diff --git a/.devcontainer/devcontainer.build.json b/.devcontainer/devcontainer.build.json
new file mode 100644
index 00000000..3aaf8d05
--- /dev/null
+++ b/.devcontainer/devcontainer.build.json
@@ -0,0 +1,29 @@
+{
+  "name": "Home Ops",
+  "image": "mcr.microsoft.com/devcontainers/base:bullseye",
+  "features": {
+    "ghcr.io/devcontainers/features/common-utils:2": {
+      "configureZshAsDefaultShell": true
+    },
+    "ghcr.io/devcontainers/features/python:1": {
+      "version": "3.11.7",
+      "installTools": false
+    }
+  },
+  "customizations": {
+    "vscode": {
+      "settings": {
+        "terminal.integrated.profiles.linux": {
+          "bash": {
+            "path": "/bin/zsh"
+          }
+        },
+        "terminal.integrated.defaultProfile.linux": "zsh"
+      },
+      "extensions": [
+        "redhat.ansible",
+        "redhat.vscode-yaml"
+      ]
+    }
+  }
+}
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index c33a9203..2aa8e6cd 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,24 +1,13 @@
 {
   "name": "Home Ops",
-  "image": "mcr.microsoft.com/devcontainers/base:bullseye",
-  "containerEnv": {
-    "KUBECONFIG": "${containerWorkspaceFolder}/kubeconfig",
-    "SOPS_AGE_KEY_FILE": "${containerWorkspaceFolder}/age.key"
-  },
+  "image": "ghcr.io/onedr0p/flux-cluster-template/devcontainer:base",
   "postCreateCommand": {
     "deps": "${containerWorkspaceFolder}/.devcontainer/postCreateCommand.sh"
   },
   "features": {
-    "ghcr.io/devcontainers/features/common-utils:2": {
-      "configureZshAsDefaultShell": true
-    },
     "ghcr.io/devcontainers/features/kubectl-helm-minikube:1": {
       "minikube": "none"
     },
-    "ghcr.io/devcontainers/features/python:1": {
-      "version": "3.11.7",
-      "installTools": false
-    },
     "ghcr.io/devcontainers-contrib/features/age:1": {},
     "ghcr.io/devcontainers-contrib/features/cloudflared:1": {},
     "ghcr.io/devcontainers-contrib/features/go-task:1": {},
@@ -30,21 +19,5 @@
     "ghcr.io/jsburckhardt/devcontainer-features/flux:1": {},
     "ghcr.io/rio/features/kustomize:1": {},
     "ghcr.io/gickis/devcontainer-features/kubeconform:1": {}
-  },
-  "customizations": {
-    "vscode": {
-      "settings": {
-        "terminal.integrated.profiles.linux": {
-          "bash": {
-            "path": "/bin/zsh"
-          }
-        },
-        "terminal.integrated.defaultProfile.linux": "zsh"
-      },
-      "extensions": [
-        "redhat.ansible",
-        "redhat.vscode-yaml"
-      ]
-    }
   }
 }
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
index 8f98801e..700745aa 100644
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -12,7 +12,7 @@ concurrency:
 
 jobs:
   yay:
-    name: yay
+    name: workstation (yay)
     runs-on: ubuntu-latest
     container:
       image: greyltc/archlinux-aur:yay
diff --git a/.github/workflows/publish-devcontainer.yaml b/.github/workflows/publish-devcontainer.yaml
new file mode 100644
index 00000000..7cabeb6f
--- /dev/null
+++ b/.github/workflows/publish-devcontainer.yaml
@@ -0,0 +1,42 @@
+---
+name: "Publish devcontainer"
+
+on:
+  workflow_dispatch:
+  push:
+    branches: ["main"]
+    paths: [".devcontainer/devcontainer.build.json"]
+  pull_request:
+    branches: ["main"]
+    paths: [".devcontainer/devcontainer.build.json"]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  publish-devcontainer:
+    name: Publish devcontainer
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - if: ${{ github.event_name != 'pull_request' }}
+        name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        uses: devcontainers/ci@v0.3
+        with:
+          imageName: ghcr.io/${{ github.repository }}/devcontainer
+          imageTag: base,latest
+          configFile: .devcontainer/devcontainer.build.json
+          push: ${{ github.event_name == 'pull_request' && 'never' || 'always' }}