diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 0000000000..7ae2b38fcf
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,63 @@
+name: docker
+
+on:
+  push:
+    tags: ["v*"]
+    branches: ['docker-release']
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  docker:
+    name: docker-${{ matrix.flavor }}
+    strategy:
+      fail-fast: false
+      matrix:
+        flavor:
+          - alpine
+          - deb
+          - github-actions
+          - rpm
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ghcr.io/jdx/rtx:${{ matrix.flavor }}
+          labels: ${{ steps.meta.outputs.labels }}
+          file: packaging/${{ matrix.flavor }}/Dockerfile
+  test:
+    runs-on: ubuntu-22.04
+    container: ghcr.io/jdx/rtx:github-actions
+    timeout-minutes: 10
+    steps:
+      - run: node -v
+      - run: cargo -V
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Run cargo nextest
+        run: cargo nextest run --all-features
+        env:
+          RUST_BACKTRACE: "1"
diff --git a/.github/workflows/rtx.yml b/.github/workflows/rtx.yml
index 0f22f02a14..175b47b6d4 100644
--- a/.github/workflows/rtx.yml
+++ b/.github/workflows/rtx.yml
@@ -16,6 +16,7 @@ env:
 jobs:
   unit:
     runs-on: ubuntu-22.04
+    container: ghcr.io/jdx/rtx:github-actions
     timeout-minutes: 10
     steps:
       - name: Checkout
@@ -24,11 +25,6 @@ jobs:
         uses: Swatinem/rust-cache@v2
         with:
           save-if: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
-      - uses: taiki-e/install-action@v2
-        with:
-          tool: nextest,just,cargo-deny,cargo-msrv,cargo-machete
-      - name: Install direnv/shfmt
-        run: sudo apt-get update; sudo apt-get install direnv shfmt
       - name: Run cargo nextest
         run: cargo nextest run --all-features
         env:
@@ -40,6 +36,7 @@ jobs:
 
   coverage:
     name: coverage-${{matrix.tranche}}
+    container: ghcr.io/jdx/rtx:github-actions
     runs-on: ubuntu-latest
     timeout-minutes: 30
     strategy:
@@ -49,18 +46,11 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-      - run: rustup toolchain install nightly --component llvm-tools-preview
       - name: Rust Cache
         uses: Swatinem/rust-cache@v2
         with:
           shared-key: coverage
           save-if: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
-      - uses: taiki-e/install-action@cargo-llvm-cov
-      - name: Install zsh/fish/direnv
-        run: sudo apt-get update; sudo apt-get install zsh fish direnv shfmt
-      - run: npm i -g markdown-magic
-      - name: Install just
-        uses: taiki-e/install-action@just
       - name: Run tests with coverage
         uses: nick-fields/retry@v2
         env:
@@ -69,6 +59,7 @@ jobs:
           RTX_GITHUB_BOT_TOKEN: ${{ secrets.RTX_GITHUB_BOT_TOKEN }}
           TEST_TRANCHE: ${{matrix.tranche}}
           TEST_TRANCHE_COUNT: 4
+          RTX_DEBUG: "1"
         with:
           timeout_minutes: 30
           max_attempts: 2
@@ -89,6 +80,8 @@ jobs:
         target:
           - aarch64-unknown-linux-gnu
           - x86_64-unknown-linux-gnu
+          - arm-unknown-linux-musleabihf
+          - armv7-unknown-linux-gnueabihf
     steps:
       - uses: actions/checkout@v4
       - name: Rust Cache
@@ -142,6 +135,7 @@ jobs:
           if-no-files-found: error
   e2e-linux:
     runs-on: ubuntu-22.04
+    container: ghcr.io/jdx/rtx:github-actions
     needs: [build-linux]
     timeout-minutes: 30
     if: github.event_name != 'pull_request'
@@ -168,7 +162,7 @@ jobs:
     runs-on: ubuntu-22.04
     needs: [build-linux]
     timeout-minutes: 10
-    container: jdxcode/rtx:rpm
+    container: ghcr.io/jdx/rtx:rpm
     if: github.event_name != 'pull_request'
