Run Paseo from an official Docker image (#1740)

* Add Docker images and agent Docker Mods

Ship official container images that run the Paseo daemon headless. One
Dockerfile parametrized by BASE_IMAGE covers Debian 12/13, Ubuntu 22.04/24.04
and Alpine; it bundles Node 22, the npm-published server + CLI, a vendored
s6-overlay as PID 1, and a small Docker Mods loader.

Agents are chosen at runtime via DOCKER_MODS (pipe-separated mod images). Each
mod is a FROM scratch image carrying only an install hook that runs
`npm install -g <agent-cli>`; the loader pulls the layers from the registry,
extracts them, and runs the hook before the daemon starts, so any requested
agent is on PATH when Paseo probes provider availability.

- docker/base: Dockerfile, install scripts, s6 services, mods loader
- docker/mods/*: claude-code, codex, copilot, opencode, pi
- docker/docker-compose.example.yml + docker/README.md
- .github/workflows/docker.yml: multi-arch (amd64/arm64) buildx matrix,
  publishes to ghcr.io/getpaseo on version tags
- docs/docker.md + CLAUDE.md docs index row

* feat(docker): print pairing QR and link on daemon startup

Add an s6 oneshot service that waits for the daemon to listen, then runs
`paseo daemon pair` so the pairing QR code and link surface in the container
logs. Best-effort: never blocks boot, skips gracefully when relay is disabled.
Opt out with PASEO_PAIRING_QR=0.

* build(docker): add Arch image support

* ci(docker): build Arch without Buildx

* docs(docker): document paseo env contract

* feat(docker): add opt-in sudo mode

* docs(docker): link env references

* fix(docker): create agent config dirs

* fix(docker): default home to /home/paseo

* docs(docker): document agent auth setup

* docs(docker): document relay port setup

* fix(docker): install Node from tarball

* docs: add Docker quick start

* docs(docker): remove legacy home example

* docs(docker): set container hostname

* fix(docker): prepare opencode storage

* fix(docker): allow paseo login shell

* fix docker opencode permissions

* ci(docker): use Node 24 actions

* fix(docker): install bzip2 runtime tools

* fix(docker): update Pi mod package

* fix(docker): quiet default daemon logs

* fix(docker): split home from state

Docker images now keep HOME at /home/paseo and store Paseo daemon state under /home/paseo/.paseo by default.

Existing volumes can keep the old layout by setting PASEO_HOME=/home/paseo.

* fix(docker): keep mods out of paseo home

* ci(docker): skip alpine arm64 builds

* fix(docker): address review findings

* fix(docker): verify s6 overlay downloads

* fix(docker): honor custom healthcheck port

* fix(docker): fail on mod extraction errors

* feat(docker): add official container image

Ship a focused daemon image with the bundled web UI enabled and document extending it with agent CLIs.

* ci(docker): publish images only on stable releases

* fix(docker): check daemon health over HTTP

---------

Co-authored-by: Herbrant <cdavide98carnemolla@gmail.com>

docker/Dockerfile.agents.example

@@ -0,0 +1,17 @@
+# Example child image that adds agent CLIs to the official Paseo image.
+#
+# Build:
+#   docker build -f docker/Dockerfile.agents.example -t paseo-with-agents .
+#
+# Then set `image: paseo-with-agents` in docker/docker-compose.example.yml.
+
+FROM ghcr.io/getpaseo/paseo:latest
+
+USER root
+RUN npm install -g \
+  @anthropic-ai/claude-code \
+  @openai/codex \
+  opencode-ai
+
+# Leave the image user as root. The base entrypoint prepares mounted volumes,
+# then drops the daemon and launched agents to the non-root `paseo` user.

docker/README.md

@@ -0,0 +1,30 @@
+# Paseo Docker Image
+
+This directory contains the official Paseo daemon image.
+
+The image runs the daemon headless and serves the bundled web UI from the same
+HTTP origin. Start it, then open the daemon URL in a browser.
+
+```bash
+docker run -d --name paseo \
+  -p 6767:6767 \
+  -e PASEO_PASSWORD=change-me \
+  -v "$PWD/paseo-home:/home/paseo" \
+  -v "$PWD:/workspace" \
+  ghcr.io/getpaseo/paseo:latest
+```
+
+Then open `http://localhost:6767`.
+
+The base image intentionally does not bundle agent CLIs. Extend it with the
+agents you use:
+
+```Dockerfile
+FROM ghcr.io/getpaseo/paseo:latest
+
+USER root
+RUN npm install -g @openai/codex @anthropic-ai/claude-code
+```
+
+See [docs/docker.md](../docs/docker.md) for Compose, reverse proxy, security,
+agent auth, and troubleshooting notes.

