,4 +96,9 @@ export interface ExperimentData {
     totalExperimentRuns: number;
     experimentExecutable: string;
     configFileFormat: string;
+    // Optional dependency manifests: layered into a per-experiment image at build
+    // time (see backend build_image.py). pipRequirements is requirements.txt
+    // contents; aptPackages is whitespace/newline-separated apt package names.
+    pipRequirements?: string;
+    aptPackages?: string;
 }
diff --git a/apps/runner/modules/data/experiment.py b/apps/runner/modules/data/experiment.py
index a5bef64d..53707279 100644
--- a/apps/runner/modules/data/experiment.py
+++ b/apps/runner/modules/data/experiment.py
@@ -36,6 +36,12 @@ class ExperimentData(BaseModel):
     postProcess = False
     configFileFormat : str
 
+    # Optional dependency manifests declared by the user. These are layered into a
+    # per-experiment image at build time by the backend (see build_image.py); the
+    # runner does not need to act on them directly.
+    pipRequirements: Optional[str] = None
+    aptPackages: Optional[str] = None
+
     hyperparameters: Dict[str, Parameter]
     configs = {}  #Will be set Later
 
diff --git a/apps/runner/modules/runner.py b/apps/runner/modules/runner.py
index c3c3acd9..7a74b6d2 100644
--- a/apps/runner/modules/runner.py
+++ b/apps/runner/modules/runner.py
@@ -18,9 +18,27 @@
 PROCESS_OUT_STREAM = 0
 PROCESS_ERROR_STREAM = 1
 
+# Environment variables that are safe to expose to user-submitted trial code.
+# User experiments are untrusted and run as a subprocess, so they must NOT
+# inherit the runner's full environment: doing so leaks the secrets injected
+# into the runner pod (GMAIL_CREDS, MONGODB_PORT, BACKEND_PORT, etc.) to
+# arbitrary uploaded code. We pass through only the variables actually needed to
+# locate and launch interpreters/binaries; everything else is withheld.
+_TRIAL_ENV_ALLOWLIST = ('PATH', 'HOME', 'LANG', 'LC_ALL', 'LC_CTYPE', 'TZ', 'TMPDIR', 'JAVA_OPTS')
+
 explogger = get_experiment_logger()
 
 
+def _build_trial_env():
+    """Build a sanitized environment for user-submitted trial subprocesses.
+
+    Returns a copy of the runner's environment restricted to
+    ``_TRIAL_ENV_ALLOWLIST`` so untrusted trial code cannot read the runner's
+    injected secrets.
+    """
+    return {key: os.environ[key] for key in _TRIAL_ENV_ALLOWLIST if key in os.environ}
+
+
 def _get_data(process: 'Popen[str]', trialRun: int, trialTimeout: int):
     try:
         data = process.communicate(timeout=trialTimeout)
@@ -55,15 +73,18 @@ def _run_trial(experiment: ExperimentData, config_path: str, trialRun: int):
     # set the paths
     os.mkdir(f'trial{trialRun}')
     os.chdir(f'trial{trialRun}')
+    # Untrusted user code: run with a sanitized environment so it cannot read
+    # the runner's secrets (see _build_trial_env).
+    trial_env = _build_trial_env()
     if experiment.experimentType == ExperimentType.PYTHON:
-        with Popen(['python', "../" + experiment.file, config_path], stdout=PIPE, stdin=PIPE, stderr=PIPE, encoding='utf8') as process:
+        with Popen(['python', "../" + experiment.file, config_path], stdout=PIPE, stdin=PIPE, stderr=PIPE, encoding='utf8', env=trial_env) as process:
             _get_data(process, trialRun, experiment.timeout)
     elif experiment.experimentType == ExperimentType.JAVA:
-        with Popen(['java', '-jar', "../" + experiment.file, config_path], stdout=PIPE, stdin=PIPE, stderr=PIPE, encoding='utf8') as process:
+        with Popen(['java', '-jar', "../" + experiment.file, config_path], stdout=PIPE, stdin=PIPE, stderr=PIPE, encoding='utf8', env=trial_env) as process:
             _get_data(process, trialRun, experiment.timeout)
     elif experiment.experimentType == ExperimentType.C:
-        Popen(['chmod', '+x', "../" + experiment.file], stdout=PIPE, stdin=PIPE, stderr=PIPE, encoding='utf8')
-        with Popen(['../' + experiment.file, config_path], stdout=PIPE, stdin=PIPE, stderr=PIPE, encoding='utf8') as process:
+        Popen(['chmod', '+x', "../" + experiment.file], stdout=PIPE, stdin=PIPE, stderr=PIPE, encoding='utf8', env=trial_env)
+        with Popen(['../' + experiment.file, config_path], stdout=PIPE, stdin=PIPE, stderr=PIPE, encoding='utf8', env=trial_env) as process:
             _get_data(process, trialRun, experiment.timeout)
 
