.github/workflows/packages.yml

@@ -13,6 +13,10 @@ on:
         required: true
       PACKAGES_RSA_KEY:
         required: true
+      DOCKERHUB_USERNAME:
+        required: true
+      DOCKERHUB_TOKEN:
+        required: true
   workflow_dispatch:
     inputs:
       tag:
@@ -75,6 +79,10 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
       - uses: goreleaser/goreleaser-action@v7
         with:
           version: v2.18.3
@@ -83,12 +91,14 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
-      - name: The built binary and the published image print the tag
+      - name: The built binary and the published images print the tag
         env:
           TAG: ${{ inputs.tag }}
         run: |
           test "$(dist/fejkdata_linux_amd64_v1/fejkdata --version)" = "fejkdata $TAG"
-          test "$(docker run --rm "ghcr.io/larvit/fejkdata:${TAG#v}" --version)" = "fejkdata $TAG"
+          for image in docker.io/larvit/fejkdata ghcr.io/larvit/fejkdata; do
+            test "$(docker run --rm "$image:${TAG#v}" --version)" = "fejkdata $TAG"
+          done
 
   repos:
     name: apt, dnf and apk repositories for ${{ inputs.tag }}

.github/workflows/test.yml

@@ -99,3 +99,5 @@ jobs:
       TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
       PACKAGES_GPG_KEY: ${{ secrets.PACKAGES_GPG_KEY }}
       PACKAGES_RSA_KEY: ${{ secrets.PACKAGES_RSA_KEY }}
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}

CHANGELOG.md

@@ -9,7 +9,7 @@ replacement, and each removed path, column or flag.
 ### Added
 
 - Prebuilt binaries for Linux, macOS and Windows on amd64 and arm64, packages for apt,
-  dnf, apk, Homebrew and Scoop, and the image `ghcr.io/larvit/fejkdata`, so
+  dnf, apk, Homebrew and Scoop, and the image `larvit/fejkdata` on Docker Hub and GHCR, so
   the CLI installs without Go. 0.1.0 ships them too; the README's
   [Install](https://github.com/larvit/fejkdata#install) lists each command.
 

README.md

@@ -38,10 +38,13 @@ echo '{/sv_SE.person}' | fejkdata   # Sara Eriksson
 ```sh
 brew install larvit/tap/fejkdata                                  # macOS, Linux
 scoop bucket add larvit https://github.com/larvit/scoop-bucket && scoop install fejkdata  # Windows
-docker run --rm -i ghcr.io/larvit/fejkdata < template.json        # any OS with Docker
+docker run --rm -i larvit/fejkdata < template.json                # any OS with Docker
 go install github.com/larvit/fejkdata/cmd/fejkdata@latest         # any OS with Go
 ```
 
+The image is also `ghcr.io/larvit/fejkdata`, which CI on shared runners may prefer:
+Docker Hub limits anonymous pulls per IP address.
+
 Debian, Ubuntu, Fedora, RHEL and Alpine install from fejkdata's signed repositories, which
 hold the latest release:
 
@@ -997,7 +1000,7 @@ minor only adds, and a major is the only release that changes what exists. Seede
 is the exception: any release, a patch too, may change what a seed draws. Where you
 compare seeded output, install one exact version
 (`go install github.com/larvit/fejkdata/cmd/fejkdata@vX.Y.Z`, the image
-`ghcr.io/larvit/fejkdata:X.Y.Z` or a release's binary; `go.mod` already pins one),
+`larvit/fejkdata:X.Y.Z` or a release's binary; `go.mod` already pins one),
 and regenerate seeded fixtures and expected values when you raise that version.
 