docker/base/Dockerfile

@@ -0,0 +1,79 @@
+# syntax=docker/dockerfile:1
+
+ARG NODE_IMAGE=node:22-bookworm-slim
+FROM ${NODE_IMAGE}
+
+ARG PASEO_VERSION=latest
+
+ENV HOME=/home/paseo \
+    PASEO_HOME=/home/paseo/.paseo \
+    PASEO_LISTEN=0.0.0.0:6767 \
+    PASEO_WEB_UI_ENABLED=true \
+    PASEO_LOG_FORMAT=json \
+    PASEO_LOG_LEVEL=info \
+    CLAUDE_CONFIG_DIR=/home/paseo/.claude \
+    CODEX_HOME=/home/paseo/.codex \
+    XDG_CONFIG_HOME=/home/paseo/.config \
+    XDG_DATA_HOME=/home/paseo/.local/share \
+    XDG_STATE_HOME=/home/paseo/.local/state \
+    XDG_CACHE_HOME=/home/paseo/.cache \
+    ONNXRUNTIME_NODE_INSTALL=skip
+
+RUN set -eux; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends \
+      bash \
+      ca-certificates \
+      curl \
+      git \
+      gosu \
+      openssh-client \
+      tini; \
+    rm -rf /var/lib/apt/lists/*
+
+RUN set -eux; \
+    npm install -g --omit=optional \
+      "@getpaseo/server@${PASEO_VERSION}" \
+      "@getpaseo/cli@${PASEO_VERSION}"; \
+    npm cache clean --force; \
+    server_entry="$(npm root -g)/@getpaseo/server/dist/scripts/supervisor-entrypoint.js"; \
+    test -f "$server_entry"; \
+    printf '%s\n' "$server_entry" > /etc/paseo-server-entry; \
+    node --check "$server_entry"
+
+RUN set -eux; \
+    existing_group="$(getent group 1000 | cut -d: -f1 || true)"; \
+    if [ -n "$existing_group" ] && [ "$existing_group" != "paseo" ]; then \
+      groupmod --new-name paseo "$existing_group"; \
+    elif [ -z "$existing_group" ]; then \
+      groupadd --gid 1000 paseo; \
+    fi; \
+    existing_user="$(getent passwd 1000 | cut -d: -f1 || true)"; \
+    if [ -n "$existing_user" ] && [ "$existing_user" != "paseo" ]; then \
+      usermod --login paseo --gid paseo --home /home/paseo --shell /bin/bash "$existing_user"; \
+    elif [ -z "$existing_user" ]; then \
+      useradd --uid 1000 --gid paseo --create-home --home-dir /home/paseo --shell /bin/bash paseo; \
+    fi; \
+    mkdir -p \
+      /workspace \
+      "$PASEO_HOME" \
+      "$CLAUDE_CONFIG_DIR" \
+      "$CODEX_HOME" \
+      "$XDG_CONFIG_HOME" \
+      "$XDG_DATA_HOME" \
+      "$XDG_STATE_HOME" \
+      "$XDG_CACHE_HOME"; \
+    chown -R paseo:paseo /home/paseo /workspace
+
+COPY rootfs/ /
+RUN chmod +x /usr/local/bin/paseo-docker-entrypoint
+
+WORKDIR /workspace
+
+EXPOSE 6767
+VOLUME ["/home/paseo"]
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+  CMD node -e "const listen=process.env.PASEO_LISTEN||'0.0.0.0:6767'; const m=listen.match(/:(\\d+)$/); const port=m?Number(m[1]):6767; require('http').get({hostname:'127.0.0.1',port,path:'/api/health'},r=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))"
+
+ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/paseo-docker-entrypoint"]

