diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 0000000000..7ae2b38fcf
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,63 @@
+name: docker
+
+on:
+  push:
+    tags: ["v*"]
+    branches: ['docker-release']
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  docker:
+    name: docker-${{ matrix.flavor }}
+    strategy:
+      fail-fast: false
+      matrix:
+        flavor:
+          - alpine
+          - deb
+          - github-actions
+          - rpm
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ghcr.io/jdx/rtx:${{ matrix.flavor }}
+          labels: ${{ steps.meta.outputs.labels }}
+          file: packaging/${{ matrix.flavor }}/Dockerfile
+  test:
+    runs-on: ubuntu-22.04
+    container: ghcr.io/jdx/rtx:github-actions
+    timeout-minutes: 10
+    steps:
+      - run: node -v
+      - run: cargo -V
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Run cargo nextest
+        run: cargo nextest run --all-features
+        env:
+          RUST_BACKTRACE: "1"
diff --git a/.github/workflows/rtx.yml b/.github/workflows/rtx.yml
index 0f22f02a14..3fe055e308 100644
--- a/.github/workflows/rtx.yml
+++ b/.github/workflows/rtx.yml
@@ -16,6 +16,7 @@ env:
 jobs:
   unit:
     runs-on: ubuntu-22.04
+    container: ghcr.io/jdx/rtx:github-actions
     timeout-minutes: 10
     steps:
       - name: Checkout
@@ -24,11 +25,6 @@ jobs:
         uses: Swatinem/rust-cache@v2
         with:
           save-if: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
-      - uses: taiki-e/install-action@v2
-        with:
-          tool: nextest,just,cargo-deny,cargo-msrv,cargo-machete
-      - name: Install direnv/shfmt
-        run: sudo apt-get update; sudo apt-get install direnv shfmt
       - name: Run cargo nextest
         run: cargo nextest run --all-features
         env:
@@ -40,6 +36,7 @@ jobs:
 
   coverage:
     name: coverage-${{matrix.tranche}}
+    container: ghcr.io/jdx/rtx:github-actions
     runs-on: ubuntu-latest
     timeout-minutes: 30
     strategy:
@@ -49,18 +46,11 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-      - run: rustup toolchain install nightly --component llvm-tools-preview
       - name: Rust Cache
         uses: Swatinem/rust-cache@v2
         with:
           shared-key: coverage
           save-if: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
-      - uses: taiki-e/install-action@cargo-llvm-cov
-      - name: Install zsh/fish/direnv
-        run: sudo apt-get update; sudo apt-get install zsh fish direnv shfmt
-      - run: npm i -g markdown-magic
-      - name: Install just
-        uses: taiki-e/install-action@just
       - name: Run tests with coverage
         uses: nick-fields/retry@v2
         env:
@@ -69,6 +59,7 @@ jobs:
           RTX_GITHUB_BOT_TOKEN: ${{ secrets.RTX_GITHUB_BOT_TOKEN }}
           TEST_TRANCHE: ${{matrix.tranche}}
           TEST_TRANCHE_COUNT: 4
+          RTX_VERBOSE: "1"
         with:
           timeout_minutes: 30
           max_attempts: 2
@@ -142,6 +133,7 @@ jobs:
           if-no-files-found: error
   e2e-linux:
     runs-on: ubuntu-22.04
+    container: ghcr.io/jdx/rtx:github-actions
     needs: [build-linux]
     timeout-minutes: 30
     if: github.event_name != 'pull_request'
@@ -168,7 +160,7 @@ jobs:
     runs-on: ubuntu-22.04
     needs: [build-linux]
     timeout-minutes: 10
-    container: jdxcode/rtx:rpm
+    container: ghcr.io/jdx/rtx:rpm
     if: github.event_name != 'pull_request'
     steps:
       - uses: actions/checkout@v4
@@ -191,7 +183,7 @@ jobs:
           if-no-files-found: error
   deb:
     runs-on: ubuntu-22.04
-    container: jdxcode/rtx:deb
+    container: ghcr.io/jdx/rtx:deb
     timeout-minutes: 10
     if: github.event_name != 'pull_request'
     needs: [build-linux]
@@ -217,6 +209,7 @@ jobs:
   release:
     runs-on: ubuntu-22.04
     if: startsWith(github.event.ref, 'refs/tags/v')
+    container: ghcr.io/jdx/rtx:github-actions
     timeout-minutes: 10
     permissions:
       contents: write
@@ -305,7 +298,7 @@ jobs:
           formula: rtx
   bump-alpine:
     runs-on: ubuntu-22.04
-    container: jdxcode/rtx:alpine
+    container: ghcr.io/jdx/rtx:alpine
     timeout-minutes: 30
     needs: [release]
     steps:
diff --git a/packaging/github-actions/Dockerfile b/packaging/github-actions/Dockerfile
new file mode 100644
index 0000000000..20c8c7133b
--- /dev/null
+++ b/packaging/github-actions/Dockerfile
@@ -0,0 +1,62 @@
+FROM ubuntu
+LABEL maintainer="jdx"
+
+ENV PATH="/root/.cargo/bin:${PATH}"
+ENV CARGO_HOME="/root/.cargo"
+ENV RUSTUP_HOME="/root/.rustup"
+
+RUN apt-get update \
+    && apt-get upgrade -y \
+    && apt-get install -y \
+        bash \
+        build-essential \
+        ca-certificates \
+        curl \
+        direnv \
+        fd-find \
+        fish \
+        git \
+        gnupg \
+        libbz2-dev \
+        libffi-dev \
+        liblzma-dev \
+        libncursesw5-dev \
+        libreadline-dev \
+        libsqlite3-dev \
+        libssl-dev \
+        libxml2-dev \
+        libxmlsec1-dev \
+        pkg-config \
+        shellcheck \
+        shfmt \
+        sudo \
+        tk-dev \
+        xz-utils \
+        zlib1g-dev \
+    && ln -s /usr/bin/{fdfind,fd} \
+    && mkdir -p /etc/apt/keyrings \
+    && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
+    && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.list \
+    && apt-get update && apt-get install -y nodejs \
+    && node -v \
+    && npm i -g markdown-magic \
+    && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
+    && curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash \
+    && rustup install stable && rustup default stable \
+    && rustup toolchain install nightly --component llvm-tools-preview \
+    && cargo install \
+       cargo-msrv \
+    && cargo binstall -y \
+        cargo-deny \
+        cargo-llvm-cov \
+        cargo-machete \
+        cargo-nextest \
+        cross \
+        just \
+        zipsign \
+    && apt-get clean \
+    && rustc -vV \
+    && cargo -V \
+    && node -v \
+    && npm -v \
+    && just --version