ci: use pre-built binaries for Docker instead of QEMU cross-compilation

QEMU arm64 Rust builds took 60+ min and timed out in CI. Now the Docker
job downloads the pre-built release binaries and packages them directly.

- Dockerfile.ci: slim image for CI (downloads pre-built binaries)
- Dockerfile: full source build for local dev (unchanged build stage)
- Both use ubuntu:24.04 (GLIBC 2.39 matches CI build environment)
- Multi-arch manifest combines amd64 + arm64 images

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/release.yml

@@ -99,11 +99,16 @@ jobs:
     name: Docker
     needs: release
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - platform: linux/amd64
+            binary_target: x86_64-unknown-linux-gnu
+          - platform: linux/arm64
+            binary_target: aarch64-unknown-linux-gnu
     steps:
       - uses: actions/checkout@v4
 
-      - uses: docker/setup-qemu-action@v3
-
       - uses: docker/setup-buildx-action@v3
 
       - uses: docker/login-action@v3
@@ -112,16 +117,53 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: docker/build-push-action@v6
+      # Download pre-built binaries from the release instead of recompiling
+      - name: Download release binaries
+        run: |
+          tag="${GITHUB_REF#refs/tags/}"
+          tarball="webclaw-${tag}-${{ matrix.binary_target }}.tar.gz"
+          curl -sSL "https://github.com/0xMassi/webclaw/releases/download/${tag}/${tarball}" -o release.tar.gz
+          tar xzf release.tar.gz
+          mkdir -p binaries
+          find . -name 'webclaw' -not -name 'webclaw-mcp' -path '*/webclaw-*/' -exec cp {} binaries/webclaw \;
+          find . -name 'webclaw-mcp' -exec cp {} binaries/webclaw-mcp \;
+          chmod +x binaries/*
+          ls -la binaries/
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
         with:
           context: .
+          file: Dockerfile.ci
           push: true
-          platforms: linux/amd64,linux/arm64
-          tags: |
-            ghcr.io/0xmassi/webclaw:latest
-            ghcr.io/0xmassi/webclaw:${{ github.ref_name }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          platforms: ${{ matrix.platform }}
+          tags: ghcr.io/0xmassi/webclaw:${{ github.ref_name }}-${{ matrix.binary_target }}
+          build-args: |
+            BINARY_DIR=binaries
+
+  docker-manifest:
+    name: Docker Manifest
+    needs: docker
+    runs-on: ubuntu-latest
+    steps:
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create multi-arch manifest
+        run: |
+          tag="${GITHUB_REF#refs/tags/}"
+          docker manifest create ghcr.io/0xmassi/webclaw:${tag} \
+            ghcr.io/0xmassi/webclaw:${tag}-x86_64-unknown-linux-gnu \
+            ghcr.io/0xmassi/webclaw:${tag}-aarch64-unknown-linux-gnu
+          docker manifest push ghcr.io/0xmassi/webclaw:${tag}
+
+          docker manifest create ghcr.io/0xmassi/webclaw:latest \
+            ghcr.io/0xmassi/webclaw:${tag}-x86_64-unknown-linux-gnu \
+            ghcr.io/0xmassi/webclaw:${tag}-aarch64-unknown-linux-gnu
+          docker manifest push ghcr.io/0xmassi/webclaw:latest
 
   homebrew:
     name: Update Homebrew

Dockerfile

@@ -46,11 +46,10 @@ RUN touch crates/*/src/*.rs \
 # ---------------------------------------------------------------------------
 # Stage 2: Minimal runtime image
 # ---------------------------------------------------------------------------
-FROM debian:bookworm-slim
+FROM ubuntu:24.04
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
-    libssl3 \
     && rm -rf /var/lib/apt/lists/*
 
 # Copy both binaries

Dockerfile.ci

@@ -0,0 +1,16 @@
+# Slim runtime image — uses pre-built binaries from the release.
+# The full Dockerfile (multi-stage Rust build) is for local development.
+# CI uses this to avoid 60+ min QEMU cross-compilation.
+ARG BINARY_DIR=binaries
+
+FROM ubuntu:24.04
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+ARG BINARY_DIR
+COPY ${BINARY_DIR}/webclaw /usr/local/bin/webclaw
+COPY ${BINARY_DIR}/webclaw-mcp /usr/local/bin/webclaw-mcp
+
+CMD ["webclaw"]