Shrink the binary by 40%: drop client-go's clientset and the ECR keychain

AGENTS.md

@@ -11,7 +11,7 @@ VMs). [CHANGELOG.md](CHANGELOG.md) lists what the fork changed and [TODO.md](TOD
 | Path | What it is |
 | --- | --- |
 | `main.go`, `cmd/` | The `devpod` CLI (cobra). `cmd/agent/` and `cmd/helper/` hold the hidden commands run on the remote machine and inside the container. |
-| `pkg/` | Core Go code: `devcontainer/` (parsing, building and running dev containers), `driver/` (docker, kubernetes, custom), `workspace/`, `provider/`, `client/`, `agent/` (agent injection and the gRPC tunnel between CLI and agent), `ide/`, `ssh/`, `credentials/`, `config/`. |
+| `pkg/` | Core Go code: `devcontainer/` (parsing, building and running dev containers), `driver/` (docker, kubernetes, custom), `kubeclient/` (minimal Kubernetes API client), `workspace/`, `provider/`, `client/`, `agent/` (agent injection and the gRPC tunnel between CLI and agent), `ide/`, `ssh/`, `credentials/`, `config/`. |
 | `providers/` | The built-in `docker` and `kubernetes` provider definitions, embedded into the binary. Other providers live in separate repos. |
 | `desktop/` | The desktop app: Tauri 2 (Rust, `desktop/src-tauri`) with a React/TypeScript UI (`desktop/src`). It runs the `devpod` CLI as a sidecar. |
 | `docs/` | Docusaurus documentation site, deployed to [devpod.curityio.net](https://devpod.curityio.net/) (GitHub Pages with a custom domain, so `baseUrl` is `/`) by `.github/workflows/docs.yaml` on pushes to `main`. |
@@ -73,6 +73,11 @@ cd src-tauri && cargo +stable check
   linux) copy fresh binaries there; if you build some other way, copy them yourself. Also, all dev builds report
   version `v0.0.0`, so a container that already has an agent keeps it: recreate the workspace to test agent
   changes.
+- **Don't import `k8s.io/client-go/kubernetes`** (or its typed clients, or anything that uses them, such as
+  go-containerregistry's `authn/kubernetes`). Its scheme links every Kubernetes API group and adds over 20 MB to
+  the binary, which also runs as the agent. Use `pkg/kubeclient`, which only registers core/v1 and rbac/v1; add a
+  resource or group there if you need one. `go list -deps . | grep '^k8s.io/client-go/kubernetes'` must print
+  nothing.
 - **gRPC tunnel code is generated.** After editing `pkg/agent/tunnel/tunnel.proto`, regenerate with
   `hack/build-grpc.sh` (needs `protoc`; existing code uses protoc-gen-go v1.36.4 and protoc-gen-go-grpc v1.5.1).
 - **CI quirks:**

CHANGELOG.md

@@ -35,11 +35,24 @@ Add new entries to the top of the "Unreleased" section.
 
 ### Changed
 
+- The `devpod` binary is about 40% smaller ([#21](https://github.com/curityio/devpod/pull/21)): the stripped
+  linux/amd64 build went from 68 MB to 41 MB (20 MB to 14 MB gzipped). The Kubernetes driver and the in-cluster
+  registry keychain now use a small client for the core/v1 and rbac/v1 APIs instead of client-go's clientset,
+  which linked every Kubernetes API group, and the built-in Amazon ECR keychain is gone (see Removed).
 - The Windows e2e tests, which needed Loft's self-hosted Windows runner, are replaced by
   `windows-tests.yaml` ([#16](https://github.com/curityio/devpod/pull/16)). It builds the CLI and runs
   the unit tests on GitHub's `windows-latest` runners, which can't run the Linux containers the e2e
   tests use.
 
+### Removed
+
+- The built-in Amazon ECR registry keychain ([#21](https://github.com/curityio/devpod/pull/21)), which DevPod used when it ran inside a Kubernetes pod, together
+  with the AWS SDK it needed. To use ECR, configure
+  [`docker-credential-ecr-login`](https://github.com/awslabs/amazon-ecr-credential-helper) as a credential
+  helper in the Docker config; see
+  [Private registries](https://devpod.curityio.net/how-it-works/deploy-k8s#private-registries). The Azure
+  Container Registry and Google keychains are kept.
+
 ## v0.8.0-alpha.1 (2026-10-16)
 
 First release from `curityio/devpod`.

docs/pages/how-it-works/deploy-k8s.mdx

@@ -19,4 +19,29 @@ existing build layers from the registry to reduce the overall build time.
 <figure>
   <img src={require("@site/static/media/c4_build_k8s.png").default} alt="DevPod Architecture 2" />
   <figcaption>DevPod - Component Diagram Kubernetes Build Process</figcaption>
-</figure>
+</figure>
+## Private registries
+
+DevPod gets registry credentials for a Kubernetes workspace in these ways:
+
+- **Pull secret for the workspace image.** With `KUBERNETES_PULL_SECRETS_ENABLED` (on by default), DevPod reads the
+  credentials for the image's registry from the Docker config on your computer, including its credential helpers, and
+  stores them in a pull secret that the workspace pod uses.
+- **Forwarded Docker credentials.** While DevPod builds the image in the pod, and in the dev container when
+  `SSH_INJECT_DOCKER_CREDENTIALS` is on, registry requests are answered by the Docker credentials on your computer
+  (see [Credentials](../developing-in-workspaces/credentials.mdx#docker-credentials)).
+- **In-cluster credentials.** When DevPod itself runs in a pod, it also uses the `imagePullSecrets` of the pod's
+  service account, Google Artifact Registry and Container Registry credentials, and Azure Container Registry
+  credentials when `AZURE_CLIENT_ID` and `AZURE_TENANT_ID` are set.
+
+Amazon ECR has no built-in support. To use it, install
+[`docker-credential-ecr-login`](https://github.com/awslabs/amazon-ecr-credential-helper) and add it to the Docker config
+(`~/.docker/config.json`) on your computer, or wherever DevPod runs:
+
+```json
+{
+  "credHelpers": {
+    "123456789012.dkr.ecr.us-east-1.amazonaws.com": "ecr-login"
+  }
+}
+```