 
diff --git a/apps/runner/runner-base.Dockerfile b/apps/runner/runner-base.Dockerfile
new file mode 100644
index 00000000..1150fc76
--- /dev/null
+++ b/apps/runner/runner-base.Dockerfile
@@ -0,0 +1,54 @@
+# syntax=docker/dockerfile:1
+#
+# glados-runner-base
+# ------------------
+# Phase 0 of the registry / base-image split (DEV / minikube only).
+#
+# This image captures the slow-changing "harness" layers of the runner:
+#   * the python:3.9 interpreter
+#   * system interpreters / libraries the runner needs at exec time
+#       - libmagic1     (file-type identification via bytes)
+#       - default-jdk   (running user-submitted Java / .jar targets)
+#   * the runner's own Python dependencies (from Pipfile / Pipfile.lock)
+#   * the runner harness source itself (COPY . /app)
+#
+# It is intentionally a faithful mirror of runner.Dockerfile's `base` +
+# `python_dependencies` stages. It deliberately does NOT add or remove any
+# runtime dependency-install behaviour -- that logic lives in runner.py and is
+# out of scope until Phase 3.
+#
+# In a later phase a build-time Kaniko Job will build FROM this base image,
+# layer the user-submitted Python dependencies on top, and push the result to
+# the in-cluster registry (see kubernetes_init/registry/). runner.Dockerfile is
+# left untouched and continues to build the current runner image on its own, so
+# nothing here changes the existing build.
+
+FROM python:3.9 AS base
+
+# Keeps Python from generating .pyc files in the container
+ENV PYTHONDONTWRITEBYTECODE=1
+
+# Turns off buffering for easier container logging
+ENV PYTHONUNBUFFERED=1
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        # For file type identification via bytes
+        libmagic1 \
+        # Provides Java (JDK 11) for running user-submitted jar targets
+        default-jdk
+
+# Ability to pass in JVM options
+ARG JAVA_OPTS
+ENV JAVA_OPTS=$JAVA_OPTS
+
+FROM base AS python_dependencies
+# Copy in python requirements definitions and install the runner's own deps.
+RUN pip install pipenv
+COPY Pipfile .
+COPY Pipfile.lock .
+
+RUN pipenv install --system --deploy --ignore-pipfile
+
+WORKDIR /app
+COPY . /app
diff --git a/apps/runner/runner.py b/apps/runner/runner.py
index a89c82b8..9abf6d38 100644
--- a/apps/runner/runner.py
+++ b/apps/runner/runner.py
@@ -2,7 +2,6 @@
 import os
 import shutil
 import logging
-import subprocess
 import sys
 import json
 import time
@@ -66,39 +65,8 @@ def run_batch_and_catch_exceptions(data: IncomingStartRequest):
         # Unsafe to upload experiment logs files here
         raise err
 
-def install_packages(file_path):
-    try:
-        # Read the packages from the file
-        with open(file_path, "r") as file:
-            packages = file.read().splitlines()
-
-        if not packages:
-            explogger.info("No packages to install.")
-            return
-
-        # Update the package list
-        explogger.info("Updating package list...")
-        subprocess.run(["apt-get", "update"], check=True)
-
-        # Install the packages
-        explogger.info("Installing packages...")
-        subprocess.run(["apt-get", "install", "-y"] + packages, check=True)
-        
-        # Update cache
-        explogger.info("Updating cache...")
-        subprocess.run(["ldconfig"], check=True)
-
-        explogger.info("Packages installed successfully!")
-    except subprocess.CalledProcessError as e:
-        explogger.error(f"Error occurred while running a command: {e}")
-    except FileNotFoundError:
-        explogger.error(f"File '{file_path}' not found.")
-    except Exception as e:
-        explogger.error(f"An unexpected error occurred: {e}")
-
 
 def run_batch(data: IncomingStartRequest):
-    fileWasZip = False
     syslogger.info('Run_Batch starting with data %s', data)
 