     steps:
       - uses: actions/checkout@v4
@@ -191,7 +185,7 @@ jobs:
           if-no-files-found: error
   deb:
     runs-on: ubuntu-22.04
-    container: jdxcode/rtx:deb
+    container: ghcr.io/jdx/rtx:deb
     timeout-minutes: 10
     if: github.event_name != 'pull_request'
     needs: [build-linux]
@@ -217,6 +211,7 @@ jobs:
   release:
     runs-on: ubuntu-22.04
     if: startsWith(github.event.ref, 'refs/tags/v')
+    container: ghcr.io/jdx/rtx:github-actions
     timeout-minutes: 10
     permissions:
       contents: write
@@ -305,7 +300,7 @@ jobs:
           formula: rtx
   bump-alpine:
     runs-on: ubuntu-22.04
-    container: jdxcode/rtx:alpine
+    container: ghcr.io/jdx/rtx:alpine
     timeout-minutes: 30
     needs: [release]
     steps:
diff --git a/packaging/github-actions/Dockerfile b/packaging/github-actions/Dockerfile
new file mode 100644
index 0000000000..6a5becacc5
--- /dev/null
+++ b/packaging/github-actions/Dockerfile
@@ -0,0 +1,76 @@
+FROM ubuntu
+LABEL maintainer="jdx"
+
+ENV PATH="/root/.cargo/bin:${PATH}"
+ENV CARGO_HOME="/root/.cargo"
+ENV RUSTUP_HOME="/root/.rustup"
+ENV DEBIAN_FRONTEND=noninteractive
+ENV TZ=Etc/UTC
+
+RUN apt-get update \
+    && apt-get upgrade -y \
+    && apt-get install -y \
+        autoconf \
+        bash \
+        build-essential \
+        ca-certificates \
+        curl \
+        direnv \
+        fd-find \
+        fish \
+        git \
+        gnupg \
+        libbz2-dev \
+        libdb-dev \
+        libffi-dev \
+        libgdbm-dev \
+        libgdbm6 \
+        libgmp-dev \
+        liblzma-dev \
+        libncurses5-dev \
+        libncursesw5-dev \
+        libreadline-dev \
+        libreadline6-dev \
+        libsqlite3-dev \
+        libssl-dev \
+        libxml2-dev \
+        libxmlsec1-dev \
+        libyaml-dev \
+        patch \
+        pkg-config \
+        rustc \
+        shellcheck \
+        shfmt \
+        sudo \
+        tk-dev \
+        uuid-dev
+        xz-utils \
+        zlib1g-dev \
+        zsh \
+    && ln -s /usr/bin/{fdfind,fd} \
+    && mkdir -p /etc/apt/keyrings \
+    && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
+    && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.list \
+    && apt-get update && apt-get install -y nodejs \
+    && node -v \
+    && npm i -g markdown-magic \
+    && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
+    && curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash \
+    && rustup install stable && rustup default stable \
+    && rustup toolchain install nightly --component llvm-tools-preview \
+    && cargo install \
+       cargo-msrv \
+    && cargo binstall -y \
+        cargo-deny \
+        cargo-llvm-cov \
+        cargo-machete \
+        cargo-nextest \
+        cross \
+        just \
+        zipsign \
+    && apt-get clean \
+    && rustc -vV \
+    && cargo -V \
+    && node -v \
+    && npm -v \
+    && just --version
diff --git a/scripts/build-tarball.sh b/scripts/build-tarball.sh
index d05b7982a1..ef7c5d0ab9 100755
--- a/scripts/build-tarball.sh
+++ b/scripts/build-tarball.sh
@@ -45,6 +45,12 @@ get_arch() {
 	aarch64-*)
 		echo "arm64"
 		;;
+	arm-*)
+		echo "armv6"
+		;;
+	armv7-*)
+		echo "armv7"
+		;;
 	x86_64-*)
 		echo "x64"
 		;;
diff --git a/scripts/release-npm.sh b/scripts/release-npm.sh
index 849629248f..01152814f8 100755
--- a/scripts/release-npm.sh
+++ b/scripts/release-npm.sh
@@ -23,6 +23,8 @@ dist_tag="$(dist_tag_from_version "$RTX_VERSION")"
 platforms=(
 	linux-x64
 	linux-arm64
+	linux-armv6
+	linux-armv7
 	macos-x64
 	macos-arm64
 )
diff --git a/scripts/release.sh b/scripts/release.sh
