diff --git a/.gitea/workflows/CI.yaml b/.gitea/workflows/CI.yaml
index 9032078..80fc03a 100644
--- a/.gitea/workflows/CI.yaml
+++ b/.gitea/workflows/CI.yaml
@@ -3,9 +3,35 @@ name: CI
 on: [push]
 
 jobs:
+  # This step builds the `gas/ci` docker image.
+  # There's a tricky bootstrapping problem here.  Let's use Alpine and install `gocheckout` first
+  # thing.
+  build-docker:
+    container:
+      image: alpine:3.22
+      volumes:
+        - woodpecker-gocache:/go-cache-volume
+      env:
+        GOPATH: /go-cache-volume
+        GOCACHE: /go-cache-volume/build-cache
+    steps:
+      - name: checkout
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          env
+          GOBIN=/usr/local/go/bin go install git.offline-twitter.com/offline-labs/gocheckout@v0.0.1
+          gocheckout
+
+      - name: install docker
+        run: apk add docker
+
+      - name: build CI container
+        run: docker build -t gas/ci ops/devcontainer
+
   release-test:
     container:
-      image: offline-twitter/go
+      image: gas/ci
       volumes:
         - woodpecker-gocache:/go-cache-volume
       env:
diff --git a/ops/devcontainer/Dockerfile b/ops/devcontainer/Dockerfile
new file mode 100644
index 0000000..70f9540
--- /dev/null
+++ b/ops/devcontainer/Dockerfile
@@ -0,0 +1,7 @@
+# A dev container.
+
+FROM alpine:3.22
+
+RUN apk add build-base git go sqlite shellcheck curl jq
+
+RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b /usr/local/bin v2.0.2