v2026.2: Docker-from-Docker, Image Diet & Supply Chain

What's Changed

Docker-from-Docker via Socket Bind Mount

The container no longer runs its own Docker daemon. Instead, it uses a simple host socket bind mount for Docker access. The Docker CLI, Buildx, and Compose are pre-installed in the image via extrepo. A baked-in docker-init.sh script (run via postStartCommand) handles runtime fixups:

1. Aligns the container's docker group GID with the host socket's GID (fixes permission denied errors)
2. Auto-detects the daemon's API version via curl against the Docker socket and exports DOCKER_API_VERSION (fixes client/server version mismatch on Codespaces where the host daemon is older than the installed CLI)

This approach:

• Removes the need for --privileged mode
• Works with GitHub Codespaces out of the box
• Starts faster (no dockerd boot wait)
• Is more secure (no kernel-level access)
• Avoids APT source conflicts (no extra devcontainer Feature adding duplicate repos)
• Keeps devcontainer.json simple — just mount the socket and call docker-init.sh

OCI Annotations & GitHub Attestations

• Full OCI image annotations on multi-arch image index and per-platform manifests
• GHCR package page displays description, license, source URL, and other metadata
• actions/attest-build-provenance populates the GitHub Attestations tab
• Docker BuildKit attestations (provenance + SBOM) continue to be stored in the registry

Image Size Reduction (~1-1.7 GB)

• GCP CLI and Azure CLI removed from the default image. Install on demand:

  # GCP CLI (repo already enabled via extrepo)
  sudo apt-get update && sudo apt-get install -y google-cloud-cli
  # Azure CLI (repo not available for Trixie, use pipx)
  pipx install azure-cli

• Docker daemon (docker-ce, containerd.io) only installed on bare metal (systemd detected). Container image ships CLI-only.

Tooling Updates

• AI tools: Added goose, opencode, litellm (with boto3 for AWS Bedrock)
• Simplified: mise and ddev now installed as APT packages via extrepo
• Added: pyproject.toml for uv-based linting and TOML validation
• Activated: zoxide shell integration

CI & Build Fixes

• Auto-detect GITHUB_TOKEN from gh auth token
• Fixed Docker socket permissions via --group-add in CI and justfile
• Fixed DATE build arg, DEBIAN_FRONTEND leak, PR push guard
• Bumped codeql-action from v3 to v4

Breaking Changes

• devcontainer.json format changed — use socket bind mount and postStartCommand: "docker-init.sh". See README for the new format.
• docker run commands need --group-add — see README for updated examples
• GCP CLI and Azure CLI no longer pre-installed — install on demand (see above)