Run Paseo from an official Docker image (#1740)

* Add Docker images and agent Docker Mods

Ship official container images that run the Paseo daemon headless. One
Dockerfile parametrized by BASE_IMAGE covers Debian 12/13, Ubuntu 22.04/24.04
and Alpine; it bundles Node 22, the npm-published server + CLI, a vendored
s6-overlay as PID 1, and a small Docker Mods loader.

Agents are chosen at runtime via DOCKER_MODS (pipe-separated mod images). Each
mod is a FROM scratch image carrying only an install hook that runs
`npm install -g <agent-cli>`; the loader pulls the layers from the registry,
extracts them, and runs the hook before the daemon starts, so any requested
agent is on PATH when Paseo probes provider availability.

- docker/base: Dockerfile, install scripts, s6 services, mods loader
- docker/mods/*: claude-code, codex, copilot, opencode, pi
- docker/docker-compose.example.yml + docker/README.md
- .github/workflows/docker.yml: multi-arch (amd64/arm64) buildx matrix,
  publishes to ghcr.io/getpaseo on version tags
- docs/docker.md + CLAUDE.md docs index row

* feat(docker): print pairing QR and link on daemon startup

Add an s6 oneshot service that waits for the daemon to listen, then runs
`paseo daemon pair` so the pairing QR code and link surface in the container
logs. Best-effort: never blocks boot, skips gracefully when relay is disabled.
Opt out with PASEO_PAIRING_QR=0.

* build(docker): add Arch image support

* ci(docker): build Arch without Buildx

* docs(docker): document paseo env contract

* feat(docker): add opt-in sudo mode

* docs(docker): link env references

* fix(docker): create agent config dirs

* fix(docker): default home to /home/paseo

* docs(docker): document agent auth setup

* docs(docker): document relay port setup

* fix(docker): install Node from tarball

* docs: add Docker quick start

* docs(docker): remove legacy home example

* docs(docker): set container hostname

* fix(docker): prepare opencode storage

* fix(docker): allow paseo login shell

* fix docker opencode permissions

* ci(docker): use Node 24 actions

* fix(docker): install bzip2 runtime tools

* fix(docker): update Pi mod package

* fix(docker): quiet default daemon logs

* fix(docker): split home from state

Docker images now keep HOME at /home/paseo and store Paseo daemon state under /home/paseo/.paseo by default.

Existing volumes can keep the old layout by setting PASEO_HOME=/home/paseo.

* fix(docker): keep mods out of paseo home

* ci(docker): skip alpine arm64 builds

* fix(docker): address review findings

* fix(docker): verify s6 overlay downloads

* fix(docker): honor custom healthcheck port

* fix(docker): fail on mod extraction errors

* feat(docker): add official container image

Ship a focused daemon image with the bundled web UI enabled and document extending it with agent CLIs.

* ci(docker): publish images only on stable releases

* fix(docker): check daemon health over HTTP

---------

Co-authored-by: Herbrant <cdavide98carnemolla@gmail.com>

.github/workflows/docker.yml

@@ -0,0 +1,131 @@
+name: Docker
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - "docker/**"
+      - ".github/workflows/docker.yml"
+  push:
+    branches: [main]
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      paseo_version:
+        description: "Paseo npm version to build for validation. Defaults to latest."
+        required: false
+        default: ""
+
+concurrency:
+  group: docker-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  REGISTRY: ghcr.io
+  PLATFORMS: linux/amd64,linux/arm64
+
+jobs:
+  setup:
+    runs-on: ubuntu-latest
+    outputs:
+      image: ${{ steps.values.outputs.image }}
+      install_version: ${{ steps.values.outputs.install_version }}
+      publish: ${{ steps.values.outputs.publish }}
+      check_tag: ${{ steps.values.outputs.check_tag }}
+      publish_tags: ${{ steps.values.outputs.publish_tags }}
+    steps:
+      - uses: actions/checkout@v6
+
+      - id: values
+        env:
+          INPUT_PASEO_VERSION: ${{ inputs.paseo_version }}
+          REPO_OWNER: ${{ github.repository_owner }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+
+          owner="$(printf '%s' "${REPO_OWNER}" | tr '[:upper:]' '[:lower:]')"
+          image="ghcr.io/${owner}/paseo"
+          install_version="${INPUT_PASEO_VERSION:-latest}"
+          publish=false
+
+          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
+            install_version="${REF_NAME#v}"
+            if [[ "${REF_NAME}" != *-* ]]; then
+              publish=true
+            fi
+          fi
+
+          check_tag="${image}:check-${GITHUB_SHA::12}"
+          publish_tags="${image}:${install_version}"$'\n'"${image}:latest"
+
+          {
+            echo "image=${image}"
+            echo "install_version=${install_version}"
+            echo "publish=${publish}"
+            echo "check_tag=${check_tag}"
+            echo "publish_tags<<EOF"
+            echo "${publish_tags}"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+          echo "Resolved image=${image} install_version=${install_version} publish=${publish}"
+
+  build:
+    needs: setup
+    if: needs.setup.outputs.publish != 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: docker/setup-qemu-action@v4
+      - uses: docker/setup-buildx-action@v4
+
+      - uses: docker/build-push-action@v7
+        with:
+          context: docker/base
+          file: docker/base/Dockerfile
+          platforms: ${{ env.PLATFORMS }}
+          build-args: |
+            PASEO_VERSION=${{ needs.setup.outputs.install_version }}
+          tags: ${{ needs.setup.outputs.check_tag }}
+          push: false
+          provenance: false
+          cache-from: type=gha,scope=paseo
+          cache-to: type=gha,scope=paseo,mode=max
+
+  publish:
+    needs: setup
+    if: needs.setup.outputs.publish == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: docker/setup-qemu-action@v4
+      - uses: docker/setup-buildx-action@v4
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/build-push-action@v7
+        with:
+          context: docker/base
+          file: docker/base/Dockerfile
+          platforms: ${{ env.PLATFORMS }}
+          build-args: |
+            PASEO_VERSION=${{ needs.setup.outputs.install_version }}
+          tags: ${{ needs.setup.outputs.publish_tags }}
+          push: true
+          provenance: false
+          cache-from: type=gha,scope=paseo
+          cache-to: type=gha,scope=paseo,mode=max