should we have users run the prebuilt docker image instead of building it themselves? then we know they'll get the same thing we have in CI

I'd say yes, a prebuilt image is preferred - not everyone might have a powerful machine on hand to build the base image fast.

I'd probably also commit the /work directory into the image so that no git checkout is necessary for basic work/build. That way it's an atomic, "guaranteed to work" image.

Another note I'd add here is running the container in detached mode. With the current commands (especially the ones provided in the README), for each command, a new container is spun up then shut down once the command completes. With a detached container, just by referring to the name and using exec instead of run, a lot of resources can be saved.

For example the current README approach is:

$ docker run -u `id -u` -v `pwd`:/work x1plusbuild bash -c 'git config --global --add safe.directory /work'
$ docker run -u `id -u` -v `pwd`:/work x1plusbuild make scripts
$ scp scripts/getkey root@bambu:/tmp
$ ssh root@bambu /tmp/getkey >> localconfig.mk
$ docker run -u `id -u` -v `pwd`:/work x1plusbuild make

Which could be modified to:

$ docker run -d --name x1plus -u `id -u` -v `pwd`:/work x1plusbuild 
$ docker exec -it x1plus bash -c 'git config --global --add safe.directory /work'
$ docker exec -it x1plus make scripts
$ scp scripts/getkey root@bambu:/tmp
$ ssh root@bambu /tmp/getkey >> localconfig.mk
$ docker exec -it x1plus make
$ docker stop x1plus
// Later on, the same container can be spun up with
$ docker start x1plus