     # Obtain most basic experiment info
@@ -170,36 +138,13 @@ def run_batch(data: IncomingStartRequest):
             close_experiment_run(exp_id)
             return
     
-    if experiment.creatorRole == "admin" or experiment.creatorRole == "privileged":
-        explogger.info("User is admin or privileged, installing packages from packages.txt")
-        
-        if os.path.exists("packages.txt"):
-            try:
-                install_packages("packages.txt")
-            except Exception as err:
-                explogger.error("Failed to install packages")
-                explogger.exception(err)
-                os.chdir('../..')
-                close_experiment_run(exp_id)
-        
-        explogger.info("User is admin or privileged, running commands from commandsToRun.txt")
-            
-        if os.path.exists("commandsToRun.txt"):
-            for line in open("commandsToRun.txt"):
-                try:
-                    os.system(line)
-                except Exception as err:
-                    explogger.error(f"Failed to run command: {line}")
-                    explogger.exception(err)
-                    os.chdir('../..')
-                    close_experiment_run(exp_id)
-                    return        
-            
-    # this needs to happen after all dependencies are installed
+    # Dependencies are baked into the per-experiment image at build time (see
+    # backend build_image.py); the runner installs nothing at runtime. This is
+    # required for the hardened runner (non-root + readOnlyRootFilesystem) and
+    # removes the former admin apt-get / arbitrary-command install paths.
     if experiment.experimentType == ExperimentType.ZIP:
         # Recalc the file type
         try:
-            fileWasZip = True
             experiment.experimentType = determine_experiment_file_type(experiment.experimentExecutable)
             # also update experiment.file
             experiment.file = experiment.experimentExecutable
@@ -211,34 +156,6 @@ def run_batch(data: IncomingStartRequest):
             close_experiment_run(exp_id)
             return
       
-    # If it is a python file get the pipreqs
-    if experiment.experimentType == ExperimentType.PYTHON:
-        try:
-            # if the file exists, skip running the command
-            if not os.path.exists("userProvidedFileReqs.txt"):
-                if fileWasZip:
-                    os.system(f"pipreqs --savepath userProvidedFileReqs.txt .")
-                else:
-                    os.system(f"pipreqs --savepath userProvidedFileReqs.txt ExperimentFiles/{exp_id}")
-                explogger.info("Generated pip requirements")
-        except Exception as err:
-            explogger.error("Failed to generate pip requirements")
-            explogger.exception(err)
-            os.chdir('../..')
-            close_experiment_run(exp_id)
-            return
-
-    # check if the new requirements exists
-    if os.path.exists("userProvidedFileReqs.txt"):
-        # do pip install -r userProvidedFileReqs.txt
-        try:
-            os.system(f"pip install -r userProvidedFileReqs.txt")
-        except Exception as err:
-            explogger.error("Failed to install pip requirements")
-            explogger.exception(err)
-            os.chdir('../..')
-            close_experiment_run(exp_id)
-            return
 
     explogger.info(f"Generating configs and downloading to ExperimentFiles/{exp_id}/configFiles")
 