index 2cf0630e19..c9bbdaa33b 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -10,12 +10,11 @@ export RTX_VERSION RELEASE_DIR
 rm -rf "${RELEASE_DIR:?}/$RTX_VERSION"
 mkdir -p "$RELEASE_DIR/$RTX_VERSION"
 
-#cp artifacts/tarball-x86_64-pc-windows-gnu/*.zip "$RELEASE_DIR/$RTX_VERSION"
-#cp artifacts/tarball-x86_64-pc-windows-gnu/*.zip "$RELEASE_DIR/rtx-latest-windows.zip"
-
 targets=(
 	x86_64-unknown-linux-gnu
 	aarch64-unknown-linux-gnu
+	arm-unknown-linux-gnueabihf
+	armv7-unknown-linux-gnueabihf
 	x86_64-apple-darwin
 	aarch64-apple-darwin
 )
@@ -27,6 +26,8 @@ done
 platforms=(
 	linux-x64
 	linux-arm64
+	linux-armv6
+	linux-armv7
 	macos-x64
 	macos-arm64
 )
@@ -60,7 +61,7 @@ gpg -u 408B88DB29DDE9E0 --output "$RELEASE_DIR"/install.sh.sig --sign "$RELEASE_
 
 NPM_PREFIX=@jdxcode/rtx ./rtx/scripts/release-npm.sh
 NPM_PREFIX=rtx-cli ./rtx/scripts/release-npm.sh
-AWS_S3_BUCKET=rtx.pub ./rtx/scripts/publish-s3.sh
+#AWS_S3_BUCKET=rtx.pub ./rtx/scripts/publish-s3.sh
 ./rtx/scripts/publish-r2.sh
 
 ./rtx/scripts/render-homebrew.sh >homebrew-tap/rtx.rb
diff --git a/scripts/render-homebrew.sh b/scripts/render-homebrew.sh
index 11788fb92c..c906a41f3a 100755
--- a/scripts/render-homebrew.sh
+++ b/scripts/render-homebrew.sh
@@ -5,6 +5,8 @@ set -euxo pipefail
 RTX_VERSION=${RTX_VERSION#v*} \
 	RTX_CHECKSUM_LINUX_X86_64=$(grep "rtx-v$RTX_VERSION-linux-x64.tar.xz" "$RELEASE_DIR/v$RTX_VERSION/SHASUMS256.txt" | cut -d ' ' -f1) \
 	RTX_CHECKSUM_LINUX_ARM64=$(grep "rtx-v$RTX_VERSION-linux-arm64.tar.xz" "$RELEASE_DIR/v$RTX_VERSION/SHASUMS256.txt" | cut -d ' ' -f1) \
+	RTX_CHECKSUM_LINUX_ARMV6=$(grep "rtx-v$RTX_VERSION-linux-armv6.tar.xz" "$RELEASE_DIR/v$RTX_VERSION/SHASUMS256.txt" | cut -d ' ' -f1) \
+	RTX_CHECKSUM_LINUX_ARMV7=$(grep "rtx-v$RTX_VERSION-linux-armv7.tar.xz" "$RELEASE_DIR/v$RTX_VERSION/SHASUMS256.txt" | cut -d ' ' -f1) \
 	RTX_CHECKSUM_MACOS_X86_64=$(grep "rtx-v$RTX_VERSION-macos-x64.tar.xz" "$RELEASE_DIR/v$RTX_VERSION/SHASUMS256.txt" | cut -d ' ' -f1) \
 	RTX_CHECKSUM_MACOS_ARM64=$(grep "rtx-v$RTX_VERSION-macos-arm64.tar.xz" "$RELEASE_DIR/v$RTX_VERSION/SHASUMS256.txt" | cut -d ' ' -f1) \
 	envsubst '$RTX_VERSION,$RTX_CHECKSUM_LINUX_X86_64,$RTX_CHECKSUM_LINUX_ARM64,$RTX_CHECKSUM_MACOS_X86_64,$RTX_CHECKSUM_MACOS_ARM64' \
diff --git a/scripts/render-install.sh b/scripts/render-install.sh
index f417830637..fa3d375640 100755
--- a/scripts/render-install.sh
+++ b/scripts/render-install.sh
@@ -5,6 +5,8 @@ set -euxo pipefail
 RTX_VERSION=$RTX_VERSION \
 	RTX_CHECKSUM_LINUX_X86_64=$(grep "rtx-v.*linux-x64.tar.gz" "$RELEASE_DIR/$RTX_VERSION/SHASUMS256.txt") \
 	RTX_CHECKSUM_LINUX_ARM64=$(grep "rtx-v.*linux-arm64.tar.gz" "$RELEASE_DIR/$RTX_VERSION/SHASUMS256.txt") \
+	RTX_CHECKSUM_LINUX_ARMV6=$(grep "rtx-v.*linux-armv6.tar.gz" "$RELEASE_DIR/$RTX_VERSION/SHASUMS256.txt") \
+	RTX_CHECKSUM_LINUX_ARMV7=$(grep "rtx-v.*linux-armv7.tar.gz" "$RELEASE_DIR/$RTX_VERSION/SHASUMS256.txt") \
 	RTX_CHECKSUM_MACOS_X86_64=$(grep "rtx-v.*macos-x64.tar.gz" "$RELEASE_DIR/$RTX_VERSION/SHASUMS256.txt") \
 	RTX_CHECKSUM_MACOS_ARM64=$(grep "rtx-v.*macos-arm64.tar.gz" "$RELEASE_DIR/$RTX_VERSION/SHASUMS256.txt") \
 	envsubst '$RTX_VERSION,$RTX_CHECKSUM_LINUX_X86_64,$RTX_CHECKSUM_LINUX_ARM64,$RTX_CHECKSUM_MACOS_X86_64,$RTX_CHECKSUM_MACOS_ARM64' \
diff --git a/src/file.rs b/src/file.rs
index 2a2e4e5651..0aef0aaf4a 100644
--- a/src/file.rs
+++ b/src/file.rs
@@ -202,7 +202,8 @@ pub fn is_executable(path: &Path) -> bool {
 pub fn make_executable(path: &Path) -> Result<()> {
     let mut perms = path.metadata()?.permissions();
     perms.set_mode(perms.mode() | 0o111);
-    fs::set_permissions(path, perms)?;
+    fs::set_permissions(path, perms)
+        .wrap_err_with(|| format!("failed to chmod +x: {}", display_path(path)))?;
     Ok(())
 }