diff --git a/images/rdp-public.gif b/images/rdp-public.gif
new file mode 100644
index 0000000..68d08b3
Binary files /dev/null and b/images/rdp-public.gif differ
diff --git a/images/ssh-public.gif b/images/ssh-public.gif
new file mode 100644
index 0000000..960af76
Binary files /dev/null and b/images/ssh-public.gif differ
diff --git a/manage/resources/public/rdp.mdx b/manage/resources/public/rdp.mdx
index e524102..d1cec6e 100644
--- a/manage/resources/public/rdp.mdx
+++ b/manage/resources/public/rdp.mdx
@@ -13,6 +13,10 @@ Only available in [Pangolin Cloud](https://app.pangolin.net/auth/signup) and [En
 
 RDP public resources render a full Remote Desktop Protocol client in the browser. Users visit a FQDN, complete Pangolin authentication, and get an interactive Windows desktop session—including file transfers, clipboard copy/paste, and standard RDP features—without installing remote desktop software.
 
+<Frame caption="RDP session in the browser">
+  <img src="/images/rdp-public.gif" alt="Remote desktop session rendered in the Pangolin web dashboard" />
+</Frame>
+
 ## How It Works
 
 1. You assign a FQDN on a domain managed in Pangolin.
diff --git a/manage/resources/public/ssh.mdx b/manage/resources/public/ssh.mdx
index 54a626d..06577bd 100644
--- a/manage/resources/public/ssh.mdx
+++ b/manage/resources/public/ssh.mdx
@@ -13,6 +13,10 @@ Only available in [Pangolin Cloud](https://app.pangolin.net/auth/signup) and [En
 
 SSH public resources render a full interactive terminal in the browser. Users visit a FQDN—no SSH client or Pangolin desktop client is required.
 
+<Frame caption="SSH session in the browser">
+  <img src="/images/ssh-public.gif" alt="Interactive SSH terminal rendered in the Pangolin web dashboard" />
+</Frame>
+
 ## How It Works
 
 1. You assign a FQDN on a domain managed in Pangolin.
diff --git a/manage/ssh.mdx b/manage/ssh.mdx
index 1d9e665..d5d114b 100644
--- a/manage/ssh.mdx
+++ b/manage/ssh.mdx
@@ -46,11 +46,11 @@ SSH resources are configured through three decisions in the dashboard.
 
 | Option | Description |
 |--------|-------------|
-| **Pangolin SSH (Recommended)** | Executes commands directly on the host via the site connector. No network SSH server is required, and you do not enter a host or port. Newt must run as root (`sudo newt ...`). |
+| **Pangolin SSH (Recommended)** | Executes commands directly on the host via the site connector. No network SSH server is required, and you do not enter a host or port. Newt must run as the [binary](/manage/sites/install-site#binary-installation) on the host as root (`sudo newt ...`). Containerized installs are not supported—sessions may open the container shell instead of the host. |
 | **Standard SSH Server** | Routes commands over the network to an SSH server such as OpenSSH. Enter the backend host and port. To use automated provisioning (PAM) with this mode, you must configure OpenSSH to accept Pangolin certificates and connections. This mode also supports a remote auth daemon for pushing users to machines on the same network as the site connector that are not running the connector itself. |
 
 <Warning>
-**Pangolin SSH mode requires root.** Newt must run as root on the site connector host. Use `sudo newt ...` or run the Newt systemd service as root. See [Install a site](/manage/sites/install-site).
+**Pangolin SSH mode requires the Newt binary on the host.** Install Newt as a [binary on the site connector host](/manage/sites/install-site#binary-installation) and run it as root (`sudo newt ...` or a root systemd service). If Newt runs in a container, SSH sessions may drop you into the container shell rather than the host.
 </Warning>
 
 ### Authentication Method