diff --git a/docs/adr/ADR-039-container-resource-types.md b/docs/adr/ADR-039-container-resource-types.md
index fea278aad..b896553c9 100644
--- a/docs/adr/ADR-039-container-resource-types.md
+++ b/docs/adr/ADR-039-container-resource-types.md
@@ -88,7 +88,7 @@ An immutable container image (OCI image, LXC image, etc.).
 | **Kind** | physical |
 | **Sandbox strategy** | `none` (images are immutable) |
 | **User-addable** | yes |
-| **CLI arguments** | `--image-ref` (required, e.g., `python:3.12-slim`), `--digest` (optional), `--engine-type` (optional, inherited from parent runtime) |
+| **CLI arguments** | `--image` (required, e.g., `python:3.12-slim`), `--digest` (optional), `--engine-type` (optional, inherited from parent runtime) |
 | **Allowed parents** | `container-runtime` (1) |
 | **Allowed children** | `container-instance` (0..\*, instances created from this image) |
 | **Auto-discovery** | Discovered from `container-runtime`. Does not auto-discover children (instances are discovered from the runtime). |
@@ -105,7 +105,7 @@ A container — running, stopped, paused, or created.
 | **Kind** | physical |
 | **Sandbox strategy** | `snapshot` |
 | **User-addable** | yes |
-| **CLI arguments** | `--container-id` (optional), `--name` (optional), `--image-ref` (optional, links to parent image), `--engine-type` (optional, inherited from parent runtime) |
+| **CLI arguments** | `--container-id` (optional; ID of an existing container to register), `--image` (required when `--container-id` is not provided; container image reference, e.g., `ubuntu:latest`), `--mount` (optional, repeatable; mount a resource or host path into the container, format: `RESOURCE_OR_PATH:CONTAINER_PATH[:MODE]`; see [ADR-043 §3.2](ADR-043-devcontainer-integration.md)), `--clone-into` (optional; clone a repository into the container on first start, format: `REPO_URL:CONTAINER_PATH`), `--engine-type` (optional, inherited from parent runtime) |
 | **Allowed parents** | `container-runtime` (1), `container-image` (0..1, the image it was created from) |
 | **Allowed children** | `container-mount` (0..\*), `container-exec-env` (1), `container-port` (0..\*) |
 | **Auto-discovery** | Discovered from `container-runtime`. Auto-discovers mounts, execution environment, and port mappings. |
diff --git a/docs/specification.md b/docs/specification.md
index 49bfb09c2..c856a617c 100644
--- a/docs/specification.md
+++ b/docs/specification.md
@@ -10588,6 +10588,7 @@ Type-specific flags depend on the resource type. See `agents resource type show
 
 **Container-specific flags** (for `container-instance` and `devcontainer-instance` types):
 
+- `--image IMAGE_REF`: Container image reference (e.g., `ubuntu:latest`, `python:3.12-slim`). Required for `container-instance` when `--container-id` is not provided. Not required for `devcontainer-instance` (image is derived from `devcontainer.json`).
 - `--mount RESOURCE_OR_PATH:CONTAINER_PATH`: Mount a resource or host path into the container (repeatable). Accepts either a resource reference (`local/api-repo:/workspace`) or a raw host path (`/home/user/projects/api:/workspace`). See [ADR-043 §3.2](adr/ADR-043-devcontainer-integration.md).
 - `--clone-into REPO_URL:CONTAINER_PATH`: Clone a remote repository into the container at the specified path. The clone happens lazily on first container start.