diff --git a/devenv/.dockerignore b/devenv/.dockerignore
index 8779699..85d4d68 100644
--- a/devenv/.dockerignore
+++ b/devenv/.dockerignore
@@ -7,6 +7,7 @@
 !packages-common.txt
 !packages-debian.txt
 !packages-c10s.txt
+!npm.txt
 !build-deps.txt
 !build-deps-debian.txt
 !build-deps-c10s.txt
diff --git a/devenv/Containerfile b/devenv/Containerfile
deleted file mode 100644
index c03b708..0000000
--- a/devenv/Containerfile
+++ /dev/null
@@ -1,108 +0,0 @@
-# These aren't packages, just low-dependency binaries dropped in /usr/local/bin
-# so we can fetch them independently in a separate build.
-ARG base=docker.io/library/debian:sid
-FROM $base as base
-# Life is too short to care about dash
-RUN ln -sfr /bin/bash /bin/sh
-RUN <<EORUN
-set -xeuo pipefail
-
-# Initialize some basic packages
-apt -y update && apt -y install curl time bzip2
-
-# Enable deb-src repositories for build-dep
-sed -i "s/^deb /deb [arch=$(dpkg --print-architecture)] /" /etc/apt/sources.list.d/debian.sources
-sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.sources
-
-# Enable gh CLI repository
-mkdir -p -m 755 /etc/apt/keyrings
-curl -fLo /etc/apt/keyrings/githubcli-archive-keyring.gpg https://cli.github.com/packages/githubcli-archive-keyring.gpg
-chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg
-mkdir -p -m 755 /etc/apt/sources.list.d
-echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" > /etc/apt/sources.list.d/github-cli.list
-
-# And re-update after we've fetched repos
-apt -y update
-EORUN
-
-FROM base as tools
-# renovate: datasource=github-releases depName=block/goose
-ARG gooseversion=v1.11.1
-# renovate: datasource=github-releases depName=bootc-dev/bcvk
-ARG bcvkversion=v0.5.3
-RUN <<EORUN
-set -xeuo pipefail
-arch=$(arch)
-
-rm -vrf /usr/local/bin/*
-
-# goose for local AI
-target=goose-${arch}-unknown-linux-gnu.tar.bz2
-/bin/time -f '%E %C' curl -fLO https://github.com/block/goose/releases/download/$gooseversion/$target
-tar xvjf $target
-mv goose /usr/local/bin/goose
-
-# bcvk
-if test "${arch}" = x86_64; then
-  td=$(mktemp -d)
-  cd $td
-  target=bcvk-${arch}-unknown-linux-gnu
-  /bin/time -f '%E %C' curl -fLO https://github.com/bootc-dev/bcvk/releases/download/$bcvkversion/${target}.tar.gz
-  tar xvzf $target.tar.gz
-  mv $target /usr/local/bin/bcvk
-  cd -
-  rm -rf $td
-else
-  echo bcvk unavailable for $arch
-fi
-EORUN
-
-FROM base as rust
-RUN <<EORUN
-set -xeuo pipefail
-# Setup rust; the idea here though is we install system-wide into /usr/local
-# as if it was packaged.
-export RUSTUP_HOME=/usr/local/rustup
-export CARGO_HOME=/usr/local/cargo
-# Install Rust system-wide
-curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile default
-# Move binaries to /usr/local/bin (system-managed, root-owned)
-mv /usr/local/cargo/bin/* /usr/local/bin/
-# Nothing really left here
-rm -vrf /usr/local/cargo/bin
-EORUN
-
-# This builds the image.
-# Build this using `just devenv-build` from the root of the repository.
-FROM base
-COPY packages.txt build-deps.txt /run/src/
-WORKDIR /run/src
-RUN <<EORUN
-set -xeuo pipefail
-grep -vEe '^#' packages.txt | /bin/time -f '%E %C' xargs apt -y install
-grep -vEe '^#' build-deps.txt | /bin/time -f '%E %C' xargs apt -y build-dep
-apt clean && rm -rf /var/lib/apt/lists/*
-EORUN
-
-# Copy in the binaries from our tools container image
-COPY --from=tools /usr/local/bin/* /usr/local/bin/
-COPY --from=rust /usr/local/bin/* /usr/local/bin/
-COPY --from=rust /usr/local/rustup /usr/local/rustup
-# Point rustup at the system-wide installation, but let CARGO_HOME default to ~/.cargo
-ENV RUSTUP_HOME=/usr/local/rustup
-# Setup for codespaces
-COPY devenv-init.sh /usr/local/bin/
-
-WORKDIR /
-# Create user before declaring volumes so home directory has correct ownership
-RUN <<EORUN
-set -xeuo pipefail
-useradd -m devenv -s /bin/bash
-# This needs to be precreated and owned by the devenv user
-mkdir -p ~devenv/.local/share/containers
-chown -R -h devenv: ~devenv/.local
-echo 'devenv ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/devenv && chmod 0440 /etc/sudoers.d/devenv
-EORUN
-# To avoid overlay-on-overlay with nested containers
-VOLUME [ "/var/lib/containers", "/home/devenv/.local/share/containers/" ]
-USER devenv
diff --git a/devenv/Containerfile.c10s b/devenv/Containerfile.c10s
index 29639cb..1f1f3f0 100644
--- a/devenv/Containerfile.c10s
+++ b/devenv/Containerfile.c10s
@@ -36,12 +36,14 @@ arch=$(arch)
 
