diff --git a/Makefile b/Makefile
index 2dac70d08..cb0fc2e97 100644
--- a/Makefile
+++ b/Makefile
@@ -56,7 +56,7 @@ test:
 	uv run pytest tests/ -v
 	@echo "✅ All tests passed!"
 
-check-all: format lint security test
+check-all: format lint type-check security test
 	@echo "✅ All code quality checks passed!"
 
 pre-commit:
diff --git a/strix/runtime/backends.py b/strix/runtime/backends.py
index 017bc5148..b8806e38b 100644
--- a/strix/runtime/backends.py
+++ b/strix/runtime/backends.py
@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import logging
 import os
+import sys
 from collections.abc import Awaitable, Callable
 from pathlib import Path
 from typing import TYPE_CHECKING, Any
@@ -82,7 +83,8 @@ def _podman_socket_candidates() -> list[str]:
     candidates: list[str] = []
 
     # -- macOS podman machine (applehv / libkrun) --
-    candidates.extend(_macos_podman_machine_sockets())
+    if sys.platform == "darwin":
+        candidates.extend(_macos_podman_machine_sockets())
 
     # -- Linux rootless --
     xdg_runtime = os.environ.get("XDG_RUNTIME_DIR")
@@ -100,7 +102,7 @@ def _podman_socket_candidates() -> list[str]:
     # -- macOS podman machine temp-dir fallback --
     tmpdir = os.environ.get("TMPDIR")
     if tmpdir:
-        candidates.append(f"unix://{tmpdir}podman/podman-machine-default-api.sock")
+        candidates.append(f"unix://{tmpdir.rstrip('/')}/podman/podman-machine-default-api.sock")
 
     return candidates
 
diff --git a/strix/runtime/docker_client.py b/strix/runtime/docker_client.py
index cde5bf776..6709cc9a5 100644
--- a/strix/runtime/docker_client.py
+++ b/strix/runtime/docker_client.py
@@ -114,8 +114,13 @@ class StrixDockerSandboxClient(DockerSandboxClient):
             if cap not in cap_add:
                 cap_add.append(cap)
 
-        extra_hosts = create_kwargs.setdefault("extra_hosts", {})
-        extra_hosts[self._host_gateway_hostname] = "host-gateway"
+        # Docker requires an explicit host-gateway mapping for
+        # host.docker.internal. Podman resolves host.containers.internal
+        # via its built-in DNS and the compat API's host-gateway support
+        # only arrived in v4.7, so skip extra_hosts for Podman.
+        if self._host_gateway_hostname == "host.docker.internal":
+            extra_hosts = create_kwargs.setdefault("extra_hosts", {})
+            extra_hosts[self._host_gateway_hostname] = "host-gateway"
 
         logger.debug(
             "Creating sandbox container: image=%s caps=%s exposed_ports=%s",
diff --git a/tests/test_backends.py b/tests/test_backends.py
index 7e947b64b..c8b8f04ae 100644
--- a/tests/test_backends.py
+++ b/tests/test_backends.py
@@ -135,11 +135,16 @@ class TestPodmanSocketCandidates:
         uid = os.getuid()
         assert f"unix:///run/user/{uid}/podman/podman.sock" in candidates
 
-    def test_includes_tmpdir_when_set(self) -> None:
+    def test_includes_tmpdir_when_set_with_trailing_slash(self) -> None:
         os.environ["TMPDIR"] = "/tmp/"
         candidates = _podman_socket_candidates()
         assert "unix:///tmp/podman/podman-machine-default-api.sock" in candidates
 
+    def test_includes_tmpdir_when_set_without_trailing_slash(self) -> None:
+        os.environ["TMPDIR"] = "/tmp"
+        candidates = _podman_socket_candidates()
+        assert "unix:///tmp/podman/podman-machine-default-api.sock" in candidates
+
     def test_no_tmpdir_entry_when_not_set(self) -> None:
         candidates = _podman_socket_candidates()
         tmpdir_candidates = [c for c in candidates if "podman-machine-default-api" in c]