diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e3eb85c..e2996b2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
       # Dummy tag; version does not matter.
       TAG: cpython-devcontainer:1.0.0-${{ github.run_id }}
     steps:
-      - name: Checkout Push to Registry action
+      - name: Checkout
         uses: actions/checkout@v5
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -32,6 +32,31 @@ jobs:
       - name: Test clang
         run: docker run --rm ${{ env.TAG }} clang --version
 
+  build_wasi_container:
+    name: Build and test (WASI container)
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.os }}
+    env:
+      TAG: cpython-wasicontainer:1.0.0-${{ github.run_id }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Build Dockerfile
+        uses: docker/build-push-action@v6
+        with:
+          context: ./wasicontainer
+          load: true
+          tags: ${{ env.TAG }}
+      - name: Test WASI SDK
+        run: docker run --rm ${{ env.TAG }} /opt/wasi-sdk/bin/clang --version
+      - name: Test Wasmtime
+        run: docker run --rm ${{ env.TAG }} wasmtime --version
+
   build_autoconf:
     name: Build and test (Autoconf)
     strategy:
@@ -43,7 +68,7 @@ jobs:
     env:
       TAG: autoconf:${{ matrix.autoconf_version }}-${{ github.run_id }}
     steps:
-      - name: Checkout Push to Registry action
+      - name: Checkout
         uses: actions/checkout@v5
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c84146f..f64d0bf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,6 +11,7 @@ on:
         options:
         - autoconf
         - devcontainer
+        - wasicontainer
 
 run-name: "Release: ${{ inputs.package }}"
 
diff --git a/wasicontainer/Dockerfile b/wasicontainer/Dockerfile
new file mode 100644
index 0000000..ad5c577
--- /dev/null
+++ b/wasicontainer/Dockerfile
@@ -0,0 +1,20 @@
+FROM ghcr.io/python/devcontainer:latest
+
+LABEL org.opencontainers.image.base.name="ghcr.io/python/wasicontainer:latest"
+LABEL org.opencontainers.image.source="https://github.com/python/cpython-devcontainers"
+LABEL org.opencontainers.image.title="CPython WASI development container"
+LABEL org.opencontainers.image.description="CPython development container with the tooling to work on WASI builds."
+LABEL org.opencontainers.image.authors="Brett Cannon"
+
+ARG TARGETARCH
+
+# WASI SDK versions are controlled in install-wasi.sh.
+ENV WASI_SDK_ROOT=/opt
+
+ENV WASMTIME_VERSION=36.0.2
+ENV WASMTIME_HOME=/opt/wasmtime
+
+RUN mkdir -p /opt/cpython-devcontainer/bin
+COPY --chmod=755 install-wasi.sh /opt/cpython-devcontainer/bin/
+
+RUN /opt/cpython-devcontainer/bin/install-wasi.sh
diff --git a/wasicontainer/README.md b/wasicontainer/README.md
new file mode 100644
index 0000000..193c8e1
--- /dev/null
+++ b/wasicontainer/README.md
@@ -0,0 +1,3 @@
+A container for developing CPython for WASI.
+
+It is based on the dev container, and thus includes the same common utilities.
diff --git a/wasicontainer/install-wasi.sh b/wasicontainer/install-wasi.sh
new file mode 100644
index 0000000..408ac43
--- /dev/null
+++ b/wasicontainer/install-wasi.sh
@@ -0,0 +1,45 @@
+#! /bin/bash -ex
+
+mkdir --parents ${WASI_SDK_ROOT}
+
+# For 3.11, 3.12.
+# There is no Arm support for WASI SDK < 23.
+if [ "${TARGETARCH}" = "amd64" ]; then
+    URL=https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-16/wasi-sdk-16.0-linux.tar.gz
+    curl --location $URL | tar --directory ${WASI_SDK_ROOT} --extract --gunzip
+fi
+
+case "${TARGETARCH}" in
+    amd64) WASI_ARCH="x86_64" ;;
+    arm64) WASI_ARCH="arm64" ;;
+    *) echo "Unsupported TARGETARCH: ${TARGETARCH}" && exit 1 ;;
+esac && \
+
+# 24: 3.13, 3.14
+# The URL format only works for WASI SDK >= 23.
+WASI_SDK_VERSIONS=(24)
+for VERSION in "${WASI_SDK_VERSIONS[@]}"; do
+    URL=https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${VERSION}/wasi-sdk-${VERSION}.0-${WASI_ARCH}-linux.tar.gz
+    curl --location $URL | tar --directory ${WASI_SDK_ROOT} --extract --gunzip
+done
+
+# For Python 3.13 as Tools/wasm/wasi.py expects /opt/wasi-sdk by default.
+ln -s ${WASI_SDK_ROOT}/wasi-sdk-24.0*/ /opt/wasi-sdk
+
+
+mkdir --parents ${WASMTIME_HOME}
+
+case "${TARGETARCH}" in
+    amd64) WASMTIME_ARCH="x86_64" ;;
+    arm64) WASMTIME_ARCH="aarch64" ;;
+    *) echo "Unsupported TARGETARCH: ${TARGETARCH}" && exit 1 ;;
+esac
+
+URL="https://github.com/bytecodealliance/wasmtime/releases/download/v${WASMTIME_VERSION}/wasmtime-v${WASMTIME_VERSION}-${WASMTIME_ARCH}-linux.tar.xz"
+
+curl --location $URL |
+    xz --decompress |
+    tar --strip-components 1 --directory ${WASMTIME_HOME} -x
+
+# Put `wasmtime` on $PATH.
+ln -s ${WASMTIME_HOME}/wasmtime* /usr/local/bin