 rm -vrf /usr/local/bin/*
 
-# goose for local AI
+# goose is a single static binary
 target=goose-${arch}-unknown-linux-gnu.tar.bz2
 /bin/time -f '%E %C' curl -fLO https://github.com/block/goose/releases/download/$gooseversion/$target
 tar xvjf $target
 mv goose /usr/local/bin/goose
 
+## Other tools
+
 # bcvk
 if test "${arch}" = x86_64; then
   td=$(mktemp -d)
@@ -84,6 +86,8 @@ grep -hEve '^#' packages-common.txt packages-c10s.txt | /bin/time -f '%E %C' xar
 grep -vEe '^#' build-deps-c10s.txt | /bin/time -f '%E %C' xargs dnf -y builddep
 dnf clean all
 EORUN
+COPY npm.txt /run/src
+RUN grep -vEe '^#' npm.txt | /bin/time -f '%E %C' xargs npm i -g
 
 # Copy in the binaries from our tools container image
 COPY --from=tools /usr/local/bin/* /usr/local/bin/
diff --git a/devenv/Containerfile.debian b/devenv/Containerfile.debian
index 5dbef1f..edba74d 100644
--- a/devenv/Containerfile.debian
+++ b/devenv/Containerfile.debian
@@ -84,6 +84,8 @@ grep -hEve '^#' packages-common.txt packages-debian.txt | /bin/time -f '%E %C' x
 grep -vEe '^#' build-deps-debian.txt | /bin/time -f '%E %C' xargs apt -y build-dep
 apt clean && rm -rf /var/lib/apt/lists/*
 EORUN
+COPY npm.txt /run/src
+RUN grep -vEe '^#' npm.txt | /bin/time -f '%E %C' xargs npm i -g
 
 # Copy in the binaries from our tools container image
 COPY --from=tools /usr/local/bin/* /usr/local/bin/
diff --git a/devenv/build-deps.txt b/devenv/build-deps.txt
deleted file mode 100644
index c920542..0000000
--- a/devenv/build-deps.txt
+++ /dev/null
@@ -1 +0,0 @@
-ostree
diff --git a/devenv/npm.txt b/devenv/npm.txt
new file mode 100644
index 0000000..aad6ffe
--- /dev/null
+++ b/devenv/npm.txt
@@ -0,0 +1,2 @@
+# renovate: datasource=npm depName=opencode-ai
+opencode-ai@1.0.163
diff --git a/devenv/packages-common.txt b/devenv/packages-common.txt
index b22beb5..5a0d311 100644
--- a/devenv/packages-common.txt
+++ b/devenv/packages-common.txt
@@ -7,6 +7,7 @@ sudo
 
 # Generic utilities
 acl
+rsync
 
 # General build env (note: we install rust through rustup later)
 gcc
diff --git a/devenv/packages.txt b/devenv/packages.txt
deleted file mode 100644
index 9bf9e16..0000000
--- a/devenv/packages.txt
+++ /dev/null
@@ -1,29 +0,0 @@
-# Key dependencies
-just
-podman
-curl
-git
-# Just because lots of things expect it
-sudo
-
-# Generic utilities
-acl
-
-# General build env, note we install rust through rustup later
-gcc
-clang
-clang-format
-libkrb5-dev pkg-config libvirt-dev libostree-dev
-go-md2man
-
-# Runtime virt
-genisoimage qemu-utils qemu-kvm libvirt-daemon-system virtiofsd
-
-# TUI editors on general principle
-vim nano
-
-# dependency of other things like gemini CLI
-npm
-
-# from 3rd party repo
-gh