 | Surface | Major | Minor |
@@ -1277,18 +1280,20 @@ To release, head `CHANGELOG.md` with the version's section in place of `Unreleas
 and merge: once `main` passes the gate, CI tags that commit `vX.Y.Z` and publishes
 the GitHub release with the section as its body. A top heading of `[Unreleased]`
 publishes nothing. CI then runs the Packages workflow on the new tag, which attaches the
-binaries and packages, pushes the image, updates the Homebrew tap and the Scoop bucket,
+binaries and packages, pushes the image to Docker Hub and GHCR, updates the Homebrew tap and the Scoop bucket,
 and deploys the apt, dnf and apk repositories to GitHub Pages. The workflow reads
 these repository secrets:
 
+- `DOCKERHUB_USERNAME`, `DOCKERHUB_TOKEN`: a Docker Hub account and access token that can
+  push to `larvit/fejkdata`.
 - `PACKAGES_GPG_KEY`, `PACKAGES_RSA_KEY`: the private keys that sign the repositories.
 - `TAP_GITHUB_TOKEN`: a token that can push to `larvit/homebrew-tap` and
   `larvit/scoop-bucket`.
 
-The image's GHCR package must be public, and Pages must deploy from GitHub Actions. To
+The image's Docker Hub repository and GHCR package must be public, and Pages must deploy from GitHub Actions. To
 package a release again,
 run the workflow by hand with its tag; it replaces what it uploaded before. For a tag older
-than the latest release it leaves the tap, the bucket, the image's `latest` and
+than the latest release it leaves the tap, the bucket, the images' `latest` and
 the repositories alone, since each holds one version.
 
 ## License

docs/decisions.md

@@ -903,7 +903,7 @@ By the maintainer's decision of 2026-10-09, every 0.1.0 chunk ships under the fl
 
 Shipped under that decision: item 89, the last of 0.1.0, at 52e0304. Its paired ruling against 90ffcff was better. The release's scoring run read Navigation 7.00, Locality 5.75, Shape 6.38, Self-sufficiency 6.50 and overall 6.25; its seats named places items 170 to 172 and 178 hold, and `isPath`, filed as item 251.
 
-Shipped under the floor by the maintainer's decision of 2026-10-13: item 58, prebuilt binaries and packages, which the plan had under 0.2.0, ships as 0.1.0's distribution. It changes no Go code.
+Shipped under the floor by the maintainer's decision of 2026-10-13: item 58, prebuilt binaries and packages, which the plan had under 0.2.0, ships as 0.1.0's distribution, and so does the image on Docker Hub, decided 2026-10-14. Neither changes Go code.
 
 Shipped by the maintainer's decision of 2026-10-11 with its ratchet waived: item 182, the shipped data as Go packages, at a632a92. Its last paired ruling against bf1becb was same overall, Mid A better and Junior A worse, with Shape fallen, three seats against the namespace mount in `internal/datafiles/mount.go` and the `at` field of `datafiles.Source`; the scoring run that would rule it worse under the floor was not run. `todo.md` item 197 replaces that mount.
 
@@ -971,7 +971,10 @@ are built here, as static files any host can serve: `release-tooling/package-rep
 signs them with a GPG key (apt, dnf) and an RSA key (apk). A hosted package service would
 only save that tooling. GitHub already hosts the code (see "GitHub is canonical, and the
 module path names it"), so Pages adds no new vendor. The image sits on GHCR for the same
-reason; being OCI, it moves to another registry by changing its path. A Pages site holds at
+reason; being OCI, it moves to another registry by changing its path. Docker Hub carries
+the same image too, by the maintainer's decision of 2026-10-14: it is Docker's default
+registry, so `docker run larvit/fejkdata` works with no host in the name. Docker Hub limits
+anonymous pulls by IP, so CI on shared runners may pull from `ghcr.io` instead. A Pages site holds at
 most 1 GB and a release's packages take about 35 MB, so the repositories hold the latest
 release only; each GitHub release still carries its own packages, and the image keeps a tag
 per version. Leaving Pages costs

release-tooling/goreleaser.yaml

@@ -54,6 +54,7 @@ nfpms:
 
 dockers_v2:
   - images:
+      - docker.io/larvit/fejkdata
       - ghcr.io/larvit/fejkdata
     tags:
       - "{{ .Version }}"