ci+dev: ghcr.io image publishing + devcontainer Go 1.26

- .goreleaser.yaml: dockers + docker_manifests for multi-arch images at
  ghcr.io/css521/agentenv:<tag> and :latest (linux/amd64 + linux/arm64)
- Dockerfile: distroless static image, COPYs the goreleaser-built binary
- .github/workflows/release.yml: QEMU + Buildx + ghcr.io login step;
  packages:write permission for the workflow
- .devcontainer/devcontainer.json: bump to mcr ...go:2.1-1.26 (the 1-1.x
  line tops out at Go 1.24 which can't compile our go 1.26 directive);
  prefix postCreate with sudo (lifecycle commands run as remoteUser)
- README: mention ghcr.io image alongside binaries

Author: css521

.devcontainer/devcontainer.json

@@ -4,7 +4,9 @@
   // libbtrfs-dev pre-installed, seccomp relaxed so agentenv's user-namespace
   // runner works, and the project source mounted as the workspace.
   "name": "agentenv-dev",
-  "image": "mcr.microsoft.com/devcontainers/go:1-1.23",
+  // Image-version 2.x is where MS publishes Go 1.25+ (the older 1-1.xx
+  // line tops out at Go 1.24, which fails our go.mod's `go 1.26` directive).
+  "image": "mcr.microsoft.com/devcontainers/go:2.1-1.26",
 
   // The agentenv runner clones into a fresh user namespace; the dev container's
   // default seccomp profile blocks that. Unconfining it inside the dev container
@@ -20,7 +22,9 @@
 
   // libbtrfs-dev lets you build with `-tags btrfs` (the optional fast-path
   // backend that needs cgo); the default static build needs nothing.
-  "postCreateCommand": "apt-get update && apt-get install -y -qq libbtrfs-dev make",
+  // sudo: devcontainer lifecycle commands run as remoteUser (vscode), not root.
+  // The common-utils feature gives vscode passwordless sudo.
+  "postCreateCommand": "sudo apt-get update && sudo apt-get install -y -qq libbtrfs-dev make",
   // Show the Makefile target list every time the container is attached, so a new
   // contributor immediately sees what they can do (build / test / verify / demo).
   "postAttachCommand": "make help",

.github/workflows/release.yml

@@ -3,7 +3,8 @@ name: Release
 # Fires when a tag like v0.1.0 / v1.2.3 is pushed. Cross-compiles linux/amd64
 # + linux/arm64 via goreleaser, attaches them to a DRAFT GitHub release
 # (because `.goreleaser.yaml` sets `release.draft: true`) — review and
-# Publish in the GitHub UI when ready.
+# Publish in the GitHub UI when ready. Also builds + pushes multi-arch
+# container images to ghcr.io/css521/agentenv:<tag> + :latest.
 
 on:
   push:
@@ -12,6 +13,7 @@ on:
 
 permissions:
   contents: write   # goreleaser creates the GitHub release + uploads artifacts
+  packages: write   # docker push → ghcr.io under this org
 
 jobs:
   goreleaser:
@@ -25,6 +27,18 @@ jobs:
         with:
           go-version: '1.26'
 
+      # QEMU lets the runner build linux/arm64 images from a linux/amd64 host.
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+
+      # GITHUB_TOKEN is automatically scoped for ghcr.io publishes when the
+      # workflow has packages:write; no separate PAT needed.
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - uses: goreleaser/goreleaser-action@v6
         with:
           version: latest

.goreleaser.yaml

@@ -37,5 +37,45 @@ checksum:
 changelog:
   use: github
 
+# Multi-arch container images pushed to ghcr.io. Two per-arch images are built
+# (each with a binary matching its target platform), then a single manifest
+# list points at both — so `docker pull ghcr.io/css521/agentenv:vX.Y.Z`
+# transparently picks amd64 or arm64.
+dockers:
+  - image_templates:
+      - "ghcr.io/css521/agentenv:{{ .Version }}-amd64"
+    use: buildx
+    dockerfile: Dockerfile
+    goos: linux
+    goarch: amd64
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.source=https://github.com/css521/agentenv"
+      - "--label=org.opencontainers.image.version={{ .Version }}"
+      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
+      - "--label=org.opencontainers.image.licenses=MIT"
+  - image_templates:
+      - "ghcr.io/css521/agentenv:{{ .Version }}-arm64"
+    use: buildx
+    dockerfile: Dockerfile
+    goos: linux
+    goarch: arm64
+    build_flag_templates:
+      - "--platform=linux/arm64"
+      - "--label=org.opencontainers.image.source=https://github.com/css521/agentenv"
+      - "--label=org.opencontainers.image.version={{ .Version }}"
+      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
+      - "--label=org.opencontainers.image.licenses=MIT"
+
+docker_manifests:
+  - name_template: "ghcr.io/css521/agentenv:{{ .Version }}"
+    image_templates:
+      - "ghcr.io/css521/agentenv:{{ .Version }}-amd64"
+      - "ghcr.io/css521/agentenv:{{ .Version }}-arm64"
+  - name_template: "ghcr.io/css521/agentenv:latest"
+    image_templates:
+      - "ghcr.io/css521/agentenv:{{ .Version }}-amd64"
+      - "ghcr.io/css521/agentenv:{{ .Version }}-arm64"
+
 release:
   draft: true

Dockerfile

@@ -0,0 +1,16 @@
+# Minimal release image for `agentenv` — distroless static base, no shell, no
+# package manager, just the binary. Built and pushed to ghcr.io by goreleaser
+# (see `dockers:` in .goreleaser.yaml).
+#
+# The build context is goreleaser's per-arch dist/ subdirectory, which already
+# contains the pre-compiled `agentenv` binary — so this Dockerfile is just a
+# COPY + ENTRYPOINT. No `go build` happens here.
+#
+# Note: agentenv calls `bash -lc` inside the *managed rootfs* (work/current),
+# never inside this image. So a distroless host image is fine; bash is only
+# required in whatever rootfs you `init --from` or `init --tarball` later.
+FROM gcr.io/distroless/static-debian12:nonroot
+
+COPY agentenv /usr/local/bin/agentenv
+
+ENTRYPOINT ["/usr/local/bin/agentenv"]

README.md

@@ -34,6 +34,7 @@ CGO_ENABLED=1 go build -tags btrfs -o agentenv .     # optional btrfs fast path
 ```
 
 Prebuilt binaries are attached to each [release](https://github.com/css521/agentenv/releases).
+Multi-arch container images at `ghcr.io/css521/agentenv` (`:latest` or `:vX.Y.Z`).
 
 ## Why it's different