Ship a distroless image so the plugin can run in-cluster in serve mode,
letting developer laptops use the shared cache without S3 credentials.
- Dockerfile: golang builder running `make build`, distroless static nonroot
- `make docker` for a local smoke build
- `.woodpecker/docker.yaml` pushes to docker-internal on tag
- README: image name and the SSL_CERT_DIR mount the internal CA needs
