diff --git a/packages/shade-server/Dockerfile b/packages/shade-server/Dockerfile
index aa17ae6..e7823b1 100644
--- a/packages/shade-server/Dockerfile
+++ b/packages/shade-server/Dockerfile
@@ -9,10 +9,15 @@ COPY package.json bun.lock tsconfig.json ./
 # Copy all packages the server + observer + dashboard need
 COPY packages ./packages
 
-RUN bun install --frozen-lockfile
+# BuildKit gives each RUN a 1024 soft file-descriptor limit while the hard
+# limit is ~1M. bun extracts tarballs in parallel, so a large package can
+# exhaust the descriptors and the install dies with "Fail extracting tarball"
+# — reproducible in a build, invisible outside one because `docker run`
+# inherits a far higher limit. Raise the soft limit to what the host allows.
+RUN ulimit -n "$(ulimit -Hn)" && bun install --frozen-lockfile
 
 # Build the dashboard SPA → dist/, then copy to observer's dist/
-RUN cd packages/shade-dashboard && bun run build
+RUN ulimit -n "$(ulimit -Hn)" && cd packages/shade-dashboard && bun run build
 
 # ─── Production stage ───────────────────────────────────────
 FROM oven/bun:1-alpine