diff --git a/kubernetes_init/backend/cluster-role-job-creator.yaml b/kubernetes_init/backend/cluster-role-job-creator.yaml
index 5c271f87..b603e8f9 100644
--- a/kubernetes_init/backend/cluster-role-job-creator.yaml
+++ b/kubernetes_init/backend/cluster-role-job-creator.yaml
@@ -4,9 +4,14 @@ metadata:
   name: job-creator
   namespace: default
 rules:
+# get/list/watch added so the backend can poll the Kaniko build Job to completion (Phase 2)
 - apiGroups: ["batch"]
   resources: ["jobs"]
-  verbs: ["create", "delete"]
+  verbs: ["create", "delete", "get", "list", "watch"]
+# configmaps: the backend stages the Kaniko build context in a ConfigMap (Phase 2)
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["create", "delete", "get"]
 - apiGroups: [""]
   resources: ["pods"]
   verbs: ["get", "list", "watch"]
diff --git a/kubernetes_init/registry/README.md b/kubernetes_init/registry/README.md
new file mode 100644
index 00000000..639a4167
--- /dev/null
+++ b/kubernetes_init/registry/README.md
@@ -0,0 +1,97 @@
+# In-cluster registry (DEV / minikube)
+
+Phase 0 of the runner registry / base-image split. This directory documents the
+private, in-cluster container registry that the dev stack uses so that a future
+Kaniko build Job can push runner images and runner Jobs can pull them — all
+without touching public Docker Hub.
+
+## Decision: use the existing ctlptl registry
+
+The dev cluster **already ships an in-cluster registry**, and it is the cleanest
+possible integration with the existing Tilt flow, so Phase 0 adopts it rather
+than introducing a second registry.
+
+`.devcontainer/post-start.sh` creates the cluster with:
+
+```bash
+ctlptl create cluster minikube --registry=ctlptl-registry
+```
+
+[ctlptl](https://github.com/tilt-dev/ctlptl) (a Tilt-team tool that is already
+installed and used in this repo) does three things for us:
+
+1. Runs a `registry:2` container named `ctlptl-registry` and joins it to the
+   `minikube` docker network, so the cluster node can reach it.
+2. Publishes a `local-registry-hosting` ConfigMap in the `kube-public`
+   namespace — the [KEP-1755](https://github.com/kubernetes/enhancements/tree/master/keps/sig-cluster-lifecycle/generic/1755-communicating-a-local-registry)
+   discovery standard:
+
+   ```yaml
+   data:
+     localRegistryHosting.v1: |
+       host: localhost:<random-port>       # push target from the dev host / Tilt
+       hostFromClusterNetwork: ctlptl-registry:5000   # pull target for in-cluster pods
+       hostFromContainerRuntime: ctlptl-registry:5000
+   ```
+
+3. Because Tilt reads that ConfigMap automatically, **`docker_build` pushes are
+   already redirected to this registry with no `default_registry` line needed**,
+   and image refs in the k8s manifests are rewritten to the in-cluster address.
+
+### Why not the alternatives?
+
+- **`minikube addons enable registry`** — spins up a *separate* registry plus an
+  `HTTPS`/proxy shim, and it does **not** publish the `local-registry-hosting`
+  ConfigMap. Tilt would keep pushing to the ctlptl registry, so we'd have two
+  registries fighting and manual `default_registry` wiring to reconcile them.
+- **A hand-rolled `Deployment` + `Service` (+ `PVC`) here** — same problem: Tilt
+  auto-detects the ctlptl registry, so a second registry would sit unused unless
+  we override discovery, and it would duplicate infrastructure ctlptl already
+  manages (network joining, insecure-registry trust on the node, teardown).
+
+The ctlptl registry is the Tilt-native path and is already wired end to end, so
+Phase 0 simply makes the decision explicit (this doc + `registry.yaml`) instead
+of adding redundant infrastructure.
+
+## Files
+
+- `registry.yaml` — declarative ctlptl `Registry` resource that reproduces what
+  `post-start.sh` creates imperatively. Apply/reconcile with
+  `ctlptl apply -f kubernetes_init/registry/registry.yaml` (idempotent).
+
+## Verify it is reachable in-cluster
+
+```bash
+# 1. The discovery ConfigMap exists and points pods at ctlptl-registry:5000
+kubectl get configmap -n kube-public local-registry-hosting \
+  -o jsonpath='{.data.localRegistryHosting\.v1}'
+
+# 2. The registry container is on the minikube network (node can resolve it)
+docker network inspect minikube \
+  --format '{{range .Containers}}{{.Name}} {{.IPv4Address}}{{"\n"}}{{end}}'
+
+# 3. ctlptl agrees the registry is running
