feat: Publish docker image to ghcr

This Github workflow builds & publishes an OCI/Docker container image to Github/s Container Registry (ghcr.io).

It also adds a brief intro for how to use it in the README, and removes the (now outdated) `tools/docker/README.md`.

.github/workflows/release.yml

@@ -71,3 +71,42 @@ jobs:
         files: 'agate.*.gz'
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         release-tag: ${{ github.ref_name }}
+
+  build_docker:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Log into GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Extract metadata for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          # Because this workflow only runs on commits tagged `v*` (i n semver format) this section ensures that
+          # a docker build tagged `v1.2.3+podman.build` is tagged with `1`, `1.2`, `1.2.3` and `1.2.3+podman.build`
+          # as well as being tagged with `latest`. For each of these, a subsequent build that has the same tag will
+          # replace it. This means that pulling `ghcr.io/mbrubeck/agate:1` will always get the most recent image
+          # released with a v1 tag, container, `ghcr.io/mbrubeck/agate:1.2` will get the latest v1.2 tag, and so on.
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}.{{patch}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

README.md

@@ -38,6 +38,23 @@ Install the package [`agate-bin`](https://aur.archlinux.org/packages/agate-bin/)
 
 If you have the Rust toolchain installed, run `cargo install agate` to install agate from crates.io.
 
+### Docker
+
+Recent builds have also been released as OCI/Docker images on Github's Container Registry (ghcr.io). Most people will need to mount two volumes, one for your content, one for your certificates (this can be empty, they will be automatically generated if needed):
+
+```sh
+$ docker run \
+  -p 1965:1965 \
+  -v your/path/to/gmi:/gmi \
+  -v your/path/to/certs:/certs \
+  ghcr.io/mbrubeck/agate:latest \
+  --hostname example.org
+```
+
+This container will run without a mounted certificates directory, but new certificates will be lost when it shuts down and re-generated every time it boots, showing your site's visitors a certificate warning each time your server restarts.
+
+Each release is tagged with `major`, `major.minor`, `major.minor.patch`, as well as the full version string and "latest". This means `docker pull ghcr.io/mbrubeck/agate:3` will always retrieve the latest `v3.*` image, `…:3.3` the latest `v3.3.*` image, and `…:latest` the most recent release of any version.
+
 ### Source
 
 Download the source code and run `cargo build --release` inside the source repository, then find the binary at `target/release/agate`.