Docker CI on GitHub Actions

Image builds rebuild every layer because the cache never survives.

Why it happens

The BuildKit cache is either absent or shipped to a registry and back on every job.

What to change

1. Use a remote builder that keeps the layer cache on its own disk
2. Order the Dockerfile so dependency installation comes before source copy
3. Use multi-stage builds and copy only artefacts into the final stage
4. Build arm64 natively rather than through QEMU

Docker on runnerhut

jobs:
  image:
    runs-on: runnerhut-8vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@v4
      - uses: runnerhut/setup-buildx@v1
      - uses: docker/build-push-action@v6
        with: { push: true, tags: ghcr.io/acme/api:latest }

The only runnerhut-specific line is `runs-on: runnerhut-8vcpu-ubuntu-2404`. Everything else is standard GitHub Actions — the same actions, the same secrets and the same permissions model you use today.