diff --git a/docs/proposals/TUNNEL.md b/docs/proposals/TUNNEL.md
index 3762963..7e4da76 100644
--- a/docs/proposals/TUNNEL.md
+++ b/docs/proposals/TUNNEL.md
@@ -205,7 +205,7 @@ Even if intercepted: unreadable gibberish
 
 **Tailscale Client**
 - VPN client that connects to Headscale
-- Runs in each container (installed via `hack/docker/Dockerfile.tunnel`)
+- Runs in each container (installed via `hack/docker/Dockerfile.server-tunnel`)
 - Joins the mesh, creates tunnel interface
 
 **Your Application = Controller**
@@ -237,7 +237,7 @@ Daemon → Internet → Controller (public IP:8765)
 
 ```
 
-**Key:** `hack/docker/Dockerfile.tunnel` installs **Tailscale client** (not Headscale server). Headscale runs separately.
+**Key:** `hack/docker/Dockerfile.server-tunnel` installs **Tailscale client** (not Headscale server). Headscale runs separately.
 
 ---
 
@@ -263,7 +263,7 @@ server = Server(connect="tunnel", tunnel_config=config)
 
 Use the tunnel-enabled image. Build it yourself like this:
 ```bash
-docker build -f hack/docker/Dockerfile.tunnel -t my-app:tunnel .
+docker build -f hack/docker/Dockerfile.server-tunnel -t my-app:tunnel .
 ```
 
 ### Running
@@ -284,7 +284,7 @@ docker run \
 
 ```bash
 # From SandD repo
-docker build -f hack/docker/Dockerfile.tunnel -t inftyai/sandd-server:latest-tunnel .
+docker build -f hack/docker/Dockerfile.server-tunnel -t inftyai/sandd-server:latest-tunnel .
 ```
 
 ### 2. Run Headscale
@@ -543,7 +543,7 @@ A: Attacker can join your mesh. Use single-use keys and revoke immediately if le
 **Q: Why not install Headscale in my container?**
 A: Headscale is a coordination server - you only need one for the entire mesh. Like DNS: one server, many clients.
 
-**Q: What's in `hack/docker/Dockerfile.tunnel`?**
+**Q: What's in `hack/docker/Dockerfile.server-tunnel`?**
 A: Python 3.11, SandD library, and Tailscale client (not Headscale server).
 
 **Q: Do I need NET_ADMIN?**
diff --git a/examples/tunnel-simple/README.md b/examples/tunnel-simple/README.md
index 3f965ff..28ab78b 100644
--- a/examples/tunnel-simple/README.md
+++ b/examples/tunnel-simple/README.md
@@ -49,7 +49,7 @@ You can either:
 
 ```bash
 # Option B: Build manually from repo root
-docker build -f hack/docker/Dockerfile.tunnel -t inftyai/sandd-server:latest-tunnel .
+docker build -f hack/docker/Dockerfile.server-tunnel -t inftyai/sandd-server:latest-tunnel .
 docker build -f hack/docker/Dockerfile.debian -t inftyai/sandd-daemon:debian .
 ```
 
diff --git a/examples/tunnel-simple/docker-compose.yml b/examples/tunnel-simple/docker-compose.yml
index a1ae7f5..6ad40ae 100644
--- a/examples/tunnel-simple/docker-compose.yml
+++ b/examples/tunnel-simple/docker-compose.yml
@@ -31,7 +31,7 @@ services:
     hostname: controller
     build:
       context: ../..
-      dockerfile: hack/docker/Dockerfile.tunnel
+      dockerfile: hack/docker/Dockerfile.server-tunnel
     command:
       - /bin/bash
       - -c
diff --git a/hack/docker/Dockerfile.tunnel b/hack/docker/Dockerfile.server-tunnel
similarity index 94%
rename from hack/docker/Dockerfile.tunnel
rename to hack/docker/Dockerfile.server-tunnel
index 4fd8566..388503c 100644
--- a/hack/docker/Dockerfile.tunnel
+++ b/hack/docker/Dockerfile.server-tunnel
@@ -6,7 +6,7 @@
 #   ↑
 #   └─ Tailscale client (installed in this image)
 #
-# Build: docker build -f Dockerfile.tunnel -t inftyai/sandd-server:latest-tunnel .
+# Build: docker build -f Dockerfile.server-tunnel -t inftyai/sandd-server:latest-tunnel .
 # Run:   docker run --cap-add NET_ADMIN --device /dev/net/tun inftyai/sandd-server:latest-tunnel
 
 FROM python:3.11-slim-bookworm
diff --git a/hack/docker/Dockerfile.tunnel-release b/hack/docker/Dockerfile.server-tunnel-release
similarity index 89%
rename from hack/docker/Dockerfile.tunnel-release
rename to hack/docker/Dockerfile.server-tunnel-release
index 8524d32..4cca2aa 100644
--- a/hack/docker/Dockerfile.tunnel-release
+++ b/hack/docker/Dockerfile.server-tunnel-release
@@ -1,7 +1,7 @@
 # SandD Server with Tunnel Support (Release Version)
 # Uses published PyPI package instead of building from source
 #
-# Build: docker build -f hack/docker/Dockerfile.tunnel-release -t inftyai/sandd-server:v0.1.0-tunnel .
+# Build: docker build -f hack/docker/Dockerfile.server-tunnel-release -t inftyai/sandd-server:v0.1.0-tunnel .
 # Run:   docker run --cap-add NET_ADMIN --device /dev/net/tun inftyai/sandd-server:v0.1.0-tunnel
 
 FROM python:3.11-slim-bookworm
diff --git a/hack/docker/README.md b/hack/docker/README.md
index df28796..1981bd4 100644
--- a/hack/docker/README.md
+++ b/hack/docker/README.md
@@ -8,14 +8,14 @@ This directory contains Docker-related files for building and testing SandD.
 
 #### Server (Controller) Images
 
-- **`Dockerfile.tunnel`** - Server with Tailscale (build from source)
+- **`Dockerfile.server-tunnel`** - Server with Tailscale (build from source)
   - Use: Development and testing
-  - Build: `docker build -f hack/docker/Dockerfile.tunnel -t inftyai/sandd-server:latest-tunnel .`
+  - Build: `docker build -f hack/docker/Dockerfile.server-tunnel -t inftyai/sandd-server:latest-tunnel .`
   - See: [docs/proposals/TUNNEL.md](../../docs/proposals/TUNNEL.md)
 
-- **`Dockerfile.tunnel-release`** - Server with Tailscale (uses PyPI release)
+- **`Dockerfile.server-tunnel-release`** - Server with Tailscale (uses PyPI release)
   - Use: Production deployments
-  - Build: `docker build -f hack/docker/Dockerfile.tunnel-release --build-arg SANDD_VERSION=0.1.0 -t inftyai/sandd-server:v0.1.0-tunnel .`
+  - Build: `docker build -f hack/docker/Dockerfile.server-tunnel-release --build-arg SANDD_VERSION=0.1.0 -t inftyai/sandd-server:v0.1.0-tunnel .`
 
 #### Daemon (Worker) Images
 
@@ -46,7 +46,7 @@ This directory contains Docker-related files for building and testing SandD.
 
 ```bash
 # From repo root
-docker build -f hack/docker/Dockerfile.tunnel -t inftyai/sandd-server:latest-tunnel .
+docker build -f hack/docker/Dockerfile.server-tunnel -t inftyai/sandd-server:latest-tunnel .
 ```
 
 ### Build test images