feat(workspaces): implement workspace container image and initial hub api

packages/workspace-manager/docker/Dockerfile

@@ -0,0 +1,50 @@
+# Copyright 2026 Google LLC
+# SPDX-License-Identifier: Apache-2.0
+
+FROM node:20-slim
+
+# Install system dependencies
+RUN apt-get update && apt-get install -y \
+    git \
+    curl \
+    rsync \
+    vim \
+    tmux \
+    procps \
+    build-essential \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install GitHub CLI
+RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
+    && chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
+    && apt-get update \
+    && apt-get install gh -y
+
+# Install Rust (to install shpool)
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+ENV PATH="/root/.cargo/bin:${PATH}"
+
+# Install shpool
+RUN cargo install shpool \
+    && mv /root/.cargo/bin/shpool /usr/local/bin/shpool
+
+# Install global dev tools
+RUN npm install -g tsx eslint vitest typescript prettier @google/gemini-cli@nightly
+
+# Create workspace directory
+WORKDIR /home/node/workspace
+RUN chown -R node:node /home/node/workspace
+
+# Entrypoint script
+COPY --chown=node:node entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
+USER node
+
+# Environment variables
+ENV GEMINI_CLI_WORKSPACE=1
+ENV PATH=$PATH:/usr/local/bin
+
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+CMD ["/bin/bash"]

packages/workspace-manager/docker/entrypoint.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# Copyright 2026 Google LLC
+# SPDX-License-Identifier: Apache-2.0
+
+# Ensure GH_TOKEN is set from memory-only mount if available
+if [ -f /dev/shm/.gh_token ]; then
+    export GH_TOKEN=$(cat /dev/shm/.gh_token)
+    echo "GitHub token injected from memory."
+fi
+
+# Start shpool daemon in the background
+/usr/local/bin/shpool daemon &
+
+# Restore ~/.gemini settings if they are provided in a mount or PD
+# (Assuming PD is mounted at /home/node/persistent_home for now)
+if [ -d /home/node/persistent_home/.gemini ]; then
+    rsync -a /home/node/persistent_home/.gemini/ /home/node/.gemini/
+fi
+
+# Execute the CMD passed to docker
+exec "$@"