docker/base/rootfs/usr/local/bin/paseo-docker-entrypoint

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+IMAGE_HOME="/home/paseo"
+
+: "${HOME:=$IMAGE_HOME}"
+: "${PASEO_HOME:=${HOME}/.paseo}"
+: "${PASEO_LISTEN:=0.0.0.0:6767}"
+: "${PASEO_WEB_UI_ENABLED:=true}"
+: "${PASEO_LOG_LEVEL:=info}"
+: "${PASEO_LOG_FORMAT:=json}"
+: "${CLAUDE_CONFIG_DIR:=${HOME}/.claude}"
+: "${CODEX_HOME:=${HOME}/.codex}"
+: "${XDG_CONFIG_HOME:=${HOME}/.config}"
+: "${XDG_DATA_HOME:=${HOME}/.local/share}"
+: "${XDG_STATE_HOME:=${HOME}/.local/state}"
+: "${XDG_CACHE_HOME:=${HOME}/.cache}"
+
+export HOME
+export PASEO_HOME
+export PASEO_LISTEN
+export PASEO_WEB_UI_ENABLED
+export PASEO_LOG_LEVEL
+export PASEO_LOG_FORMAT
+export CLAUDE_CONFIG_DIR
+export CODEX_HOME
+export XDG_CONFIG_HOME
+export XDG_DATA_HOME
+export XDG_STATE_HOME
+export XDG_CACHE_HOME
+
+ensure_dir() {
+  local dir="$1"
+  mkdir -p "$dir"
+  if [[ "$(id -u)" == "0" ]]; then
+    local owner
+    owner="$(stat -c "%u" "$dir")"
+    if [[ "$owner" == "0" ]]; then
+      chown paseo:paseo "$dir"
+    fi
+  fi
+}
+
+ensure_dir "$HOME"
+ensure_dir "$PASEO_HOME"
+ensure_dir "$CLAUDE_CONFIG_DIR"
+ensure_dir "$CODEX_HOME"
+ensure_dir "$XDG_CONFIG_HOME"
+ensure_dir "$XDG_DATA_HOME"
+ensure_dir "$XDG_STATE_HOME"
+ensure_dir "$XDG_CACHE_HOME"
+
+if [[ "$#" -gt 0 ]]; then
+  if [[ "$(id -u)" == "0" ]]; then
+    exec gosu paseo "$@"
+  fi
+  exec "$@"
+fi
+
+if [[ -z "${PASEO_PASSWORD:-}" ]]; then
+  {
+    echo "[paseo] WARNING: PASEO_PASSWORD is not set."
+    echo "[paseo] The daemon accepts unauthenticated control connections from any client that can reach it."
+    echo "[paseo] Set PASEO_PASSWORD for any published port or network-reachable deployment."
+  } >&2
+fi
+
+if [[ ! -f /etc/paseo-server-entry ]]; then
+  echo "[paseo] FATAL: /etc/paseo-server-entry is missing." >&2
+  exit 1
+fi
+
+entry="$(cat /etc/paseo-server-entry)"
+echo "[paseo] starting daemon on ${PASEO_LISTEN} with web UI ${PASEO_WEB_UI_ENABLED}"
+if [[ "$(id -u)" == "0" ]]; then
+  exec gosu paseo node "$entry"
+fi
+exec node "$entry"

docker/docker-compose.example.yml

@@ -0,0 +1,21 @@
+# Minimal Paseo daemon + web UI deployment.
+#
+# Open http://localhost:6767 after `docker compose up -d`.
+# For any network-reachable deployment, change PASEO_PASSWORD first.
+services:
+  paseo:
+    image: ghcr.io/getpaseo/paseo:latest
+    container_name: paseo
+    restart: unless-stopped
+    ports:
+      - "6767:6767"
+    environment:
+      PASEO_PASSWORD: "change-me"
+      # Add DNS names you use to reach this container. IPs and localhost are
+      # already allowed by default.
+      # PASEO_HOSTNAMES: "paseo.example.com,.lan"
+    volumes:
+      # Persistent daemon state and agent credentials/config.
+      - ./paseo-home:/home/paseo
+      # Code visible to Paseo and the agents it launches.
+      - ./workspace:/workspace