+ctlptl get registry ctlptl-registry
+
+# 4. End-to-end push + in-cluster pull smoke test
+HOSTPORT=$(kubectl get configmap -n kube-public local-registry-hosting \
+  -o jsonpath='{.data.localRegistryHosting\.v1}' | awk '/host:/{print $2; exit}')
+docker pull busybox:latest
+docker tag busybox:latest "$HOSTPORT/busybox:smoke"
+docker push "$HOSTPORT/busybox:smoke"
+# Pod pulls via the in-cluster name, proving cluster-side reachability:
+kubectl run registry-smoke --rm -it --restart=Never \
+  --image=ctlptl-registry:5000/busybox:smoke -- echo ok
+```
+
+## Follow-ups for Phases 1–2
+
+- The registry is plain-HTTP (insecure). The minikube node already trusts it
+  (ctlptl configured that), but a Kaniko build Job pushing to it will need
+  `--insecure` / `--insecure-registry=ctlptl-registry:5000`.
+- The Kaniko Job should build `FROM ctlptl-registry:5000/runner-base` (the base
+  image added in Phase 0 — see `apps/runner/runner-base.Dockerfile`) and push
+  the per-experiment image back to `ctlptl-registry:5000`.
+- The runner Job image ref (`apps/backend/job-runner.yaml` /
+  `IMAGE_RUNNER`) will then point at `ctlptl-registry:5000/...` instead of the
+  public `gladospipeline/glados-runner:main`.
diff --git a/kubernetes_init/registry/registry.yaml b/kubernetes_init/registry/registry.yaml
new file mode 100644
index 00000000..e4f04a9b
--- /dev/null
+++ b/kubernetes_init/registry/registry.yaml
@@ -0,0 +1,26 @@
+# Declarative form of the in-cluster dev registry used by the Tilt / minikube
+# flow. This is the same registry that .devcontainer/post-start.sh creates
+# imperatively via:
+#
+#     ctlptl create cluster minikube --registry=ctlptl-registry
+#
+# It is managed by ctlptl (https://github.com/tilt-dev/ctlptl), NOT kubectl.
+# Apply / reconcile it idempotently with:
+#
+#     ctlptl apply -f kubernetes_init/registry/registry.yaml
+#
+# ctlptl runs a `registry:2` container, joins it to the minikube docker network,
+# and publishes a `local-registry-hosting` ConfigMap in the `kube-public`
+# namespace (the KEP-1755 discovery standard). Tilt reads that ConfigMap and
+# automatically uses this registry as its default push target, and in-cluster
+# pods pull from it at `ctlptl-registry:5000`.
+#
+# Scope: DEV / minikube only. Not used in the production kubernetes_init
+# backend / frontend / mongodb manifests.
+#
+# The host port is intentionally left unset so ctlptl assigns a free one on each
+# cluster creation (matching the --registry flag behaviour); the in-cluster
+# address is always `ctlptl-registry:5000` regardless of the host port.
+apiVersion: ctlptl.dev/v1alpha1
+kind: Registry
+name: ctlptl-registry
diff --git a/kubernetes_init/tilt/cluster-role-job-creator.yaml b/kubernetes_init/tilt/cluster-role-job-creator.yaml
index 602c93d7..60c80d38 100644
--- a/kubernetes_init/tilt/cluster-role-job-creator.yaml
+++ b/kubernetes_init/tilt/cluster-role-job-creator.yaml
@@ -4,9 +4,14 @@ metadata:
   name: job-creator
   namespace: default
 rules:
+# get/list/watch added so the backend can poll the Kaniko build Job to completion (Phase 2)
 - apiGroups: ["batch"]
   resources: ["jobs"]
-  verbs: ["create", "delete"]
+  verbs: ["create", "delete", "get", "list", "watch"]
+# configmaps: the backend stages the Kaniko build context in a ConfigMap (Phase 2)
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["create", "delete", "get"]
 - apiGroups: [""]
   resources: ["pods"]
   verbs: ["get", "list", "watch"]
diff --git a/kubernetes_init/tilt/deployment-backend.yaml b/kubernetes_init/tilt/deployment-backend.yaml
index c7cf9721..8587fe4d 100644
--- a/kubernetes_init/tilt/deployment-backend.yaml
+++ b/kubernetes_init/tilt/deployment-backend.yaml
@@ -21,6 +21,14 @@ spec:
         env:
         - name: IMAGE_RUNNER
           value: runner
+        # Phase 2 build orchestration (dev/minikube). REGISTRY_HOST is the in-cluster
+        # registry used to push per-experiment images and check the build cache.
+        # RUNNER_BASE_IMAGE is the base the Kaniko build layers deps onto; the bare
+        # `runner-base` value is rewritten by Tilt (match_in_env_vars) to the pushed ref.
+        - name: REGISTRY_HOST
+          value: ctlptl-registry:5000
+        - name: RUNNER_BASE_IMAGE
+          value: runner-base
         - name: BACKEND_PORT
           valueFrom:
             secretKeyRef: