diff --git a/.github/workflows/ci-master-pr.yml b/.github/workflows/ci-master-pr.yml
index cd5a7b4..90a5320 100644
--- a/.github/workflows/ci-master-pr.yml
+++ b/.github/workflows/ci-master-pr.yml
@@ -33,6 +33,394 @@ jobs:
       run: |
         git diff --exit-code
 
+  build-4-95-3:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Display system info (linux)
+      run: |
+        set -e
+        hostname
+        whoami
+        cat /etc/*release
+        lscpu
+        free
+        df -h
+        pwd
+        docker info
+        docker version
+
+    # See: https://github.com/docker/build-push-action/blob/v2.6.1/docs/advanced/cache.md#github-cache
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v3
+
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Cache Docker layers
+      uses: actions/cache@v4
+      with:
+        path: /tmp/.buildx-cache
+        key: ${{ runner.os }}-buildx-4.95.3-${{ github.sha }}
+        restore-keys: |
+          ${{ runner.os }}-buildx-4.95.3-
+          ${{ runner.os }}-buildx-
+
+    - name: Login to Docker Hub registry
+      # Run on master and tags
+      if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/')
+      uses: docker/login-action@v3
+      with:
+        username: ${{ secrets.DOCKERHUB_REGISTRY_USER }}
+        password: ${{ secrets.DOCKERHUB_REGISTRY_PASSWORD }}
+
+    # This step generates the docker tags
+    - name: Prepare
+      id: prep-4-95-3
+      run: |
+        set -e
+
+        # Get ref, i.e. <branch_name> from refs/heads/<branch_name>, or <tag-name> from refs/tags/<tag_name>. E.g. 'master' or 'v0.0.0'
+        REF=$( echo "${GITHUB_REF}" | rev | cut -d '/' -f 1 | rev )
+
+        # Get short commit hash E.g. 'abc0123'
+        SHA=$( echo "${GITHUB_SHA}" | cut -c1-7 )
+
+        # Generate docker image tags
+        # E.g. 'v0.0.0-<variant>' and 'v0.0.0-abc0123-<variant>'
+        # E.g. 'master-<variant>' and 'master-abc0123-<variant>'
+        VARIANT="4.95.3"
+        REF_VARIANT="${REF}-${VARIANT}"
+        REF_SHA_VARIANT="${REF}-${SHA}-${VARIANT}"
+
+        # Pass variables to next step
+        echo "VARIANT_BUILD_DIR=$VARIANT_BUILD_DIR" >> $GITHUB_OUTPUT
+        echo "VARIANT=$VARIANT" >> $GITHUB_OUTPUT
+        echo "REF_VARIANT=$REF_VARIANT" >> $GITHUB_OUTPUT
+        echo "REF_SHA_VARIANT=$REF_SHA_VARIANT" >> $GITHUB_OUTPUT
+
+    - name: 4.95.3 - Build (PRs)
+      # Run only on pull requests
+      if: github.event_name == 'pull_request'
+      uses: docker/build-push-action@v5
+      with:
+        context: variants/4.95.3
+        platforms: linux/amd64
+        push: false
+        tags: |
+          ${{ github.repository }}:${{ steps.prep-4-95-3.outputs.REF_VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3.outputs.REF_SHA_VARIANT }}
+        cache-from: type=local,src=/tmp/.buildx-cache
+        cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+
+    - name: 4.95.3 - Build and push (master)
+      # Run only on master
+      if: github.ref == 'refs/heads/master'
+      uses: docker/build-push-action@v5
+      with:
+        context: variants/4.95.3
+        platforms: linux/amd64
+        push: true
+        tags: |
+          ${{ github.repository }}:${{ steps.prep-4-95-3.outputs.REF_VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3.outputs.REF_SHA_VARIANT }}
+        cache-from: type=local,src=/tmp/.buildx-cache
+        cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+
+    - name: 4.95.3 - Build and push (release)
+      if: startsWith(github.ref, 'refs/tags/')
+      uses: docker/build-push-action@v5
+      with:
+        context: variants/4.95.3
+        platforms: linux/amd64
+        push: true
+        tags: |
+          ${{ github.repository }}:${{ steps.prep-4-95-3.outputs.VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3.outputs.REF_VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3.outputs.REF_SHA_VARIANT }}
+          ${{ github.repository }}:latest
+        cache-from: type=local,src=/tmp/.buildx-cache
+        cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+
+    # This step generates the docker tags
+    - name: Prepare
+      id: prep-4-95-3-docker
+      run: |
+        set -e
+
+        # Get ref, i.e. <branch_name> from refs/heads/<branch_name>, or <tag-name> from refs/tags/<tag_name>. E.g. 'master' or 'v0.0.0'
+        REF=$( echo "${GITHUB_REF}" | rev | cut -d '/' -f 1 | rev )
+
+        # Get short commit hash E.g. 'abc0123'
+        SHA=$( echo "${GITHUB_SHA}" | cut -c1-7 )
+
+        # Generate docker image tags
+        # E.g. 'v0.0.0-<variant>' and 'v0.0.0-abc0123-<variant>'
+        # E.g. 'master-<variant>' and 'master-abc0123-<variant>'
+        VARIANT="4.95.3-docker"
+        REF_VARIANT="${REF}-${VARIANT}"
+        REF_SHA_VARIANT="${REF}-${SHA}-${VARIANT}"
+
+        # Pass variables to next step
+        echo "VARIANT_BUILD_DIR=$VARIANT_BUILD_DIR" >> $GITHUB_OUTPUT
+        echo "VARIANT=$VARIANT" >> $GITHUB_OUTPUT
+        echo "REF_VARIANT=$REF_VARIANT" >> $GITHUB_OUTPUT
+        echo "REF_SHA_VARIANT=$REF_SHA_VARIANT" >> $GITHUB_OUTPUT
+
+    - name: 4.95.3-docker - Build (PRs)
+      # Run only on pull requests
+      if: github.event_name == 'pull_request'
+      uses: docker/build-push-action@v5
+      with:
+        context: variants/4.95.3-docker
+        platforms: linux/amd64
+        push: false
+        tags: |
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker.outputs.REF_VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker.outputs.REF_SHA_VARIANT }}
+        cache-from: type=local,src=/tmp/.buildx-cache
+        cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+
+    - name: 4.95.3-docker - Build and push (master)
+      # Run only on master
+      if: github.ref == 'refs/heads/master'
+      uses: docker/build-push-action@v5
+      with:
+        context: variants/4.95.3-docker
+        platforms: linux/amd64
+        push: true
+        tags: |
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker.outputs.REF_VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker.outputs.REF_SHA_VARIANT }}
+        cache-from: type=local,src=/tmp/.buildx-cache
+        cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+
+    - name: 4.95.3-docker - Build and push (release)
+      if: startsWith(github.ref, 'refs/tags/')
+      uses: docker/build-push-action@v5
+      with:
+        context: variants/4.95.3-docker
+        platforms: linux/amd64
+        push: true
+        tags: |
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker.outputs.VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker.outputs.REF_VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker.outputs.REF_SHA_VARIANT }}
+        cache-from: type=local,src=/tmp/.buildx-cache
+        cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+
+    # This step generates the docker tags
+    - name: Prepare
+      id: prep-4-95-3-docker-go-1-20-14
+      run: |
+        set -e
+
+        # Get ref, i.e. <branch_name> from refs/heads/<branch_name>, or <tag-name> from refs/tags/<tag_name>. E.g. 'master' or 'v0.0.0'
+        REF=$( echo "${GITHUB_REF}" | rev | cut -d '/' -f 1 | rev )
+
+        # Get short commit hash E.g. 'abc0123'
+        SHA=$( echo "${GITHUB_SHA}" | cut -c1-7 )
+
+        # Generate docker image tags
+        # E.g. 'v0.0.0-<variant>' and 'v0.0.0-abc0123-<variant>'
+        # E.g. 'master-<variant>' and 'master-abc0123-<variant>'
+        VARIANT="4.95.3-docker-go-1.20.14"
+        REF_VARIANT="${REF}-${VARIANT}"
+        REF_SHA_VARIANT="${REF}-${SHA}-${VARIANT}"
+
+        # Pass variables to next step
+        echo "VARIANT_BUILD_DIR=$VARIANT_BUILD_DIR" >> $GITHUB_OUTPUT
+        echo "VARIANT=$VARIANT" >> $GITHUB_OUTPUT
+        echo "REF_VARIANT=$REF_VARIANT" >> $GITHUB_OUTPUT
+        echo "REF_SHA_VARIANT=$REF_SHA_VARIANT" >> $GITHUB_OUTPUT
+
+    - name: 4.95.3-docker-go-1.20.14 - Build (PRs)
+      # Run only on pull requests
+      if: github.event_name == 'pull_request'
+      uses: docker/build-push-action@v5
+      with:
+        context: variants/4.95.3-docker-go-1.20.14
+        platforms: linux/amd64
+        push: false
+        tags: |
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-go-1-20-14.outputs.REF_VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-go-1-20-14.outputs.REF_SHA_VARIANT }}
+        cache-from: type=local,src=/tmp/.buildx-cache
+        cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+
+    - name: 4.95.3-docker-go-1.20.14 - Build and push (master)
+      # Run only on master
+      if: github.ref == 'refs/heads/master'
+      uses: docker/build-push-action@v5
+      with:
+        context: variants/4.95.3-docker-go-1.20.14
+        platforms: linux/amd64
+        push: true
+        tags: |
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-go-1-20-14.outputs.REF_VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-go-1-20-14.outputs.REF_SHA_VARIANT }}
+        cache-from: type=local,src=/tmp/.buildx-cache
+        cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+
+    - name: 4.95.3-docker-go-1.20.14 - Build and push (release)
+      if: startsWith(github.ref, 'refs/tags/')
+      uses: docker/build-push-action@v5
+      with:
+        context: variants/4.95.3-docker-go-1.20.14
+        platforms: linux/amd64
+        push: true
+        tags: |
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-go-1-20-14.outputs.VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-go-1-20-14.outputs.REF_VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-go-1-20-14.outputs.REF_SHA_VARIANT }}
+        cache-from: type=local,src=/tmp/.buildx-cache
+        cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+
+    # This step generates the docker tags
+    - name: Prepare
+      id: prep-4-95-3-docker-rootless
+      run: |
+        set -e
+
+        # Get ref, i.e. <branch_name> from refs/heads/<branch_name>, or <tag-name> from refs/tags/<tag_name>. E.g. 'master' or 'v0.0.0'
+        REF=$( echo "${GITHUB_REF}" | rev | cut -d '/' -f 1 | rev )
+
+        # Get short commit hash E.g. 'abc0123'
+        SHA=$( echo "${GITHUB_SHA}" | cut -c1-7 )
+
+        # Generate docker image tags
+        # E.g. 'v0.0.0-<variant>' and 'v0.0.0-abc0123-<variant>'
+        # E.g. 'master-<variant>' and 'master-abc0123-<variant>'
+        VARIANT="4.95.3-docker-rootless"
+        REF_VARIANT="${REF}-${VARIANT}"
+        REF_SHA_VARIANT="${REF}-${SHA}-${VARIANT}"
+
+        # Pass variables to next step
+        echo "VARIANT_BUILD_DIR=$VARIANT_BUILD_DIR" >> $GITHUB_OUTPUT
+        echo "VARIANT=$VARIANT" >> $GITHUB_OUTPUT
+        echo "REF_VARIANT=$REF_VARIANT" >> $GITHUB_OUTPUT
+        echo "REF_SHA_VARIANT=$REF_SHA_VARIANT" >> $GITHUB_OUTPUT
+
+    - name: 4.95.3-docker-rootless - Build (PRs)
+      # Run only on pull requests
+      if: github.event_name == 'pull_request'
+      uses: docker/build-push-action@v5
+      with:
+        context: variants/4.95.3-docker-rootless
+        platforms: linux/amd64
+        push: false
+        tags: |
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-rootless.outputs.REF_VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-rootless.outputs.REF_SHA_VARIANT }}
+        cache-from: type=local,src=/tmp/.buildx-cache
+        cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+
+    - name: 4.95.3-docker-rootless - Build and push (master)
+      # Run only on master
+      if: github.ref == 'refs/heads/master'
+      uses: docker/build-push-action@v5
+      with:
+        context: variants/4.95.3-docker-rootless
+        platforms: linux/amd64
+        push: true
+        tags: |
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-rootless.outputs.REF_VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-rootless.outputs.REF_SHA_VARIANT }}
+        cache-from: type=local,src=/tmp/.buildx-cache
+        cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+
+    - name: 4.95.3-docker-rootless - Build and push (release)
+      if: startsWith(github.ref, 'refs/tags/')
+      uses: docker/build-push-action@v5
+      with:
+        context: variants/4.95.3-docker-rootless
+        platforms: linux/amd64
+        push: true
+        tags: |
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-rootless.outputs.VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-rootless.outputs.REF_VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-rootless.outputs.REF_SHA_VARIANT }}
+        cache-from: type=local,src=/tmp/.buildx-cache
+        cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+
+    # This step generates the docker tags
+    - name: Prepare
+      id: prep-4-95-3-docker-rootless-go-1-20-14
+      run: |
+        set -e
+
+        # Get ref, i.e. <branch_name> from refs/heads/<branch_name>, or <tag-name> from refs/tags/<tag_name>. E.g. 'master' or 'v0.0.0'
+        REF=$( echo "${GITHUB_REF}" | rev | cut -d '/' -f 1 | rev )
+
+        # Get short commit hash E.g. 'abc0123'
+        SHA=$( echo "${GITHUB_SHA}" | cut -c1-7 )
+
+        # Generate docker image tags
+        # E.g. 'v0.0.0-<variant>' and 'v0.0.0-abc0123-<variant>'
+        # E.g. 'master-<variant>' and 'master-abc0123-<variant>'
+        VARIANT="4.95.3-docker-rootless-go-1.20.14"
+        REF_VARIANT="${REF}-${VARIANT}"
+        REF_SHA_VARIANT="${REF}-${SHA}-${VARIANT}"
+
+        # Pass variables to next step
+        echo "VARIANT_BUILD_DIR=$VARIANT_BUILD_DIR" >> $GITHUB_OUTPUT
+        echo "VARIANT=$VARIANT" >> $GITHUB_OUTPUT
+        echo "REF_VARIANT=$REF_VARIANT" >> $GITHUB_OUTPUT
+        echo "REF_SHA_VARIANT=$REF_SHA_VARIANT" >> $GITHUB_OUTPUT
+
+    - name: 4.95.3-docker-rootless-go-1.20.14 - Build (PRs)
+      # Run only on pull requests
+      if: github.event_name == 'pull_request'
+      uses: docker/build-push-action@v5
+      with:
+        context: variants/4.95.3-docker-rootless-go-1.20.14
+        platforms: linux/amd64
+        push: false
+        tags: |
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-rootless-go-1-20-14.outputs.REF_VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-rootless-go-1-20-14.outputs.REF_SHA_VARIANT }}
+        cache-from: type=local,src=/tmp/.buildx-cache
+        cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+
+    - name: 4.95.3-docker-rootless-go-1.20.14 - Build and push (master)
+      # Run only on master
+      if: github.ref == 'refs/heads/master'
+      uses: docker/build-push-action@v5
+      with:
+        context: variants/4.95.3-docker-rootless-go-1.20.14
+        platforms: linux/amd64
+        push: true
+        tags: |
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-rootless-go-1-20-14.outputs.REF_VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-rootless-go-1-20-14.outputs.REF_SHA_VARIANT }}
+        cache-from: type=local,src=/tmp/.buildx-cache
+        cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+
+    - name: 4.95.3-docker-rootless-go-1.20.14 - Build and push (release)
+      if: startsWith(github.ref, 'refs/tags/')
+      uses: docker/build-push-action@v5
+      with:
+        context: variants/4.95.3-docker-rootless-go-1.20.14
+        platforms: linux/amd64
+        push: true
+        tags: |
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-rootless-go-1-20-14.outputs.VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-rootless-go-1-20-14.outputs.REF_VARIANT }}
+          ${{ github.repository }}:${{ steps.prep-4-95-3-docker-rootless-go-1-20-14.outputs.REF_SHA_VARIANT }}
+        cache-from: type=local,src=/tmp/.buildx-cache
+        cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+
+    # Temp fix
+    # https://github.com/docker/build-push-action/issues/252
+    # https://github.com/moby/buildkit/issues/1896
+    - name: Move cache
+      run: |
+        rm -rf /tmp/.buildx-cache
+        mv /tmp/.buildx-cache-new /tmp/.buildx-cache
+
   build-4-93-1:
     runs-on: ubuntu-latest
     steps:
@@ -141,7 +529,6 @@ jobs:
           ${{ github.repository }}:${{ steps.prep-4-93-1.outputs.VARIANT }}
           ${{ github.repository }}:${{ steps.prep-4-93-1.outputs.REF_VARIANT }}
           ${{ github.repository }}:${{ steps.prep-4-93-1.outputs.REF_SHA_VARIANT }}
-          ${{ github.repository }}:latest
         cache-from: type=local,src=/tmp/.buildx-cache
         cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
 
@@ -7002,6 +7389,7 @@ jobs:
 
   update-draft-release:
     needs:
+      - build-4-95-3
       - build-4-93-1
       - build-4-92-2
       - build-4-91-1
@@ -7033,6 +7421,7 @@ jobs:
 
   publish-draft-release:
     needs:
+      - build-4-95-3
       - build-4-93-1
       - build-4-92-2
       - build-4-91-1
@@ -7066,6 +7455,7 @@ jobs:
 
   update-dockerhub-description:
     needs:
+      - build-4-95-3
       - build-4-93-1
       - build-4-92-2
       - build-4-91-1
diff --git a/README.md b/README.md
index a6d2143..66b847a 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,12 @@ Dockerized [`code-server`](https://github.com/coder/code-server).
 
 | Tag | Dockerfile Build Context |
 |:-------:|:---------:|
-| `:4.93.1`, `:latest` | [View](variants/4.93.1) |
+| `:4.95.3`, `:latest` | [View](variants/4.95.3) |
+| `:4.95.3-docker` | [View](variants/4.95.3-docker) |
+| `:4.95.3-docker-go-1.20.14` | [View](variants/4.95.3-docker-go-1.20.14) |
+| `:4.95.3-docker-rootless` | [View](variants/4.95.3-docker-rootless) |
+| `:4.95.3-docker-rootless-go-1.20.14` | [View](variants/4.95.3-docker-rootless-go-1.20.14) |
+| `:4.93.1` | [View](variants/4.93.1) |
 | `:4.93.1-docker` | [View](variants/4.93.1-docker) |
 | `:4.93.1-docker-go-1.20.14` | [View](variants/4.93.1-docker-go-1.20.14) |
 | `:4.93.1-docker-rootless` | [View](variants/4.93.1-docker-rootless) |
@@ -101,7 +106,7 @@ Dockerized [`code-server`](https://github.com/coder/code-server).
 | `:4.11.0-docker-rootless` | [View](variants/4.11.0-docker-rootless) |
 | `:4.11.0-docker-rootless-go-1.20.14` | [View](variants/4.11.0-docker-rootless-go-1.20.14) |
 
-Base variants are based on `alpine`, and include `npm 8` and `nodejs 16` (to run `code-server`), `pwsh`, and basic tools. E.g. `4.93.1`
+Base variants are based on `alpine`, and include `npm 8` and `nodejs 16` (to run `code-server`), `pwsh`, and basic tools. E.g. `4.95.3`
 
 Incremental variants include additional tools and their `code` extensions:
 
@@ -114,7 +119,7 @@ Incremental variants include additional tools and their `code` extensions:
 ### Base variant(s)
 
 ```sh
-docker run --name code-server --rm -it -p 127.0.0.1:8080:8080 theohbrothers/docker-code-server:4.93.1
+docker run --name code-server --rm -it -p 127.0.0.1:8080:8080 theohbrothers/docker-code-server:4.95.3
 # code-server is now available at http://127.0.0.1:8080. To login, use the password in the config file:
 docker exec code-server sh -c 'cat ~/.config/code-server/config.yaml'
 ```
@@ -122,13 +127,13 @@ docker exec code-server sh -c 'cat ~/.config/code-server/config.yaml'
 To disable password authentication, use `--auth=none`:
 
 ```sh
-docker run --name code-server --rm -it -p 127.0.0.1:8080:8080 theohbrothers/docker-code-server:4.93.1 --bind-addr=0.0.0.0:8080 --auth=none --disable-telemetry --disable-update-check
+docker run --name code-server --rm -it -p 127.0.0.1:8080:8080 theohbrothers/docker-code-server:4.95.3 --bind-addr=0.0.0.0:8080 --auth=none --disable-telemetry --disable-update-check
 ```
 
 ### `docker` variant(s)
 
 ```sh
-docker run --name code-server --rm -it --privileged -v docker:/var/lib/docker -p 127.0.0.1:8080:8080 theohbrothers/docker-code-server:4.93.1-docker
+docker run --name code-server --rm -it --privileged -v docker:/var/lib/docker -p 127.0.0.1:8080:8080 theohbrothers/docker-code-server:4.95.3-docker
 # code-server is now available at http://127.0.0.1:8080. To login, use the password in the config file:
 docker exec code-server sh -c 'cat ~/.config/code-server/config.yaml'
 ```
@@ -136,7 +141,7 @@ docker exec code-server sh -c 'cat ~/.config/code-server/config.yaml'
 To disable password authentication, use `--auth=none`:
 
 ```sh
-docker run --name code-server --rm -it -p 127.0.0.1:8080:8080 theohbrothers/docker-code-server:4.93.1-docker --bind-addr=0.0.0.0:8080 --auth=none --disable-telemetry --disable-update-check
+docker run --name code-server --rm -it -p 127.0.0.1:8080:8080 theohbrothers/docker-code-server:4.95.3-docker --bind-addr=0.0.0.0:8080 --auth=none --disable-telemetry --disable-update-check
 ```
 
 #### docker buildx
@@ -164,7 +169,7 @@ docker buildx build ...
 ### `docker-rootless` variant(s)
 
 ```sh
-docker run --name code-server --rm -it --privileged -p 127.0.0.1:8080:8080 theohbrothers/docker-code-server:4.93.1-docker-rootless
+docker run --name code-server --rm -it --privileged -p 127.0.0.1:8080:8080 theohbrothers/docker-code-server:4.95.3-docker-rootless
 # code-server is now available at http://127.0.0.1:8080. To login, use the password in the config file:
 docker exec code-server sh -c 'cat ~/.config/code-server/config.yaml'
 ```
@@ -172,7 +177,7 @@ docker exec code-server sh -c 'cat ~/.config/code-server/config.yaml'
 To start code-server without password authentication, use `--auth=none`:
 
 ```sh
-docker run --name code-server --rm -it -p 127.0.0.1:8080:8080 theohbrothers/docker-code-server:4.93.1-docker-rootless --bind-addr=0.0.0.0:8080 --auth=none --disable-telemetry --disable-update-check
+docker run --name code-server --rm -it -p 127.0.0.1:8080:8080 theohbrothers/docker-code-server:4.95.3-docker-rootless --bind-addr=0.0.0.0:8080 --auth=none --disable-telemetry --disable-update-check
 ```
 
 To build multi-arch images using `docker buildx`, see [here](#docker-buildx).
diff --git a/generate/definitions/versions.json b/generate/definitions/versions.json
index f5e6f67..225787d 100644
--- a/generate/definitions/versions.json
+++ b/generate/definitions/versions.json
@@ -1,6 +1,7 @@
 {
   "code-server": {
     "versions": [
+      "4.95.3",
       "4.93.1",
       "4.92.2",
       "4.91.1",
diff --git a/variants/4.95.3-docker-go-1.20.14/Dockerfile b/variants/4.95.3-docker-go-1.20.14/Dockerfile
new file mode 100644
index 0000000..29df30f
--- /dev/null
+++ b/variants/4.95.3-docker-go-1.20.14/Dockerfile
@@ -0,0 +1,350 @@
+# syntax=docker/dockerfile:1
+FROM alpine:3.17
+ARG TARGETPLATFORM
+ARG TARGETOS
+ARG TARGETARCH
+ARG TARGETVARIANT
+ARG BUILDPLATFORM
+ARG BUILDOS
+ARG BUILDARCH
+ARG BUILDVARIANT
+RUN set -eu; \
+    echo "TARGETPLATFORM=$TARGETPLATFORM"; \
+    echo "TARGETOS=$TARGETOS"; \
+    echo "TARGETARCH=$TARGETARCH"; \
+    echo "TARGETVARIANT=$TARGETVARIANT"; \
+    echo "BUILDPLATFORM=$BUILDPLATFORM"; \
+    echo "BUILDOS=$BUILDOS"; \
+    echo "BUILDARCH=$BUILDARCH"; \
+    echo "BUILDVARIANT=$BUILDVARIANT";
+
+RUN --mount=type=secret,id=GITHUB_TOKEN \
+    set -eux; \
+    DEPS='alpine-sdk bash libstdc++ libc6-compat python3'; \
+    apk add --no-cache $DEPS; \
+    # Constraint to npm 8, or else npm will fail with 'npm ERR! python is not a valid npm option'. See: https://stackoverflow.com/questions/74522956/python-is-not-a-valid-npm-option and https://jubianchi.github.io/semver-check/#/~8/8
+    apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/v3.15/main npm~8; \
+    apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/v3.20/main nodejs~20; \
+    # Fix python3.12 failing with: ModuleNotFoundError: No module named 'distutils' on alpine:3.20
+    # apk add --no-cache py3-setuptools; \
+    # Fix errors about missing spdlog
+    # apk add --no-cache spdlog; \
+    # Install kerberos dependencies https://github.com/coder/code-server/issues/6535
+    apk add --no-cache krb5-dev; \
+    npm config set python python3; \
+    # Use 'NODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT' to fix node 18.20 and 20.12 making experimental API the default, which breaks builds
+    # Use '-U_FORTIFY_SOURCE' to fix vsnprintf errors in alpine: https://gitlab.alpinelinux.org/alpine/aports/-/issues/8626
+    # Use '-DUSE_IPO=OFF -DWHOLE_PROGRAM_OPTIMISATION=OFF' to fix lto-wrapper errors?
+    ( set +x; export GITHUB_TOKEN=$( cat /run/secrets/GITHUB_TOKEN ); set -x; CXXFLAGS='-DNODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT -U_FORTIFY_SOURCE' npm install --global code-server@4.95.3 --unsafe-perm ); \
+    # Fix missing dependencies. See: https://github.com/coder/code-server/issues/5530
+    ( cd /usr/local/lib/node_modules/code-server/lib/vscode; set +x; export GITHUB_TOKEN=$( cat /run/secrets/GITHUB_TOKEN ); set -x; CXXFLAGS='-DNODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT -U_FORTIFY_SOURCE' npm install --legacy-peer-deps ); \
+    code-server --version; \
+    apk del $DEPS
+
+# Install tools
+RUN set -eux; \
+    apk add --no-cache bash bash-completion ca-certificates curl gnupg git git-lfs github-cli iotop jq less lsblk make nano openssh-client openssl p7zip rsync tree yq
+
+# Install pwsh
+# See: https://learn.microsoft.com/en-us/powershell/scripting/install/install-alpine?view=powershell-7.3
+RUN set -eux; \
+    apk add --no-cache \
+    ca-certificates \
+    less \
+    ncurses-terminfo-base \
+    krb5-libs \
+    libgcc \
+    libintl \
+    libssl1.1 \
+    libstdc++ \
+    tzdata \
+    userspace-rcu \
+    zlib \
+    icu-libs \
+    curl
+RUN apk -X https://dl-cdn.alpinelinux.org/alpine/edge/main add --no-cache lttng-ust
+RUN set -eux; \
+    mkdir -p /opt/microsoft/powershell/7; \
+    curl -sSL https://github.com/PowerShell/PowerShell/releases/download/v7.2.8/powershell-7.2.8-linux-alpine-x64.tar.gz | tar -C /opt/microsoft/powershell/7 -zxf -; \
+    chmod +x /opt/microsoft/powershell/7/pwsh; \
+    ln -s /opt/microsoft/powershell/7/pwsh /usr/bin/pwsh
+# Disable telemetry for powershell 7.0.0 and above and .NET core: https://github.com/PowerShell/PowerShell/issues/16234#issuecomment-942139350
+ENV POWERSHELL_CLI_TELEMETRY_OPTOUT=1
+ENV POWERSHELL_TELEMETRY_OPTOUT=1
+ENV POWERSHELL_UPDATECHECK=Off
+ENV POWERSHELL_UPDATECHECK_OPTOUT=1
+ENV DOTNET_CLI_TELEMETRY_OPTOUT=1
+ENV DOTNET_TELEMETRY_OPTOUT=1
+ENV COMPlus_EnableDiagnostics=0
+RUN pwsh -version
+# Install pwsh module(s)
+RUN pwsh -c 'Install-Module Pester -Force -Scope AllUsers -MinimumVersion 4.0.0 -MaximumVersion 4.10.1 -ErrorAction Stop'
+
+RUN apk add --no-cache sudo
+RUN adduser -u 1000 --gecos '' -D user
+RUN echo 'user ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/user
+
+# Install common extensions
+USER user
+# beautify - code formatter
+RUN code-server --install-extension hookyqr.beautify@1.4.11
+# docker
+RUN code-server --install-extension ms-azuretools.vscode-docker@1.18.0
+# firefox
+RUN code-server --install-extension firefox-devtools.vscode-firefox-debug@2.9.1
+# git
+RUN code-server --install-extension donjayamanne.githistory@0.6.19
+RUN code-server --install-extension eamodio.gitlens@11.6.0
+# github. Install the latest compatible version
+RUN code-server --install-extension github.vscode-pull-request-github
+# gitlab
+RUN code-server --install-extension gitlab.gitlab-workflow@3.60.0
+# jinja
+RUN code-server --install-extension samuelcolvin.jinjahtml@0.16.0
+RUN code-server --install-extension wholroyd.jinja@0.0.8
+# kubernetes
+RUN code-server --install-extension ms-kubernetes-tools.vscode-kubernetes-tools@1.3.11
+# markdown
+RUN code-server --install-extension bierner.markdown-preview-github-styles@0.1.6
+RUN code-server --install-extension DavidAnson.vscode-markdownlint@0.43.2
+# prettier - code formatter
+RUN code-server --install-extension esbenp.prettier-vscode@9.0.0
+# pwsh
+RUN code-server --install-extension ms-vscode.powershell@2021.12.0
+# svg
+RUN code-server --install-extension jock.svg@1.4.17
+# terraform
+RUN code-server --install-extension hashicorp.terraform@2.14.0
+# toml
+RUN code-server --install-extension bungcip.better-toml@0.3.2
+# vscode
+RUN code-server --install-extension vscode-icons-team.vscode-icons@11.13.0
+# xml
+RUN code-server --install-extension redhat.vscode-xml@0.18.0
+# yaml
+RUN code-server --install-extension redhat.vscode-yaml@1.9.1
+
+# Install docker
+# See: https://github.com/moby/moby/blob/v20.10.22/project/PACKAGERS.md
+# Install docker-cli dependencies
+USER root
+RUN set -eux; \
+    apk add --no-cache \
+        ca-certificates \
+        git \
+        # Workaround for golang 1.15 not producing static binaries. See: https://github.com/containerd/containerd/issues/5824
+        libc6-compat \
+        openssh-client
+# Install dockerd dependencies
+RUN apk add --no-cache \
+        btrfs-progs \
+        e2fsprogs \
+        e2fsprogs-extra \
+        ip6tables \
+        iptables \
+        openssl \
+        pigz \
+        shadow-uidmap \
+        xfsprogs \
+        xz \
+        zfs
+# Add userns-remap support. See: https://docs.docker.com/engine/security/userns-remap/
+RUN set -eux; \
+    addgroup -S dockremap; \
+    adduser -S -G dockremap dockremap; \
+    echo 'dockremap:231072:65536' >> /etc/subuid; \
+    echo 'dockremap:231072:65536' >> /etc/subgid
+# Install docker
+RUN set -eux; \
+    case "$( uname -m )" in \
+        'x86_64') \
+            URL='https://download.docker.com/linux/static/stable/x86_64/docker-24.0.9.tgz'; \
+            ;; \
+        'armhf') \
+            URL='https://download.docker.com/linux/static/stable/armel/docker-24.0.9.tgz'; \
+            ;; \
+        'armv7') \
+            URL='https://download.docker.com/linux/static/stable/armhf/docker-24.0.9.tgz'; \
+            ;; \
+        'aarch64') \
+            URL='https://download.docker.com/linux/static/stable/aarch64/docker-24.0.9.tgz'; \
+            ;; \
+        # These architectures are no longer supported as of docker 20.10.x
+        # 'ppc64le') \
+        # 	URL='https://download.docker.com/linux/static/stable/ppc64le/docker-24.0.9.tgz'; \
+        # 	;; \
+        # 's390x') \
+        # 	URL='https://download.docker.com/linux/static/stable/s390x/docker-24.0.9.tgz'; \
+        # 	;; \
+        *) \
+            echo "Architecture not supported"; \
+            exit 1; \
+            ;; \
+    esac; \
+    wget -q "$URL" -O docker.tgz; \
+    tar -xvf docker.tgz --strip-components=1 --no-same-owner --no-same-permissions -C /usr/local/bin; \
+    ls -al /usr/local/bin; \
+    rm -v docker.tgz; \
+    containerd --version; \
+    ctr --version; \
+    docker --version; \
+    dockerd --version; \
+    runc --version
+# Install bash completion
+RUN wget -q https://raw.githubusercontent.com/docker/cli/master/contrib/completion/bash/docker -O /usr/share/bash-completion/completions/docker
+# Post-install docker. See: https://docs.docker.com/engine/install/linux-postinstall/
+RUN set -eux; \
+    addgroup docker; \
+    adduser user docker;
+VOLUME /var/lib/docker
+
+# Install docker-compose v1 (deprecated, but for backward compatibility)
+USER root
+RUN apk add --no-cache docker-compose
+
+# Install docker-compose
+RUN set -eux; \
+    DOCKER_COMPOSE_VERSION=v2.32.0; \
+    case "$( uname -m )" in \
+        'x86') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-x86_64"; \
+            SHA256=c204bc7058fb881b2a39175df5c3596f6b08ef9e358d7236df7cc781f74695bd; \
+            ;; \
+        'x86_64') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-x86_64"; \
+            SHA256=c204bc7058fb881b2a39175df5c3596f6b08ef9e358d7236df7cc781f74695bd; \
+            ;; \
+        'armhf') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-armv6"; \
+            SHA256=d72e2d4b8ab71fa4b0132b451f43267aaca980c4ee9cb670ae6f83fa101747e7; \
+            ;; \
+        'armv7l') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-armv7"; \
+            SHA256=9e6b63bd2b863c4564fa61c18f2515f0130a8800f12a35c2836fdd6a044ff222; \
+            ;; \
+        'aarch64') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-aarch64"; \
+            SHA256=0bb65b36b32750a876cfdd5720e811ba1b70cb9eca72536fdf4ac7949fbc20e1; \
+            ;; \
+        'ppc64le') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-ppc64le"; \
+            SHA256=5e05371a1b0f3bb4e9785aa9957c98bff625aab675a59e5ae6c75e7e7ec41027; \
+            ;; \
+        'riscv64') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-riscv64"; \
+            SHA256=726362c280a764de1249927857e51bb9f1321a0c4d5192dc0a5e2134ac29a999; \
+            ;; \
+        's390x') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-s390x"; \
+            SHA256=d9c117c743131c3addc933d71d6ee5cbf70951ce34c43b765a7d57c80ef58429; \
+            ;; \
+        *) \
+            echo "Architecture not supported"; \
+            exit 1; \
+            ;; \
+    esac; \
+    FILE=docker-compose; \
+    wget -q "$URL" -O "$FILE"; \
+    echo "$SHA256  $FILE" | sha256sum -c -; \
+    mkdir -pv /usr/libexec/docker/cli-plugins; \
+    mv -v docker-compose /usr/libexec/docker/cli-plugins/docker-compose; \
+    chmod +x /usr/libexec/docker/cli-plugins/docker-compose; \
+    docker compose version; \
+    :
+
+# Install docker-buildx
+RUN set -eux; \
+    DOCKER_BUILDX_VERSION=v0.12.1; \
+    case "$( uname -m )" in \
+        'x86_64') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-amd64"; \
+            SHA256=716321df8ca9c82ffe96f37e9f4aa1199d4969795836dbd57ef72d12e3ac5085; \
+            ;; \
+        'armhf') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-arm-v6"; \
+            SHA256=4b3c78b59c0383ab21327e2902af2ea317e3b85e442b1cd776f0c2a7bbbb2999; \
+            ;; \
+        'armv7l') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-arm-v7"; \
+            SHA256=fe0a9e7812051a72c47d009bf9373e76e23644cc3291c848ac4a9b6f237e9e75; \
+            ;; \
+        'aarch64') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-arm64"; \
+            SHA256=fb72d627f2ee080bba70375c367f4292867821e29ca9a8cf485622f6ede8f436; \
+            ;; \
+        'ppc64le') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-ppc64le"; \
+            SHA256=1c649498d727183d82fb243e08856533ea90e8d63bfcd6f8b23b264dbcf7ea7a; \
+            ;; \
+        'riscv64') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-riscv64"; \
+            SHA256=152e7b423c1ce888eb0a658321eb8c28cc1d09af01acd5c66eddf8474dddf55c; \
+            ;; \
+        's390x') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-s390x"; \
+            SHA256=acee98a9f0550bf2c6c1161cf8067c031ddf0c566c41de7db27847bb72e8ee0b; \
+            ;; \
+        *) \
+            echo "Architecture not supported"; \
+            exit 1; \
+            ;; \
+    esac; \
+    FILE=docker-buildx; \
+    wget -q "$URL" -O "$FILE"; \
+    echo "$SHA256  $FILE" | sha256sum -c -; \
+    mkdir -pv /usr/libexec/docker/cli-plugins; \
+    mv -v docker-buildx /usr/libexec/docker/cli-plugins/docker-buildx; \
+    chmod +x /usr/libexec/docker/cli-plugins/docker-buildx; \
+    docker buildx version; \
+    :
+
+# Install binary tool(s)
+RUN set -eux; \
+    wget https://github.com/GoogleContainerTools/container-diff/releases/download/v0.17.0/container-diff-linux-amd64 -O container-diff; \
+    sha256sum container-diff | grep '^818c219ce9f9670cd5c766b9da5036cf75bbf98bc99eb258f5e8f90e80367c88 '; \
+    mv container-diff /usr/local/bin/container-diff; \
+    chmod +x /usr/local/bin/container-diff; \
+    container-diff version
+
+# Install golang binaries from official golang image
+# See: https://go.dev/dl/
+USER root
+ENV GOLANG_VERSION 1.20.14
+ENV PATH=/usr/local/go/bin:$PATH
+COPY --from=golang:1.20.14-alpine /usr/local/go /usr/local/go
+RUN go version
+
+# Install development tools
+RUN set -eux; \
+    export GOBIN=/usr/local/bin; \
+    go install github.com/go-delve/delve/cmd/dlv@v1.20.1; \
+    dlv version; \
+    go install golang.org/x/tools/gopls@v0.11.0; \
+    gopls version; \
+    rm -rf ~/go;
+
+# Install extensions
+USER user
+RUN code-server --install-extension golang.go@0.38.0
+
+# Add a default settings.json
+USER user
+COPY --chown=1000:1000 settings.json /home/user/.local/share/code-server/User/settings.json
+
+# Remove the default code-server config file created when extensions are installed
+USER user
+RUN rm -fv ~/.config/code-server/config.yaml
+
+# Symlink code to code-server
+USER root
+RUN ln -sfn /usr/local/bin/code-server /usr/local/bin/code
+
+USER root
+COPY docker-entrypoint.sh /docker-entrypoint.sh
+RUN chmod +x /docker-entrypoint.sh
+
+ENV LANG=en_US.UTF-8
+USER user
+WORKDIR /home/user
+ENTRYPOINT [ "/docker-entrypoint.sh" ]
+CMD [ "--bind-addr=0.0.0.0:8080", "--disable-telemetry", "--disable-update-check" ]
diff --git a/variants/4.95.3-docker-go-1.20.14/docker-entrypoint.sh b/variants/4.95.3-docker-go-1.20.14/docker-entrypoint.sh
new file mode 100644
index 0000000..7e38790
--- /dev/null
+++ b/variants/4.95.3-docker-go-1.20.14/docker-entrypoint.sh
@@ -0,0 +1,16 @@
+#!/bin/sh
+set -eu
+
+# See: https://github.com/docker-library/official-images#consistency
+if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then
+    set -- code-server "$@"
+fi
+if [ "$1" = 'code-server' ]; then
+    echo "Starting dockerd"
+    sudo rm -fv /var/run/docker.pid
+    sudo dockerd &
+
+    echo "Starting code-server"
+    exec code-server "$@"
+fi
+exec "$@"
diff --git a/variants/4.95.3-docker-go-1.20.14/settings.json b/variants/4.95.3-docker-go-1.20.14/settings.json
new file mode 100644
index 0000000..2c0c460
--- /dev/null
+++ b/variants/4.95.3-docker-go-1.20.14/settings.json
@@ -0,0 +1,24 @@
+{
+  "extensions.autoCheckUpdates": false,
+  "extensions.autoUpdate": false,
+  "extensions.ignoreRecommendations": true,
+  "extensions.showRecommendationsOnlyOnDemand": true,
+  "npm.fetchOnlinePackageInfo": false,
+  "telemetry.enableTelemetry": false,
+  "telemetry.telemetryLevel": "off",
+  "typescript.check.npmIsInstalled": false,
+  "typescript.disableAutomaticTypeAcquisition": false,
+  "typescript.surveys.enabled": false,
+  "workbench.enableExperiments": false,
+  "workbench.iconTheme": "vscode-icons",
+  "workbench.settings.enableNaturalLanguageSearch": false,
+  "workbench.startupEditor": "none",
+  "workbench.welcomePage.walkthroughs.openOnInstall": false,
+  "workbench.tips.enabled": false,
+
+  // Extension-specific
+  "gitlens.showWelcomeOnInstall": false,
+  "gitlens.showWhatsNewAfterUpgrades": false,
+  "redhat.telemetry.enabled": false,
+  "vsicons.dontShowNewVersionMessage": true,
+}
\ No newline at end of file
diff --git a/variants/4.95.3-docker-rootless-go-1.20.14/Dockerfile b/variants/4.95.3-docker-rootless-go-1.20.14/Dockerfile
new file mode 100644
index 0000000..917c802
--- /dev/null
+++ b/variants/4.95.3-docker-rootless-go-1.20.14/Dockerfile
@@ -0,0 +1,398 @@
+# syntax=docker/dockerfile:1
+FROM alpine:3.17
+ARG TARGETPLATFORM
+ARG TARGETOS
+ARG TARGETARCH
+ARG TARGETVARIANT
+ARG BUILDPLATFORM
+ARG BUILDOS
+ARG BUILDARCH
+ARG BUILDVARIANT
+RUN set -eu; \
+    echo "TARGETPLATFORM=$TARGETPLATFORM"; \
+    echo "TARGETOS=$TARGETOS"; \
+    echo "TARGETARCH=$TARGETARCH"; \
+    echo "TARGETVARIANT=$TARGETVARIANT"; \
+    echo "BUILDPLATFORM=$BUILDPLATFORM"; \
+    echo "BUILDOS=$BUILDOS"; \
+    echo "BUILDARCH=$BUILDARCH"; \
+    echo "BUILDVARIANT=$BUILDVARIANT";
+
+RUN --mount=type=secret,id=GITHUB_TOKEN \
+    set -eux; \
+    DEPS='alpine-sdk bash libstdc++ libc6-compat python3'; \
+    apk add --no-cache $DEPS; \
+    # Constraint to npm 8, or else npm will fail with 'npm ERR! python is not a valid npm option'. See: https://stackoverflow.com/questions/74522956/python-is-not-a-valid-npm-option and https://jubianchi.github.io/semver-check/#/~8/8
+    apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/v3.15/main npm~8; \
+    apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/v3.20/main nodejs~20; \
+    # Fix python3.12 failing with: ModuleNotFoundError: No module named 'distutils' on alpine:3.20
+    # apk add --no-cache py3-setuptools; \
+    # Fix errors about missing spdlog
+    # apk add --no-cache spdlog; \
+    # Install kerberos dependencies https://github.com/coder/code-server/issues/6535
+    apk add --no-cache krb5-dev; \
+    npm config set python python3; \
+    # Use 'NODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT' to fix node 18.20 and 20.12 making experimental API the default, which breaks builds
+    # Use '-U_FORTIFY_SOURCE' to fix vsnprintf errors in alpine: https://gitlab.alpinelinux.org/alpine/aports/-/issues/8626
+    # Use '-DUSE_IPO=OFF -DWHOLE_PROGRAM_OPTIMISATION=OFF' to fix lto-wrapper errors?
+    ( set +x; export GITHUB_TOKEN=$( cat /run/secrets/GITHUB_TOKEN ); set -x; CXXFLAGS='-DNODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT -U_FORTIFY_SOURCE' npm install --global code-server@4.95.3 --unsafe-perm ); \
+    # Fix missing dependencies. See: https://github.com/coder/code-server/issues/5530
+    ( cd /usr/local/lib/node_modules/code-server/lib/vscode; set +x; export GITHUB_TOKEN=$( cat /run/secrets/GITHUB_TOKEN ); set -x; CXXFLAGS='-DNODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT -U_FORTIFY_SOURCE' npm install --legacy-peer-deps ); \
+    code-server --version; \
+    apk del $DEPS
+
+# Install tools
+RUN set -eux; \
+    apk add --no-cache bash bash-completion ca-certificates curl gnupg git git-lfs github-cli iotop jq less lsblk make nano openssh-client openssl p7zip rsync tree yq
+
+# Install pwsh
+# See: https://learn.microsoft.com/en-us/powershell/scripting/install/install-alpine?view=powershell-7.3
+RUN set -eux; \
+    apk add --no-cache \
+    ca-certificates \
+    less \
+    ncurses-terminfo-base \
+    krb5-libs \
+    libgcc \
+    libintl \
+    libssl1.1 \
+    libstdc++ \
+    tzdata \
+    userspace-rcu \
+    zlib \
+    icu-libs \
+    curl
+RUN apk -X https://dl-cdn.alpinelinux.org/alpine/edge/main add --no-cache lttng-ust
+RUN set -eux; \
+    mkdir -p /opt/microsoft/powershell/7; \
+    curl -sSL https://github.com/PowerShell/PowerShell/releases/download/v7.2.8/powershell-7.2.8-linux-alpine-x64.tar.gz | tar -C /opt/microsoft/powershell/7 -zxf -; \
+    chmod +x /opt/microsoft/powershell/7/pwsh; \
+    ln -s /opt/microsoft/powershell/7/pwsh /usr/bin/pwsh
+# Disable telemetry for powershell 7.0.0 and above and .NET core: https://github.com/PowerShell/PowerShell/issues/16234#issuecomment-942139350
+ENV POWERSHELL_CLI_TELEMETRY_OPTOUT=1
+ENV POWERSHELL_TELEMETRY_OPTOUT=1
+ENV POWERSHELL_UPDATECHECK=Off
+ENV POWERSHELL_UPDATECHECK_OPTOUT=1
+ENV DOTNET_CLI_TELEMETRY_OPTOUT=1
+ENV DOTNET_TELEMETRY_OPTOUT=1
+ENV COMPlus_EnableDiagnostics=0
+RUN pwsh -version
+# Install pwsh module(s)
+RUN pwsh -c 'Install-Module Pester -Force -Scope AllUsers -MinimumVersion 4.0.0 -MaximumVersion 4.10.1 -ErrorAction Stop'
+
+RUN apk add --no-cache sudo
+RUN adduser -u 1000 --gecos '' -D user
+RUN echo 'user ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/user
+
+# Install common extensions
+USER user
+# beautify - code formatter
+RUN code-server --install-extension hookyqr.beautify@1.4.11
+# docker
+RUN code-server --install-extension ms-azuretools.vscode-docker@1.18.0
+# firefox
+RUN code-server --install-extension firefox-devtools.vscode-firefox-debug@2.9.1
+# git
+RUN code-server --install-extension donjayamanne.githistory@0.6.19
+RUN code-server --install-extension eamodio.gitlens@11.6.0
+# github. Install the latest compatible version
+RUN code-server --install-extension github.vscode-pull-request-github
+# gitlab
+RUN code-server --install-extension gitlab.gitlab-workflow@3.60.0
+# jinja
+RUN code-server --install-extension samuelcolvin.jinjahtml@0.16.0
+RUN code-server --install-extension wholroyd.jinja@0.0.8
+# kubernetes
+RUN code-server --install-extension ms-kubernetes-tools.vscode-kubernetes-tools@1.3.11
+# markdown
+RUN code-server --install-extension bierner.markdown-preview-github-styles@0.1.6
+RUN code-server --install-extension DavidAnson.vscode-markdownlint@0.43.2
+# prettier - code formatter
+RUN code-server --install-extension esbenp.prettier-vscode@9.0.0
+# pwsh
+RUN code-server --install-extension ms-vscode.powershell@2021.12.0
+# svg
+RUN code-server --install-extension jock.svg@1.4.17
+# terraform
+RUN code-server --install-extension hashicorp.terraform@2.14.0
+# toml
+RUN code-server --install-extension bungcip.better-toml@0.3.2
+# vscode
+RUN code-server --install-extension vscode-icons-team.vscode-icons@11.13.0
+# xml
+RUN code-server --install-extension redhat.vscode-xml@0.18.0
+# yaml
+RUN code-server --install-extension redhat.vscode-yaml@1.9.1
+
+# Install docker
+# See: https://github.com/moby/moby/blob/v20.10.22/project/PACKAGERS.md
+# Install docker-cli dependencies
+USER root
+RUN set -eux; \
+    apk add --no-cache \
+        ca-certificates \
+        git \
+        # Workaround for golang 1.15 not producing static binaries. See: https://github.com/containerd/containerd/issues/5824
+        libc6-compat \
+        openssh-client
+# Install dockerd dependencies
+RUN apk add --no-cache \
+        btrfs-progs \
+        e2fsprogs \
+        e2fsprogs-extra \
+        ip6tables \
+        iptables \
+        openssl \
+        pigz \
+        shadow-uidmap \
+        xfsprogs \
+        xz \
+        zfs
+# Add userns-remap support. See: https://docs.docker.com/engine/security/userns-remap/
+RUN set -eux; \
+    addgroup -S dockremap; \
+    adduser -S -G dockremap dockremap; \
+    echo 'dockremap:231072:65536' >> /etc/subuid; \
+    echo 'dockremap:231072:65536' >> /etc/subgid
+# Install docker
+RUN set -eux; \
+    case "$( uname -m )" in \
+        'x86_64') \
+            URL='https://download.docker.com/linux/static/stable/x86_64/docker-24.0.9.tgz'; \
+            ;; \
+        'armhf') \
+            URL='https://download.docker.com/linux/static/stable/armel/docker-24.0.9.tgz'; \
+            ;; \
+        'armv7') \
+            URL='https://download.docker.com/linux/static/stable/armhf/docker-24.0.9.tgz'; \
+            ;; \
+        'aarch64') \
+            URL='https://download.docker.com/linux/static/stable/aarch64/docker-24.0.9.tgz'; \
+            ;; \
+        # These architectures are no longer supported as of docker 20.10.x
+        # 'ppc64le') \
+        # 	URL='https://download.docker.com/linux/static/stable/ppc64le/docker-24.0.9.tgz'; \
+        # 	;; \
+        # 's390x') \
+        # 	URL='https://download.docker.com/linux/static/stable/s390x/docker-24.0.9.tgz'; \
+        # 	;; \
+        *) \
+            echo "Architecture not supported"; \
+            exit 1; \
+            ;; \
+    esac; \
+    wget -q "$URL" -O docker.tgz; \
+    tar -xvf docker.tgz --strip-components=1 --no-same-owner --no-same-permissions -C /usr/local/bin; \
+    ls -al /usr/local/bin; \
+    rm -v docker.tgz; \
+    containerd --version; \
+    ctr --version; \
+    docker --version; \
+    dockerd --version; \
+    runc --version
+# Install bash completion
+RUN wget -q https://raw.githubusercontent.com/docker/cli/master/contrib/completion/bash/docker -O /usr/share/bash-completion/completions/docker
+# Post-install docker. See: https://docs.docker.com/engine/install/linux-postinstall/
+RUN set -eux; \
+    addgroup docker; \
+    adduser user docker;
+VOLUME /var/lib/docker
+
+# Install rootless docker. See: https://docs.docker.com/engine/security/rootless/
+USER root
+RUN apk add --no-cache iproute2 fuse-overlayfs
+RUN set -eux; \
+    echo user:100000:65536 >> /etc/subuid; \
+    echo user:100000:65536 >> /etc/subgid
+RUN set -eux; \
+    case "$( uname -m )" in \
+        'x86_64') \
+            URL='https://download.docker.com/linux/static/stable/x86_64/docker-rootless-extras-24.0.9.tgz'; \
+            ;; \
+        'aarch64') \
+            URL='https://download.docker.com/linux/static/stable/aarch64/docker-rootless-extras-24.0.9.tgz'; \
+            ;; \
+        'armv7') \
+            URL='https://download.docker.com/linux/static/stable/armhf/docker-rootless-extras-24.0.9.tgz'; \
+            ;; \
+        'aarch64') \
+            URL='https://download.docker.com/linux/static/stable/aarch64/docker-rootless-extras-24.0.9.tgz'; \
+            ;; \
+        *) \
+            echo "Architecture not supported"; \
+            exit 1; \
+            ;; \
+    esac; \
+    wget -q "$URL" -O docker-rootless-extras.tgz; \
+    tar -xvf docker-rootless-extras.tgz --strip-components=1 --no-same-owner --no-same-permissions -C /usr/local/bin \
+        'docker-rootless-extras/rootlesskit' \
+        'docker-rootless-extras/rootlesskit-docker-proxy' \
+        'docker-rootless-extras/vpnkit' \
+    ; \
+    ls -al /usr/local/bin; \
+    rm -v docker-rootless-extras.tgz; \
+    rootlesskit --version; \
+    vpnkit --version
+# Create XDG_RUNTIME_DIR
+RUN set -eux; \
+    mkdir /run/user; \
+    chmod 1777 /run/user
+# Create /var/lib/docker
+RUN set -eux; \
+    mkdir -p /home/user/.local/share/docker; \
+    chown user:user /home/user/.local/share/docker
+VOLUME /home/user/.local/share/docker
+# Set env vars
+ENV XDG_RUNTIME_DIR=/run/user/1000
+ENV DOCKER_HOST=unix:///run/user/1000/docker.sock
+
+# Install docker-compose v1 (deprecated, but for backward compatibility)
+USER root
+RUN apk add --no-cache docker-compose
+
+# Install docker-compose
+RUN set -eux; \
+    DOCKER_COMPOSE_VERSION=v2.32.0; \
+    case "$( uname -m )" in \
+        'x86') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-x86_64"; \
+            SHA256=c204bc7058fb881b2a39175df5c3596f6b08ef9e358d7236df7cc781f74695bd; \
+            ;; \
+        'x86_64') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-x86_64"; \
+            SHA256=c204bc7058fb881b2a39175df5c3596f6b08ef9e358d7236df7cc781f74695bd; \
+            ;; \
+        'armhf') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-armv6"; \
+            SHA256=d72e2d4b8ab71fa4b0132b451f43267aaca980c4ee9cb670ae6f83fa101747e7; \
+            ;; \
+        'armv7l') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-armv7"; \
+            SHA256=9e6b63bd2b863c4564fa61c18f2515f0130a8800f12a35c2836fdd6a044ff222; \
+            ;; \
+        'aarch64') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-aarch64"; \
+            SHA256=0bb65b36b32750a876cfdd5720e811ba1b70cb9eca72536fdf4ac7949fbc20e1; \
+            ;; \
+        'ppc64le') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-ppc64le"; \
+            SHA256=5e05371a1b0f3bb4e9785aa9957c98bff625aab675a59e5ae6c75e7e7ec41027; \
+            ;; \
+        'riscv64') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-riscv64"; \
+            SHA256=726362c280a764de1249927857e51bb9f1321a0c4d5192dc0a5e2134ac29a999; \
+            ;; \
+        's390x') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-s390x"; \
+            SHA256=d9c117c743131c3addc933d71d6ee5cbf70951ce34c43b765a7d57c80ef58429; \
+            ;; \
+        *) \
+            echo "Architecture not supported"; \
+            exit 1; \
+            ;; \
+    esac; \
+    FILE=docker-compose; \
+    wget -q "$URL" -O "$FILE"; \
+    echo "$SHA256  $FILE" | sha256sum -c -; \
+    mkdir -pv /usr/libexec/docker/cli-plugins; \
+    mv -v docker-compose /usr/libexec/docker/cli-plugins/docker-compose; \
+    chmod +x /usr/libexec/docker/cli-plugins/docker-compose; \
+    docker compose version; \
+    :
+
+# Install docker-buildx
+RUN set -eux; \
+    DOCKER_BUILDX_VERSION=v0.12.1; \
+    case "$( uname -m )" in \
+        'x86_64') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-amd64"; \
+            SHA256=716321df8ca9c82ffe96f37e9f4aa1199d4969795836dbd57ef72d12e3ac5085; \
+            ;; \
+        'armhf') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-arm-v6"; \
+            SHA256=4b3c78b59c0383ab21327e2902af2ea317e3b85e442b1cd776f0c2a7bbbb2999; \
+            ;; \
+        'armv7l') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-arm-v7"; \
+            SHA256=fe0a9e7812051a72c47d009bf9373e76e23644cc3291c848ac4a9b6f237e9e75; \
+            ;; \
+        'aarch64') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-arm64"; \
+            SHA256=fb72d627f2ee080bba70375c367f4292867821e29ca9a8cf485622f6ede8f436; \
+            ;; \
+        'ppc64le') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-ppc64le"; \
+            SHA256=1c649498d727183d82fb243e08856533ea90e8d63bfcd6f8b23b264dbcf7ea7a; \
+            ;; \
+        'riscv64') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-riscv64"; \
+            SHA256=152e7b423c1ce888eb0a658321eb8c28cc1d09af01acd5c66eddf8474dddf55c; \
+            ;; \
+        's390x') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-s390x"; \
+            SHA256=acee98a9f0550bf2c6c1161cf8067c031ddf0c566c41de7db27847bb72e8ee0b; \
+            ;; \
+        *) \
+            echo "Architecture not supported"; \
+            exit 1; \
+            ;; \
+    esac; \
+    FILE=docker-buildx; \
+    wget -q "$URL" -O "$FILE"; \
+    echo "$SHA256  $FILE" | sha256sum -c -; \
+    mkdir -pv /usr/libexec/docker/cli-plugins; \
+    mv -v docker-buildx /usr/libexec/docker/cli-plugins/docker-buildx; \
+    chmod +x /usr/libexec/docker/cli-plugins/docker-buildx; \
+    docker buildx version; \
+    :
+
+# Install binary tool(s)
+RUN set -eux; \
+    wget https://github.com/GoogleContainerTools/container-diff/releases/download/v0.17.0/container-diff-linux-amd64 -O container-diff; \
+    sha256sum container-diff | grep '^818c219ce9f9670cd5c766b9da5036cf75bbf98bc99eb258f5e8f90e80367c88 '; \
+    mv container-diff /usr/local/bin/container-diff; \
+    chmod +x /usr/local/bin/container-diff; \
+    container-diff version
+
+# Install golang binaries from official golang image
+# See: https://go.dev/dl/
+USER root
+ENV GOLANG_VERSION 1.20.14
+ENV PATH=/usr/local/go/bin:$PATH
+COPY --from=golang:1.20.14-alpine /usr/local/go /usr/local/go
+RUN go version
+
+# Install development tools
+RUN set -eux; \
+    export GOBIN=/usr/local/bin; \
+    go install github.com/go-delve/delve/cmd/dlv@v1.20.1; \
+    dlv version; \
+    go install golang.org/x/tools/gopls@v0.11.0; \
+    gopls version; \
+    rm -rf ~/go;
+
+# Install extensions
+USER user
+RUN code-server --install-extension golang.go@0.38.0
+
+# Add a default settings.json
+USER user
+COPY --chown=1000:1000 settings.json /home/user/.local/share/code-server/User/settings.json
+
+# Remove the default code-server config file created when extensions are installed
+USER user
+RUN rm -fv ~/.config/code-server/config.yaml
+
+# Symlink code to code-server
+USER root
+RUN ln -sfn /usr/local/bin/code-server /usr/local/bin/code
+
+USER root
+COPY docker-entrypoint.sh /docker-entrypoint.sh
+RUN chmod +x /docker-entrypoint.sh
+
+ENV LANG=en_US.UTF-8
+USER user
+WORKDIR /home/user
+ENTRYPOINT [ "/docker-entrypoint.sh" ]
+CMD [ "--bind-addr=0.0.0.0:8080", "--disable-telemetry", "--disable-update-check" ]
diff --git a/variants/4.95.3-docker-rootless-go-1.20.14/docker-entrypoint.sh b/variants/4.95.3-docker-rootless-go-1.20.14/docker-entrypoint.sh
new file mode 100644
index 0000000..e3f7fd0
--- /dev/null
+++ b/variants/4.95.3-docker-rootless-go-1.20.14/docker-entrypoint.sh
@@ -0,0 +1,27 @@
+#!/bin/sh
+set -eu
+
+# See: https://github.com/docker-library/official-images#consistency
+if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then
+    set -- code-server "$@"
+fi
+if [ "$1" = 'code-server' ]; then
+    # Start rootless docker
+    # See: https://github.com/moby/moby/blob/v20.10.22/contrib/dockerd-rootless.sh
+    # See: https://github.com/docker-library/docker/blob/master/20.10/dind/dockerd-entrypoint.sh
+    echo "Starting rootless dockerd"
+    rootlesskit \
+        --net="${DOCKERD_ROOTLESS_ROOTLESSKIT_NET:-vpnkit}" \
+        --mtu="${DOCKERD_ROOTLESS_ROOTLESSKIT_MTU:-1500}" \
+        --disable-host-loopback \
+        --port-driver="${DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER:-builtin}" \
+        --copy-up=/etc \
+        --copy-up=/run \
+        --propagation=rslave \
+        ${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} \
+        dockerd &
+
+    echo "Starting code-server"
+    exec code-server "$@"
+fi
+exec "$@"
diff --git a/variants/4.95.3-docker-rootless-go-1.20.14/settings.json b/variants/4.95.3-docker-rootless-go-1.20.14/settings.json
new file mode 100644
index 0000000..2c0c460
--- /dev/null
+++ b/variants/4.95.3-docker-rootless-go-1.20.14/settings.json
@@ -0,0 +1,24 @@
+{
+  "extensions.autoCheckUpdates": false,
+  "extensions.autoUpdate": false,
+  "extensions.ignoreRecommendations": true,
+  "extensions.showRecommendationsOnlyOnDemand": true,
+  "npm.fetchOnlinePackageInfo": false,
+  "telemetry.enableTelemetry": false,
+  "telemetry.telemetryLevel": "off",
+  "typescript.check.npmIsInstalled": false,
+  "typescript.disableAutomaticTypeAcquisition": false,
+  "typescript.surveys.enabled": false,
+  "workbench.enableExperiments": false,
+  "workbench.iconTheme": "vscode-icons",
+  "workbench.settings.enableNaturalLanguageSearch": false,
+  "workbench.startupEditor": "none",
+  "workbench.welcomePage.walkthroughs.openOnInstall": false,
+  "workbench.tips.enabled": false,
+
+  // Extension-specific
+  "gitlens.showWelcomeOnInstall": false,
+  "gitlens.showWhatsNewAfterUpgrades": false,
+  "redhat.telemetry.enabled": false,
+  "vsicons.dontShowNewVersionMessage": true,
+}
\ No newline at end of file
diff --git a/variants/4.95.3-docker-rootless/Dockerfile b/variants/4.95.3-docker-rootless/Dockerfile
new file mode 100644
index 0000000..b23ae38
--- /dev/null
+++ b/variants/4.95.3-docker-rootless/Dockerfile
@@ -0,0 +1,377 @@
+# syntax=docker/dockerfile:1
+FROM alpine:3.17
+ARG TARGETPLATFORM
+ARG TARGETOS
+ARG TARGETARCH
+ARG TARGETVARIANT
+ARG BUILDPLATFORM
+ARG BUILDOS
+ARG BUILDARCH
+ARG BUILDVARIANT
+RUN set -eu; \
+    echo "TARGETPLATFORM=$TARGETPLATFORM"; \
+    echo "TARGETOS=$TARGETOS"; \
+    echo "TARGETARCH=$TARGETARCH"; \
+    echo "TARGETVARIANT=$TARGETVARIANT"; \
+    echo "BUILDPLATFORM=$BUILDPLATFORM"; \
+    echo "BUILDOS=$BUILDOS"; \
+    echo "BUILDARCH=$BUILDARCH"; \
+    echo "BUILDVARIANT=$BUILDVARIANT";
+
+RUN --mount=type=secret,id=GITHUB_TOKEN \
+    set -eux; \
+    DEPS='alpine-sdk bash libstdc++ libc6-compat python3'; \
+    apk add --no-cache $DEPS; \
+    # Constraint to npm 8, or else npm will fail with 'npm ERR! python is not a valid npm option'. See: https://stackoverflow.com/questions/74522956/python-is-not-a-valid-npm-option and https://jubianchi.github.io/semver-check/#/~8/8
+    apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/v3.15/main npm~8; \
+    apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/v3.20/main nodejs~20; \
+    # Fix python3.12 failing with: ModuleNotFoundError: No module named 'distutils' on alpine:3.20
+    # apk add --no-cache py3-setuptools; \
+    # Fix errors about missing spdlog
+    # apk add --no-cache spdlog; \
+    # Install kerberos dependencies https://github.com/coder/code-server/issues/6535
+    apk add --no-cache krb5-dev; \
+    npm config set python python3; \
+    # Use 'NODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT' to fix node 18.20 and 20.12 making experimental API the default, which breaks builds
+    # Use '-U_FORTIFY_SOURCE' to fix vsnprintf errors in alpine: https://gitlab.alpinelinux.org/alpine/aports/-/issues/8626
+    # Use '-DUSE_IPO=OFF -DWHOLE_PROGRAM_OPTIMISATION=OFF' to fix lto-wrapper errors?
+    ( set +x; export GITHUB_TOKEN=$( cat /run/secrets/GITHUB_TOKEN ); set -x; CXXFLAGS='-DNODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT -U_FORTIFY_SOURCE' npm install --global code-server@4.95.3 --unsafe-perm ); \
+    # Fix missing dependencies. See: https://github.com/coder/code-server/issues/5530
+    ( cd /usr/local/lib/node_modules/code-server/lib/vscode; set +x; export GITHUB_TOKEN=$( cat /run/secrets/GITHUB_TOKEN ); set -x; CXXFLAGS='-DNODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT -U_FORTIFY_SOURCE' npm install --legacy-peer-deps ); \
+    code-server --version; \
+    apk del $DEPS
+
+# Install tools
+RUN set -eux; \
+    apk add --no-cache bash bash-completion ca-certificates curl gnupg git git-lfs github-cli iotop jq less lsblk make nano openssh-client openssl p7zip rsync tree yq
+
+# Install pwsh
+# See: https://learn.microsoft.com/en-us/powershell/scripting/install/install-alpine?view=powershell-7.3
+RUN set -eux; \
+    apk add --no-cache \
+    ca-certificates \
+    less \
+    ncurses-terminfo-base \
+    krb5-libs \
+    libgcc \
+    libintl \
+    libssl1.1 \
+    libstdc++ \
+    tzdata \
+    userspace-rcu \
+    zlib \
+    icu-libs \
+    curl
+RUN apk -X https://dl-cdn.alpinelinux.org/alpine/edge/main add --no-cache lttng-ust
+RUN set -eux; \
+    mkdir -p /opt/microsoft/powershell/7; \
+    curl -sSL https://github.com/PowerShell/PowerShell/releases/download/v7.2.8/powershell-7.2.8-linux-alpine-x64.tar.gz | tar -C /opt/microsoft/powershell/7 -zxf -; \
+    chmod +x /opt/microsoft/powershell/7/pwsh; \
+    ln -s /opt/microsoft/powershell/7/pwsh /usr/bin/pwsh
+# Disable telemetry for powershell 7.0.0 and above and .NET core: https://github.com/PowerShell/PowerShell/issues/16234#issuecomment-942139350
+ENV POWERSHELL_CLI_TELEMETRY_OPTOUT=1
+ENV POWERSHELL_TELEMETRY_OPTOUT=1
+ENV POWERSHELL_UPDATECHECK=Off
+ENV POWERSHELL_UPDATECHECK_OPTOUT=1
+ENV DOTNET_CLI_TELEMETRY_OPTOUT=1
+ENV DOTNET_TELEMETRY_OPTOUT=1
+ENV COMPlus_EnableDiagnostics=0
+RUN pwsh -version
+# Install pwsh module(s)
+RUN pwsh -c 'Install-Module Pester -Force -Scope AllUsers -MinimumVersion 4.0.0 -MaximumVersion 4.10.1 -ErrorAction Stop'
+
+RUN apk add --no-cache sudo
+RUN adduser -u 1000 --gecos '' -D user
+RUN echo 'user ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/user
+
+# Install common extensions
+USER user
+# beautify - code formatter
+RUN code-server --install-extension hookyqr.beautify@1.4.11
+# docker
+RUN code-server --install-extension ms-azuretools.vscode-docker@1.18.0
+# firefox
+RUN code-server --install-extension firefox-devtools.vscode-firefox-debug@2.9.1
+# git
+RUN code-server --install-extension donjayamanne.githistory@0.6.19
+RUN code-server --install-extension eamodio.gitlens@11.6.0
+# github. Install the latest compatible version
+RUN code-server --install-extension github.vscode-pull-request-github
+# gitlab
+RUN code-server --install-extension gitlab.gitlab-workflow@3.60.0
+# jinja
+RUN code-server --install-extension samuelcolvin.jinjahtml@0.16.0
+RUN code-server --install-extension wholroyd.jinja@0.0.8
+# kubernetes
+RUN code-server --install-extension ms-kubernetes-tools.vscode-kubernetes-tools@1.3.11
+# markdown
+RUN code-server --install-extension bierner.markdown-preview-github-styles@0.1.6
+RUN code-server --install-extension DavidAnson.vscode-markdownlint@0.43.2
+# prettier - code formatter
+RUN code-server --install-extension esbenp.prettier-vscode@9.0.0
+# pwsh
+RUN code-server --install-extension ms-vscode.powershell@2021.12.0
+# svg
+RUN code-server --install-extension jock.svg@1.4.17
+# terraform
+RUN code-server --install-extension hashicorp.terraform@2.14.0
+# toml
+RUN code-server --install-extension bungcip.better-toml@0.3.2
+# vscode
+RUN code-server --install-extension vscode-icons-team.vscode-icons@11.13.0
+# xml
+RUN code-server --install-extension redhat.vscode-xml@0.18.0
+# yaml
+RUN code-server --install-extension redhat.vscode-yaml@1.9.1
+
+# Install docker
+# See: https://github.com/moby/moby/blob/v20.10.22/project/PACKAGERS.md
+# Install docker-cli dependencies
+USER root
+RUN set -eux; \
+    apk add --no-cache \
+        ca-certificates \
+        git \
+        # Workaround for golang 1.15 not producing static binaries. See: https://github.com/containerd/containerd/issues/5824
+        libc6-compat \
+        openssh-client
+# Install dockerd dependencies
+RUN apk add --no-cache \
+        btrfs-progs \
+        e2fsprogs \
+        e2fsprogs-extra \
+        ip6tables \
+        iptables \
+        openssl \
+        pigz \
+        shadow-uidmap \
+        xfsprogs \
+        xz \
+        zfs
+# Add userns-remap support. See: https://docs.docker.com/engine/security/userns-remap/
+RUN set -eux; \
+    addgroup -S dockremap; \
+    adduser -S -G dockremap dockremap; \
+    echo 'dockremap:231072:65536' >> /etc/subuid; \
+    echo 'dockremap:231072:65536' >> /etc/subgid
+# Install docker
+RUN set -eux; \
+    case "$( uname -m )" in \
+        'x86_64') \
+            URL='https://download.docker.com/linux/static/stable/x86_64/docker-24.0.9.tgz'; \
+            ;; \
+        'armhf') \
+            URL='https://download.docker.com/linux/static/stable/armel/docker-24.0.9.tgz'; \
+            ;; \
+        'armv7') \
+            URL='https://download.docker.com/linux/static/stable/armhf/docker-24.0.9.tgz'; \
+            ;; \
+        'aarch64') \
+            URL='https://download.docker.com/linux/static/stable/aarch64/docker-24.0.9.tgz'; \
+            ;; \
+        # These architectures are no longer supported as of docker 20.10.x
+        # 'ppc64le') \
+        # 	URL='https://download.docker.com/linux/static/stable/ppc64le/docker-24.0.9.tgz'; \
+        # 	;; \
+        # 's390x') \
+        # 	URL='https://download.docker.com/linux/static/stable/s390x/docker-24.0.9.tgz'; \
+        # 	;; \
+        *) \
+            echo "Architecture not supported"; \
+            exit 1; \
+            ;; \
+    esac; \
+    wget -q "$URL" -O docker.tgz; \
+    tar -xvf docker.tgz --strip-components=1 --no-same-owner --no-same-permissions -C /usr/local/bin; \
+    ls -al /usr/local/bin; \
+    rm -v docker.tgz; \
+    containerd --version; \
+    ctr --version; \
+    docker --version; \
+    dockerd --version; \
+    runc --version
+# Install bash completion
+RUN wget -q https://raw.githubusercontent.com/docker/cli/master/contrib/completion/bash/docker -O /usr/share/bash-completion/completions/docker
+# Post-install docker. See: https://docs.docker.com/engine/install/linux-postinstall/
+RUN set -eux; \
+    addgroup docker; \
+    adduser user docker;
+VOLUME /var/lib/docker
+
+# Install rootless docker. See: https://docs.docker.com/engine/security/rootless/
+USER root
+RUN apk add --no-cache iproute2 fuse-overlayfs
+RUN set -eux; \
+    echo user:100000:65536 >> /etc/subuid; \
+    echo user:100000:65536 >> /etc/subgid
+RUN set -eux; \
+    case "$( uname -m )" in \
+        'x86_64') \
+            URL='https://download.docker.com/linux/static/stable/x86_64/docker-rootless-extras-24.0.9.tgz'; \
+            ;; \
+        'aarch64') \
+            URL='https://download.docker.com/linux/static/stable/aarch64/docker-rootless-extras-24.0.9.tgz'; \
+            ;; \
+        'armv7') \
+            URL='https://download.docker.com/linux/static/stable/armhf/docker-rootless-extras-24.0.9.tgz'; \
+            ;; \
+        'aarch64') \
+            URL='https://download.docker.com/linux/static/stable/aarch64/docker-rootless-extras-24.0.9.tgz'; \
+            ;; \
+        *) \
+            echo "Architecture not supported"; \
+            exit 1; \
+            ;; \
+    esac; \
+    wget -q "$URL" -O docker-rootless-extras.tgz; \
+    tar -xvf docker-rootless-extras.tgz --strip-components=1 --no-same-owner --no-same-permissions -C /usr/local/bin \
+        'docker-rootless-extras/rootlesskit' \
+        'docker-rootless-extras/rootlesskit-docker-proxy' \
+        'docker-rootless-extras/vpnkit' \
+    ; \
+    ls -al /usr/local/bin; \
+    rm -v docker-rootless-extras.tgz; \
+    rootlesskit --version; \
+    vpnkit --version
+# Create XDG_RUNTIME_DIR
+RUN set -eux; \
+    mkdir /run/user; \
+    chmod 1777 /run/user
+# Create /var/lib/docker
+RUN set -eux; \
+    mkdir -p /home/user/.local/share/docker; \
+    chown user:user /home/user/.local/share/docker
+VOLUME /home/user/.local/share/docker
+# Set env vars
+ENV XDG_RUNTIME_DIR=/run/user/1000
+ENV DOCKER_HOST=unix:///run/user/1000/docker.sock
+
+# Install docker-compose v1 (deprecated, but for backward compatibility)
+USER root
+RUN apk add --no-cache docker-compose
+
+# Install docker-compose
+RUN set -eux; \
+    DOCKER_COMPOSE_VERSION=v2.32.0; \
+    case "$( uname -m )" in \
+        'x86') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-x86_64"; \
+            SHA256=c204bc7058fb881b2a39175df5c3596f6b08ef9e358d7236df7cc781f74695bd; \
+            ;; \
+        'x86_64') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-x86_64"; \
+            SHA256=c204bc7058fb881b2a39175df5c3596f6b08ef9e358d7236df7cc781f74695bd; \
+            ;; \
+        'armhf') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-armv6"; \
+            SHA256=d72e2d4b8ab71fa4b0132b451f43267aaca980c4ee9cb670ae6f83fa101747e7; \
+            ;; \
+        'armv7l') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-armv7"; \
+            SHA256=9e6b63bd2b863c4564fa61c18f2515f0130a8800f12a35c2836fdd6a044ff222; \
+            ;; \
+        'aarch64') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-aarch64"; \
+            SHA256=0bb65b36b32750a876cfdd5720e811ba1b70cb9eca72536fdf4ac7949fbc20e1; \
+            ;; \
+        'ppc64le') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-ppc64le"; \
+            SHA256=5e05371a1b0f3bb4e9785aa9957c98bff625aab675a59e5ae6c75e7e7ec41027; \
+            ;; \
+        'riscv64') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-riscv64"; \
+            SHA256=726362c280a764de1249927857e51bb9f1321a0c4d5192dc0a5e2134ac29a999; \
+            ;; \
+        's390x') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-s390x"; \
+            SHA256=d9c117c743131c3addc933d71d6ee5cbf70951ce34c43b765a7d57c80ef58429; \
+            ;; \
+        *) \
+            echo "Architecture not supported"; \
+            exit 1; \
+            ;; \
+    esac; \
+    FILE=docker-compose; \
+    wget -q "$URL" -O "$FILE"; \
+    echo "$SHA256  $FILE" | sha256sum -c -; \
+    mkdir -pv /usr/libexec/docker/cli-plugins; \
+    mv -v docker-compose /usr/libexec/docker/cli-plugins/docker-compose; \
+    chmod +x /usr/libexec/docker/cli-plugins/docker-compose; \
+    docker compose version; \
+    :
+
+# Install docker-buildx
+RUN set -eux; \
+    DOCKER_BUILDX_VERSION=v0.12.1; \
+    case "$( uname -m )" in \
+        'x86_64') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-amd64"; \
+            SHA256=716321df8ca9c82ffe96f37e9f4aa1199d4969795836dbd57ef72d12e3ac5085; \
+            ;; \
+        'armhf') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-arm-v6"; \
+            SHA256=4b3c78b59c0383ab21327e2902af2ea317e3b85e442b1cd776f0c2a7bbbb2999; \
+            ;; \
+        'armv7l') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-arm-v7"; \
+            SHA256=fe0a9e7812051a72c47d009bf9373e76e23644cc3291c848ac4a9b6f237e9e75; \
+            ;; \
+        'aarch64') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-arm64"; \
+            SHA256=fb72d627f2ee080bba70375c367f4292867821e29ca9a8cf485622f6ede8f436; \
+            ;; \
+        'ppc64le') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-ppc64le"; \
+            SHA256=1c649498d727183d82fb243e08856533ea90e8d63bfcd6f8b23b264dbcf7ea7a; \
+            ;; \
+        'riscv64') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-riscv64"; \
+            SHA256=152e7b423c1ce888eb0a658321eb8c28cc1d09af01acd5c66eddf8474dddf55c; \
+            ;; \
+        's390x') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-s390x"; \
+            SHA256=acee98a9f0550bf2c6c1161cf8067c031ddf0c566c41de7db27847bb72e8ee0b; \
+            ;; \
+        *) \
+            echo "Architecture not supported"; \
+            exit 1; \
+            ;; \
+    esac; \
+    FILE=docker-buildx; \
+    wget -q "$URL" -O "$FILE"; \
+    echo "$SHA256  $FILE" | sha256sum -c -; \
+    mkdir -pv /usr/libexec/docker/cli-plugins; \
+    mv -v docker-buildx /usr/libexec/docker/cli-plugins/docker-buildx; \
+    chmod +x /usr/libexec/docker/cli-plugins/docker-buildx; \
+    docker buildx version; \
+    :
+
+# Install binary tool(s)
+RUN set -eux; \
+    wget https://github.com/GoogleContainerTools/container-diff/releases/download/v0.17.0/container-diff-linux-amd64 -O container-diff; \
+    sha256sum container-diff | grep '^818c219ce9f9670cd5c766b9da5036cf75bbf98bc99eb258f5e8f90e80367c88 '; \
+    mv container-diff /usr/local/bin/container-diff; \
+    chmod +x /usr/local/bin/container-diff; \
+    container-diff version
+
+# Add a default settings.json
+USER user
+COPY --chown=1000:1000 settings.json /home/user/.local/share/code-server/User/settings.json
+
+# Remove the default code-server config file created when extensions are installed
+USER user
+RUN rm -fv ~/.config/code-server/config.yaml
+
+# Symlink code to code-server
+USER root
+RUN ln -sfn /usr/local/bin/code-server /usr/local/bin/code
+
+USER root
+COPY docker-entrypoint.sh /docker-entrypoint.sh
+RUN chmod +x /docker-entrypoint.sh
+
+ENV LANG=en_US.UTF-8
+USER user
+WORKDIR /home/user
+ENTRYPOINT [ "/docker-entrypoint.sh" ]
+CMD [ "--bind-addr=0.0.0.0:8080", "--disable-telemetry", "--disable-update-check" ]
diff --git a/variants/4.95.3-docker-rootless/docker-entrypoint.sh b/variants/4.95.3-docker-rootless/docker-entrypoint.sh
new file mode 100644
index 0000000..e3f7fd0
--- /dev/null
+++ b/variants/4.95.3-docker-rootless/docker-entrypoint.sh
@@ -0,0 +1,27 @@
+#!/bin/sh
+set -eu
+
+# See: https://github.com/docker-library/official-images#consistency
+if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then
+    set -- code-server "$@"
+fi
+if [ "$1" = 'code-server' ]; then
+    # Start rootless docker
+    # See: https://github.com/moby/moby/blob/v20.10.22/contrib/dockerd-rootless.sh
+    # See: https://github.com/docker-library/docker/blob/master/20.10/dind/dockerd-entrypoint.sh
+    echo "Starting rootless dockerd"
+    rootlesskit \
+        --net="${DOCKERD_ROOTLESS_ROOTLESSKIT_NET:-vpnkit}" \
+        --mtu="${DOCKERD_ROOTLESS_ROOTLESSKIT_MTU:-1500}" \
+        --disable-host-loopback \
+        --port-driver="${DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER:-builtin}" \
+        --copy-up=/etc \
+        --copy-up=/run \
+        --propagation=rslave \
+        ${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} \
+        dockerd &
+
+    echo "Starting code-server"
+    exec code-server "$@"
+fi
+exec "$@"
diff --git a/variants/4.95.3-docker-rootless/settings.json b/variants/4.95.3-docker-rootless/settings.json
new file mode 100644
index 0000000..2c0c460
--- /dev/null
+++ b/variants/4.95.3-docker-rootless/settings.json
@@ -0,0 +1,24 @@
+{
+  "extensions.autoCheckUpdates": false,
+  "extensions.autoUpdate": false,
+  "extensions.ignoreRecommendations": true,
+  "extensions.showRecommendationsOnlyOnDemand": true,
+  "npm.fetchOnlinePackageInfo": false,
+  "telemetry.enableTelemetry": false,
+  "telemetry.telemetryLevel": "off",
+  "typescript.check.npmIsInstalled": false,
+  "typescript.disableAutomaticTypeAcquisition": false,
+  "typescript.surveys.enabled": false,
+  "workbench.enableExperiments": false,
+  "workbench.iconTheme": "vscode-icons",
+  "workbench.settings.enableNaturalLanguageSearch": false,
+  "workbench.startupEditor": "none",
+  "workbench.welcomePage.walkthroughs.openOnInstall": false,
+  "workbench.tips.enabled": false,
+
+  // Extension-specific
+  "gitlens.showWelcomeOnInstall": false,
+  "gitlens.showWhatsNewAfterUpgrades": false,
+  "redhat.telemetry.enabled": false,
+  "vsicons.dontShowNewVersionMessage": true,
+}
\ No newline at end of file
diff --git a/variants/4.95.3-docker/Dockerfile b/variants/4.95.3-docker/Dockerfile
new file mode 100644
index 0000000..5b16282
--- /dev/null
+++ b/variants/4.95.3-docker/Dockerfile
@@ -0,0 +1,329 @@
+# syntax=docker/dockerfile:1
+FROM alpine:3.17
+ARG TARGETPLATFORM
+ARG TARGETOS
+ARG TARGETARCH
+ARG TARGETVARIANT
+ARG BUILDPLATFORM
+ARG BUILDOS
+ARG BUILDARCH
+ARG BUILDVARIANT
+RUN set -eu; \
+    echo "TARGETPLATFORM=$TARGETPLATFORM"; \
+    echo "TARGETOS=$TARGETOS"; \
+    echo "TARGETARCH=$TARGETARCH"; \
+    echo "TARGETVARIANT=$TARGETVARIANT"; \
+    echo "BUILDPLATFORM=$BUILDPLATFORM"; \
+    echo "BUILDOS=$BUILDOS"; \
+    echo "BUILDARCH=$BUILDARCH"; \
+    echo "BUILDVARIANT=$BUILDVARIANT";
+
+RUN --mount=type=secret,id=GITHUB_TOKEN \
+    set -eux; \
+    DEPS='alpine-sdk bash libstdc++ libc6-compat python3'; \
+    apk add --no-cache $DEPS; \
+    # Constraint to npm 8, or else npm will fail with 'npm ERR! python is not a valid npm option'. See: https://stackoverflow.com/questions/74522956/python-is-not-a-valid-npm-option and https://jubianchi.github.io/semver-check/#/~8/8
+    apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/v3.15/main npm~8; \
+    apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/v3.20/main nodejs~20; \
+    # Fix python3.12 failing with: ModuleNotFoundError: No module named 'distutils' on alpine:3.20
+    # apk add --no-cache py3-setuptools; \
+    # Fix errors about missing spdlog
+    # apk add --no-cache spdlog; \
+    # Install kerberos dependencies https://github.com/coder/code-server/issues/6535
+    apk add --no-cache krb5-dev; \
+    npm config set python python3; \
+    # Use 'NODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT' to fix node 18.20 and 20.12 making experimental API the default, which breaks builds
+    # Use '-U_FORTIFY_SOURCE' to fix vsnprintf errors in alpine: https://gitlab.alpinelinux.org/alpine/aports/-/issues/8626
+    # Use '-DUSE_IPO=OFF -DWHOLE_PROGRAM_OPTIMISATION=OFF' to fix lto-wrapper errors?
+    ( set +x; export GITHUB_TOKEN=$( cat /run/secrets/GITHUB_TOKEN ); set -x; CXXFLAGS='-DNODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT -U_FORTIFY_SOURCE' npm install --global code-server@4.95.3 --unsafe-perm ); \
+    # Fix missing dependencies. See: https://github.com/coder/code-server/issues/5530
+    ( cd /usr/local/lib/node_modules/code-server/lib/vscode; set +x; export GITHUB_TOKEN=$( cat /run/secrets/GITHUB_TOKEN ); set -x; CXXFLAGS='-DNODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT -U_FORTIFY_SOURCE' npm install --legacy-peer-deps ); \
+    code-server --version; \
+    apk del $DEPS
+
+# Install tools
+RUN set -eux; \
+    apk add --no-cache bash bash-completion ca-certificates curl gnupg git git-lfs github-cli iotop jq less lsblk make nano openssh-client openssl p7zip rsync tree yq
+
+# Install pwsh
+# See: https://learn.microsoft.com/en-us/powershell/scripting/install/install-alpine?view=powershell-7.3
+RUN set -eux; \
+    apk add --no-cache \
+    ca-certificates \
+    less \
+    ncurses-terminfo-base \
+    krb5-libs \
+    libgcc \
+    libintl \
+    libssl1.1 \
+    libstdc++ \
+    tzdata \
+    userspace-rcu \
+    zlib \
+    icu-libs \
+    curl
+RUN apk -X https://dl-cdn.alpinelinux.org/alpine/edge/main add --no-cache lttng-ust
+RUN set -eux; \
+    mkdir -p /opt/microsoft/powershell/7; \
+    curl -sSL https://github.com/PowerShell/PowerShell/releases/download/v7.2.8/powershell-7.2.8-linux-alpine-x64.tar.gz | tar -C /opt/microsoft/powershell/7 -zxf -; \
+    chmod +x /opt/microsoft/powershell/7/pwsh; \
+    ln -s /opt/microsoft/powershell/7/pwsh /usr/bin/pwsh
+# Disable telemetry for powershell 7.0.0 and above and .NET core: https://github.com/PowerShell/PowerShell/issues/16234#issuecomment-942139350
+ENV POWERSHELL_CLI_TELEMETRY_OPTOUT=1
+ENV POWERSHELL_TELEMETRY_OPTOUT=1
+ENV POWERSHELL_UPDATECHECK=Off
+ENV POWERSHELL_UPDATECHECK_OPTOUT=1
+ENV DOTNET_CLI_TELEMETRY_OPTOUT=1
+ENV DOTNET_TELEMETRY_OPTOUT=1
+ENV COMPlus_EnableDiagnostics=0
+RUN pwsh -version
+# Install pwsh module(s)
+RUN pwsh -c 'Install-Module Pester -Force -Scope AllUsers -MinimumVersion 4.0.0 -MaximumVersion 4.10.1 -ErrorAction Stop'
+
+RUN apk add --no-cache sudo
+RUN adduser -u 1000 --gecos '' -D user
+RUN echo 'user ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/user
+
+# Install common extensions
+USER user
+# beautify - code formatter
+RUN code-server --install-extension hookyqr.beautify@1.4.11
+# docker
+RUN code-server --install-extension ms-azuretools.vscode-docker@1.18.0
+# firefox
+RUN code-server --install-extension firefox-devtools.vscode-firefox-debug@2.9.1
+# git
+RUN code-server --install-extension donjayamanne.githistory@0.6.19
+RUN code-server --install-extension eamodio.gitlens@11.6.0
+# github. Install the latest compatible version
+RUN code-server --install-extension github.vscode-pull-request-github
+# gitlab
+RUN code-server --install-extension gitlab.gitlab-workflow@3.60.0
+# jinja
+RUN code-server --install-extension samuelcolvin.jinjahtml@0.16.0
+RUN code-server --install-extension wholroyd.jinja@0.0.8
+# kubernetes
+RUN code-server --install-extension ms-kubernetes-tools.vscode-kubernetes-tools@1.3.11
+# markdown
+RUN code-server --install-extension bierner.markdown-preview-github-styles@0.1.6
+RUN code-server --install-extension DavidAnson.vscode-markdownlint@0.43.2
+# prettier - code formatter
+RUN code-server --install-extension esbenp.prettier-vscode@9.0.0
+# pwsh
+RUN code-server --install-extension ms-vscode.powershell@2021.12.0
+# svg
+RUN code-server --install-extension jock.svg@1.4.17
+# terraform
+RUN code-server --install-extension hashicorp.terraform@2.14.0
+# toml
+RUN code-server --install-extension bungcip.better-toml@0.3.2
+# vscode
+RUN code-server --install-extension vscode-icons-team.vscode-icons@11.13.0
+# xml
+RUN code-server --install-extension redhat.vscode-xml@0.18.0
+# yaml
+RUN code-server --install-extension redhat.vscode-yaml@1.9.1
+
+# Install docker
+# See: https://github.com/moby/moby/blob/v20.10.22/project/PACKAGERS.md
+# Install docker-cli dependencies
+USER root
+RUN set -eux; \
+    apk add --no-cache \
+        ca-certificates \
+        git \
+        # Workaround for golang 1.15 not producing static binaries. See: https://github.com/containerd/containerd/issues/5824
+        libc6-compat \
+        openssh-client
+# Install dockerd dependencies
+RUN apk add --no-cache \
+        btrfs-progs \
+        e2fsprogs \
+        e2fsprogs-extra \
+        ip6tables \
+        iptables \
+        openssl \
+        pigz \
+        shadow-uidmap \
+        xfsprogs \
+        xz \
+        zfs
+# Add userns-remap support. See: https://docs.docker.com/engine/security/userns-remap/
+RUN set -eux; \
+    addgroup -S dockremap; \
+    adduser -S -G dockremap dockremap; \
+    echo 'dockremap:231072:65536' >> /etc/subuid; \
+    echo 'dockremap:231072:65536' >> /etc/subgid
+# Install docker
+RUN set -eux; \
+    case "$( uname -m )" in \
+        'x86_64') \
+            URL='https://download.docker.com/linux/static/stable/x86_64/docker-24.0.9.tgz'; \
+            ;; \
+        'armhf') \
+            URL='https://download.docker.com/linux/static/stable/armel/docker-24.0.9.tgz'; \
+            ;; \
+        'armv7') \
+            URL='https://download.docker.com/linux/static/stable/armhf/docker-24.0.9.tgz'; \
+            ;; \
+        'aarch64') \
+            URL='https://download.docker.com/linux/static/stable/aarch64/docker-24.0.9.tgz'; \
+            ;; \
+        # These architectures are no longer supported as of docker 20.10.x
+        # 'ppc64le') \
+        # 	URL='https://download.docker.com/linux/static/stable/ppc64le/docker-24.0.9.tgz'; \
+        # 	;; \
+        # 's390x') \
+        # 	URL='https://download.docker.com/linux/static/stable/s390x/docker-24.0.9.tgz'; \
+        # 	;; \
+        *) \
+            echo "Architecture not supported"; \
+            exit 1; \
+            ;; \
+    esac; \
+    wget -q "$URL" -O docker.tgz; \
+    tar -xvf docker.tgz --strip-components=1 --no-same-owner --no-same-permissions -C /usr/local/bin; \
+    ls -al /usr/local/bin; \
+    rm -v docker.tgz; \
+    containerd --version; \
+    ctr --version; \
+    docker --version; \
+    dockerd --version; \
+    runc --version
+# Install bash completion
+RUN wget -q https://raw.githubusercontent.com/docker/cli/master/contrib/completion/bash/docker -O /usr/share/bash-completion/completions/docker
+# Post-install docker. See: https://docs.docker.com/engine/install/linux-postinstall/
+RUN set -eux; \
+    addgroup docker; \
+    adduser user docker;
+VOLUME /var/lib/docker
+
+# Install docker-compose v1 (deprecated, but for backward compatibility)
+USER root
+RUN apk add --no-cache docker-compose
+
+# Install docker-compose
+RUN set -eux; \
+    DOCKER_COMPOSE_VERSION=v2.32.0; \
+    case "$( uname -m )" in \
+        'x86') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-x86_64"; \
+            SHA256=c204bc7058fb881b2a39175df5c3596f6b08ef9e358d7236df7cc781f74695bd; \
+            ;; \
+        'x86_64') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-x86_64"; \
+            SHA256=c204bc7058fb881b2a39175df5c3596f6b08ef9e358d7236df7cc781f74695bd; \
+            ;; \
+        'armhf') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-armv6"; \
+            SHA256=d72e2d4b8ab71fa4b0132b451f43267aaca980c4ee9cb670ae6f83fa101747e7; \
+            ;; \
+        'armv7l') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-armv7"; \
+            SHA256=9e6b63bd2b863c4564fa61c18f2515f0130a8800f12a35c2836fdd6a044ff222; \
+            ;; \
+        'aarch64') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-aarch64"; \
+            SHA256=0bb65b36b32750a876cfdd5720e811ba1b70cb9eca72536fdf4ac7949fbc20e1; \
+            ;; \
+        'ppc64le') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-ppc64le"; \
+            SHA256=5e05371a1b0f3bb4e9785aa9957c98bff625aab675a59e5ae6c75e7e7ec41027; \
+            ;; \
+        'riscv64') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-riscv64"; \
+            SHA256=726362c280a764de1249927857e51bb9f1321a0c4d5192dc0a5e2134ac29a999; \
+            ;; \
+        's390x') \
+            URL="https://github.com/docker/compose/releases/download/v2.32.0/docker-compose-linux-s390x"; \
+            SHA256=d9c117c743131c3addc933d71d6ee5cbf70951ce34c43b765a7d57c80ef58429; \
+            ;; \
+        *) \
+            echo "Architecture not supported"; \
+            exit 1; \
+            ;; \
+    esac; \
+    FILE=docker-compose; \
+    wget -q "$URL" -O "$FILE"; \
+    echo "$SHA256  $FILE" | sha256sum -c -; \
+    mkdir -pv /usr/libexec/docker/cli-plugins; \
+    mv -v docker-compose /usr/libexec/docker/cli-plugins/docker-compose; \
+    chmod +x /usr/libexec/docker/cli-plugins/docker-compose; \
+    docker compose version; \
+    :
+
+# Install docker-buildx
+RUN set -eux; \
+    DOCKER_BUILDX_VERSION=v0.12.1; \
+    case "$( uname -m )" in \
+        'x86_64') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-amd64"; \
+            SHA256=716321df8ca9c82ffe96f37e9f4aa1199d4969795836dbd57ef72d12e3ac5085; \
+            ;; \
+        'armhf') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-arm-v6"; \
+            SHA256=4b3c78b59c0383ab21327e2902af2ea317e3b85e442b1cd776f0c2a7bbbb2999; \
+            ;; \
+        'armv7l') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-arm-v7"; \
+            SHA256=fe0a9e7812051a72c47d009bf9373e76e23644cc3291c848ac4a9b6f237e9e75; \
+            ;; \
+        'aarch64') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-arm64"; \
+            SHA256=fb72d627f2ee080bba70375c367f4292867821e29ca9a8cf485622f6ede8f436; \
+            ;; \
+        'ppc64le') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-ppc64le"; \
+            SHA256=1c649498d727183d82fb243e08856533ea90e8d63bfcd6f8b23b264dbcf7ea7a; \
+            ;; \
+        'riscv64') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-riscv64"; \
+            SHA256=152e7b423c1ce888eb0a658321eb8c28cc1d09af01acd5c66eddf8474dddf55c; \
+            ;; \
+        's390x') \
+            URL="https://github.com/docker/buildx/releases/download/v0.12.1/buildx-v0.12.1.linux-s390x"; \
+            SHA256=acee98a9f0550bf2c6c1161cf8067c031ddf0c566c41de7db27847bb72e8ee0b; \
+            ;; \
+        *) \
+            echo "Architecture not supported"; \
+            exit 1; \
+            ;; \
+    esac; \
+    FILE=docker-buildx; \
+    wget -q "$URL" -O "$FILE"; \
+    echo "$SHA256  $FILE" | sha256sum -c -; \
+    mkdir -pv /usr/libexec/docker/cli-plugins; \
+    mv -v docker-buildx /usr/libexec/docker/cli-plugins/docker-buildx; \
+    chmod +x /usr/libexec/docker/cli-plugins/docker-buildx; \
+    docker buildx version; \
+    :
+
+# Install binary tool(s)
+RUN set -eux; \
+    wget https://github.com/GoogleContainerTools/container-diff/releases/download/v0.17.0/container-diff-linux-amd64 -O container-diff; \
+    sha256sum container-diff | grep '^818c219ce9f9670cd5c766b9da5036cf75bbf98bc99eb258f5e8f90e80367c88 '; \
+    mv container-diff /usr/local/bin/container-diff; \
+    chmod +x /usr/local/bin/container-diff; \
+    container-diff version
+
+# Add a default settings.json
+USER user
+COPY --chown=1000:1000 settings.json /home/user/.local/share/code-server/User/settings.json
+
+# Remove the default code-server config file created when extensions are installed
+USER user
+RUN rm -fv ~/.config/code-server/config.yaml
+
+# Symlink code to code-server
+USER root
+RUN ln -sfn /usr/local/bin/code-server /usr/local/bin/code
+
+USER root
+COPY docker-entrypoint.sh /docker-entrypoint.sh
+RUN chmod +x /docker-entrypoint.sh
+
+ENV LANG=en_US.UTF-8
+USER user
+WORKDIR /home/user
+ENTRYPOINT [ "/docker-entrypoint.sh" ]
+CMD [ "--bind-addr=0.0.0.0:8080", "--disable-telemetry", "--disable-update-check" ]
diff --git a/variants/4.95.3-docker/docker-entrypoint.sh b/variants/4.95.3-docker/docker-entrypoint.sh
new file mode 100644
index 0000000..7e38790
--- /dev/null
+++ b/variants/4.95.3-docker/docker-entrypoint.sh
@@ -0,0 +1,16 @@
+#!/bin/sh
+set -eu
+
+# See: https://github.com/docker-library/official-images#consistency
+if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then
+    set -- code-server "$@"
+fi
+if [ "$1" = 'code-server' ]; then
+    echo "Starting dockerd"
+    sudo rm -fv /var/run/docker.pid
+    sudo dockerd &
+
+    echo "Starting code-server"
+    exec code-server "$@"
+fi
+exec "$@"
diff --git a/variants/4.95.3-docker/settings.json b/variants/4.95.3-docker/settings.json
new file mode 100644
index 0000000..2c0c460
--- /dev/null
+++ b/variants/4.95.3-docker/settings.json
@@ -0,0 +1,24 @@
+{
+  "extensions.autoCheckUpdates": false,
+  "extensions.autoUpdate": false,
+  "extensions.ignoreRecommendations": true,
+  "extensions.showRecommendationsOnlyOnDemand": true,
+  "npm.fetchOnlinePackageInfo": false,
+  "telemetry.enableTelemetry": false,
+  "telemetry.telemetryLevel": "off",
+  "typescript.check.npmIsInstalled": false,
+  "typescript.disableAutomaticTypeAcquisition": false,
+  "typescript.surveys.enabled": false,
+  "workbench.enableExperiments": false,
+  "workbench.iconTheme": "vscode-icons",
+  "workbench.settings.enableNaturalLanguageSearch": false,
+  "workbench.startupEditor": "none",
+  "workbench.welcomePage.walkthroughs.openOnInstall": false,
+  "workbench.tips.enabled": false,
+
+  // Extension-specific
+  "gitlens.showWelcomeOnInstall": false,
+  "gitlens.showWhatsNewAfterUpgrades": false,
+  "redhat.telemetry.enabled": false,
+  "vsicons.dontShowNewVersionMessage": true,
+}
\ No newline at end of file
diff --git a/variants/4.95.3/Dockerfile b/variants/4.95.3/Dockerfile
new file mode 100644
index 0000000..623ee6e
--- /dev/null
+++ b/variants/4.95.3/Dockerfile
@@ -0,0 +1,147 @@
+# syntax=docker/dockerfile:1
+FROM alpine:3.17
+ARG TARGETPLATFORM
+ARG TARGETOS
+ARG TARGETARCH
+ARG TARGETVARIANT
+ARG BUILDPLATFORM
+ARG BUILDOS
+ARG BUILDARCH
+ARG BUILDVARIANT
+RUN set -eu; \
+    echo "TARGETPLATFORM=$TARGETPLATFORM"; \
+    echo "TARGETOS=$TARGETOS"; \
+    echo "TARGETARCH=$TARGETARCH"; \
+    echo "TARGETVARIANT=$TARGETVARIANT"; \
+    echo "BUILDPLATFORM=$BUILDPLATFORM"; \
+    echo "BUILDOS=$BUILDOS"; \
+    echo "BUILDARCH=$BUILDARCH"; \
+    echo "BUILDVARIANT=$BUILDVARIANT";
+
+RUN --mount=type=secret,id=GITHUB_TOKEN \
+    set -eux; \
+    DEPS='alpine-sdk bash libstdc++ libc6-compat python3'; \
+    apk add --no-cache $DEPS; \
+    # Constraint to npm 8, or else npm will fail with 'npm ERR! python is not a valid npm option'. See: https://stackoverflow.com/questions/74522956/python-is-not-a-valid-npm-option and https://jubianchi.github.io/semver-check/#/~8/8
+    apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/v3.15/main npm~8; \
+    apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/v3.20/main nodejs~20; \
+    # Fix python3.12 failing with: ModuleNotFoundError: No module named 'distutils' on alpine:3.20
+    # apk add --no-cache py3-setuptools; \
+    # Fix errors about missing spdlog
+    # apk add --no-cache spdlog; \
+    # Install kerberos dependencies https://github.com/coder/code-server/issues/6535
+    apk add --no-cache krb5-dev; \
+    npm config set python python3; \
+    # Use 'NODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT' to fix node 18.20 and 20.12 making experimental API the default, which breaks builds
+    # Use '-U_FORTIFY_SOURCE' to fix vsnprintf errors in alpine: https://gitlab.alpinelinux.org/alpine/aports/-/issues/8626
+    # Use '-DUSE_IPO=OFF -DWHOLE_PROGRAM_OPTIMISATION=OFF' to fix lto-wrapper errors?
+    ( set +x; export GITHUB_TOKEN=$( cat /run/secrets/GITHUB_TOKEN ); set -x; CXXFLAGS='-DNODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT -U_FORTIFY_SOURCE' npm install --global code-server@4.95.3 --unsafe-perm ); \
+    # Fix missing dependencies. See: https://github.com/coder/code-server/issues/5530
+    ( cd /usr/local/lib/node_modules/code-server/lib/vscode; set +x; export GITHUB_TOKEN=$( cat /run/secrets/GITHUB_TOKEN ); set -x; CXXFLAGS='-DNODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT -U_FORTIFY_SOURCE' npm install --legacy-peer-deps ); \
+    code-server --version; \
+    apk del $DEPS
+
+# Install tools
+RUN set -eux; \
+    apk add --no-cache bash bash-completion ca-certificates curl gnupg git git-lfs github-cli iotop jq less lsblk make nano openssh-client openssl p7zip rsync tree yq
+
+# Install pwsh
+# See: https://learn.microsoft.com/en-us/powershell/scripting/install/install-alpine?view=powershell-7.3
+RUN set -eux; \
+    apk add --no-cache \
+    ca-certificates \
+    less \
+    ncurses-terminfo-base \
+    krb5-libs \
+    libgcc \
+    libintl \
+    libssl1.1 \
+    libstdc++ \
+    tzdata \
+    userspace-rcu \
+    zlib \
+    icu-libs \
+    curl
+RUN apk -X https://dl-cdn.alpinelinux.org/alpine/edge/main add --no-cache lttng-ust
+RUN set -eux; \
+    mkdir -p /opt/microsoft/powershell/7; \
+    curl -sSL https://github.com/PowerShell/PowerShell/releases/download/v7.2.8/powershell-7.2.8-linux-alpine-x64.tar.gz | tar -C /opt/microsoft/powershell/7 -zxf -; \
+    chmod +x /opt/microsoft/powershell/7/pwsh; \
+    ln -s /opt/microsoft/powershell/7/pwsh /usr/bin/pwsh
+# Disable telemetry for powershell 7.0.0 and above and .NET core: https://github.com/PowerShell/PowerShell/issues/16234#issuecomment-942139350
+ENV POWERSHELL_CLI_TELEMETRY_OPTOUT=1
+ENV POWERSHELL_TELEMETRY_OPTOUT=1
+ENV POWERSHELL_UPDATECHECK=Off
+ENV POWERSHELL_UPDATECHECK_OPTOUT=1
+ENV DOTNET_CLI_TELEMETRY_OPTOUT=1
+ENV DOTNET_TELEMETRY_OPTOUT=1
+ENV COMPlus_EnableDiagnostics=0
+RUN pwsh -version
+# Install pwsh module(s)
+RUN pwsh -c 'Install-Module Pester -Force -Scope AllUsers -MinimumVersion 4.0.0 -MaximumVersion 4.10.1 -ErrorAction Stop'
+
+RUN apk add --no-cache sudo
+RUN adduser -u 1000 --gecos '' -D user
+RUN echo 'user ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/user
+
+# Install common extensions
+USER user
+# beautify - code formatter
+RUN code-server --install-extension hookyqr.beautify@1.4.11
+# docker
+RUN code-server --install-extension ms-azuretools.vscode-docker@1.18.0
+# firefox
+RUN code-server --install-extension firefox-devtools.vscode-firefox-debug@2.9.1
+# git
+RUN code-server --install-extension donjayamanne.githistory@0.6.19
+RUN code-server --install-extension eamodio.gitlens@11.6.0
+# github. Install the latest compatible version
+RUN code-server --install-extension github.vscode-pull-request-github
+# gitlab
+RUN code-server --install-extension gitlab.gitlab-workflow@3.60.0
+# jinja
+RUN code-server --install-extension samuelcolvin.jinjahtml@0.16.0
+RUN code-server --install-extension wholroyd.jinja@0.0.8
+# kubernetes
+RUN code-server --install-extension ms-kubernetes-tools.vscode-kubernetes-tools@1.3.11
+# markdown
+RUN code-server --install-extension bierner.markdown-preview-github-styles@0.1.6
+RUN code-server --install-extension DavidAnson.vscode-markdownlint@0.43.2
+# prettier - code formatter
+RUN code-server --install-extension esbenp.prettier-vscode@9.0.0
+# pwsh
+RUN code-server --install-extension ms-vscode.powershell@2021.12.0
+# svg
+RUN code-server --install-extension jock.svg@1.4.17
+# terraform
+RUN code-server --install-extension hashicorp.terraform@2.14.0
+# toml
+RUN code-server --install-extension bungcip.better-toml@0.3.2
+# vscode
+RUN code-server --install-extension vscode-icons-team.vscode-icons@11.13.0
+# xml
+RUN code-server --install-extension redhat.vscode-xml@0.18.0
+# yaml
+RUN code-server --install-extension redhat.vscode-yaml@1.9.1
+
+# Add a default settings.json
+USER user
+COPY --chown=1000:1000 settings.json /home/user/.local/share/code-server/User/settings.json
+
+# Remove the default code-server config file created when extensions are installed
+USER user
+RUN rm -fv ~/.config/code-server/config.yaml
+
+# Symlink code to code-server
+USER root
+RUN ln -sfn /usr/local/bin/code-server /usr/local/bin/code
+
+USER root
+COPY docker-entrypoint.sh /docker-entrypoint.sh
+RUN chmod +x /docker-entrypoint.sh
+
+ENV LANG=en_US.UTF-8
+USER user
+WORKDIR /home/user
+ENTRYPOINT [ "/docker-entrypoint.sh" ]
+CMD [ "--bind-addr=0.0.0.0:8080", "--disable-telemetry", "--disable-update-check" ]
diff --git a/variants/4.95.3/docker-entrypoint.sh b/variants/4.95.3/docker-entrypoint.sh
new file mode 100644
index 0000000..506f356
--- /dev/null
+++ b/variants/4.95.3/docker-entrypoint.sh
@@ -0,0 +1,13 @@
+#!/bin/sh
+set -eu
+
+# See: https://github.com/docker-library/official-images#consistency
+if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then
+    set -- code-server "$@"
+fi
+if [ "$1" = 'code-server' ]; then
+
+    echo "Starting code-server"
+    exec code-server "$@"
+fi
+exec "$@"
diff --git a/variants/4.95.3/settings.json b/variants/4.95.3/settings.json
new file mode 100644
index 0000000..2c0c460
--- /dev/null
+++ b/variants/4.95.3/settings.json
@@ -0,0 +1,24 @@
+{
+  "extensions.autoCheckUpdates": false,
+  "extensions.autoUpdate": false,
+  "extensions.ignoreRecommendations": true,
+  "extensions.showRecommendationsOnlyOnDemand": true,
+  "npm.fetchOnlinePackageInfo": false,
+  "telemetry.enableTelemetry": false,
+  "telemetry.telemetryLevel": "off",
+  "typescript.check.npmIsInstalled": false,
+  "typescript.disableAutomaticTypeAcquisition": false,
+  "typescript.surveys.enabled": false,
+  "workbench.enableExperiments": false,
+  "workbench.iconTheme": "vscode-icons",
+  "workbench.settings.enableNaturalLanguageSearch": false,
+  "workbench.startupEditor": "none",
+  "workbench.welcomePage.walkthroughs.openOnInstall": false,
+  "workbench.tips.enabled": false,
+
+  // Extension-specific
+  "gitlens.showWelcomeOnInstall": false,
+  "gitlens.showWhatsNewAfterUpgrades": false,
+  "redhat.telemetry.enabled": false,
+  "vsicons.dontShowNewVersionMessage": true,
+}
\ No newline at end of file