diff --git a/.gitignore b/.gitignore
index 86f8aff..972c33b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,5 +16,6 @@ kata-static-*.tar.zst
 /demo/kilocode/kilo
 /demo/netdebug/netdebug
 /demo/opencode/opencode
+/demo/goose/goose
 .bunkerbox/
 demo/crush/crush
diff --git a/demo/goose/run-demo.sh b/demo/goose/run-demo.sh
new file mode 100755
index 0000000..3a13798
--- /dev/null
+++ b/demo/goose/run-demo.sh
@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd -- "${SCRIPT_DIR}/../.." && pwd)"
+
+if [ -n "${PROD:-}" ]; then
+    BUILD_PROFILE="release"
+    MAKE_TARGET="release"
+else
+    BUILD_PROFILE="debug"
+    MAKE_TARGET="dev"
+fi
+
+SHARE_DIR="${SCRIPT_DIR}/share"
+OCI_DIR="${SHARE_DIR}/oci"
+KATA_DIR="${SHARE_DIR}/kata"
+OCI_FILE="${OCI_DIR}/bunkerbox-goose-1.45.0.oci"
+RUNTIME_CONF="${SHARE_DIR}/goose.conf"
+BUNKERBOX="${PROJECT_ROOT}/target/${BUILD_PROFILE}/bunkerbox"
+BUNKERBOX_IMAGE="${PROJECT_ROOT}/target/${BUILD_PROFILE}/bunkerbox-image"
+GOOSE_LINK="${SCRIPT_DIR}/goose"
+KATA_VERSION="${KATA_VERSION:-3.32.0}"
+KATA_TARBALL_NAME="kata-static-${KATA_VERSION}-amd64.tar.zst"
+KATA_TARBALL="${SCRIPT_DIR}/${KATA_TARBALL_NAME}"
+KATA_SHARE_TARBALL="${SHARE_DIR}/${KATA_TARBALL_NAME}"
+KATA_URL="https://github.com/kata-containers/kata-containers/releases/download/${KATA_VERSION}/${KATA_TARBALL_NAME}"
+KATA_ARCHIVE_PREFIX="/$(printf '%s/%s' opt kata)"
+KATA_ARCHIVE_PATH=".${KATA_ARCHIVE_PREFIX}"
+
+rm -f "$GOOSE_LINK"
+rm -rf "$OCI_DIR" "$KATA_DIR"
+mkdir -p "$OCI_DIR" "$KATA_DIR"
+
+make -C "$PROJECT_ROOT" "${MAKE_TARGET}"
+
+if [ ! -x "${KATA_DIR}/bin/containerd-shim-kata-v2" ]; then
+  if [ ! -f "$KATA_TARBALL" ]; then
+    echo "Downloading Kata ${KATA_VERSION}..."
+    curl -fL "$KATA_URL" -o "$KATA_TARBALL"
+  fi
+
+  cp "$KATA_TARBALL" "$KATA_SHARE_TARBALL"
+
+  echo "Installing Kata ${KATA_VERSION} to ${KATA_DIR}"
+  rm -rf "$KATA_DIR"
+  mkdir -p "$KATA_DIR"
+  tar --use-compress-program=unzstd -xf "$KATA_SHARE_TARBALL" -C "$KATA_DIR" --strip-components=3 "$KATA_ARCHIVE_PATH"
+  rm -f "$KATA_SHARE_TARBALL"
+fi
+
+if grep -Rqs "$KATA_ARCHIVE_PREFIX" "$KATA_DIR"; then
+  echo "Updating Kata config paths for ${KATA_DIR}"
+  grep -RIl "$KATA_ARCHIVE_PREFIX" "$KATA_DIR" \
+    | xargs -r sed -i "s#${KATA_ARCHIVE_PREFIX}#${KATA_DIR}#g"
+fi
+
+QEMU_BIOS="${KATA_DIR}/share/kata-qemu/qemu/bios-256k.bin"
+if [ -f "$QEMU_BIOS" ]; then
+  sed -i "s#^firmware = \"\"#firmware = \"${QEMU_BIOS}\"#" \
+    "${KATA_DIR}/share/defaults/kata-containers/configuration.toml" \
+    "${KATA_DIR}/share/defaults/kata-containers/configuration-qemu.toml"
+fi
+
+QEMU_BIN="${KATA_DIR}/bin/qemu-system-x86_64"
+QEMU_REAL="${KATA_DIR}/bin/qemu-system-x86_64.real"
+QEMU_DATA_DIR="${KATA_DIR}/share/kata-qemu/qemu"
+if [ -x "$QEMU_BIN" ] && [ ! -x "$QEMU_REAL" ]; then
+  mv "$QEMU_BIN" "$QEMU_REAL"
+  cat > "$QEMU_BIN" <<EOF_QEMU
+#!/usr/bin/env sh
+exec "$QEMU_REAL" -L "$QEMU_DATA_DIR" "\$@"
+EOF_QEMU
+  chmod 0755 "$QEMU_BIN"
+fi
+
+BUNKERBOX_KATA_DIR="$KATA_DIR" "$BUNKERBOX" --share "$SHARE_DIR" setup
+
+"$BUNKERBOX_IMAGE" "$PROJECT_ROOT/images/goose.conf" --output "$OCI_FILE"
+
+cp "${OCI_DIR}/goose.conf" "$RUNTIME_CONF"
+
+ln -sfn "$BUNKERBOX" "$GOOSE_LINK"
+
+cat <<EOF_DONE
+Demo ready.
+To rebuild with the production (release) version: PROD=1 ./run-demo.sh
+
+Now run:
+  cd ${SCRIPT_DIR}
+  ./goose --share ./share
+EOF_DONE
diff --git a/images/README.md b/images/README.md
index aa20385..978d3a7 100644
--- a/images/README.md
+++ b/images/README.md
@@ -37,3 +37,4 @@ make install-image OCI=path/to/image.oci
 | `opencode.conf` | [OpenCode](https://github.com/anomalyco/opencode) | `bunkerbox-opencode-1.17.18.oci` |
 | `kilocode.conf` | [KiloCode](https://github.com/Kilo-Org/kilocode) | `bunkerbox-kilocode-7.4.11.oci` |
 | `crush.conf` | [Crush](https://github.com/charmbracelet/crush) | `bunkerbox-crush-0.84.1.oci` |
+| `goose.conf` | [Goose](https://github.com/aaif-goose/goose) | `bunkerbox-goose-1.45.0.oci` |
diff --git a/images/goose.conf b/images/goose.conf
new file mode 100644
index 0000000..13896e4
--- /dev/null
+++ b/images/goose.conf
@@ -0,0 +1,87 @@
+name: goose
+image: localhost/bunkerbox-goose:1.45.0
+output: bunkerbox-goose-1.45.0.oci
+overwrite: true
+command:
+  - goose
+
+build_args:
+  GOOSE_VERSION: "1.45.0"
+
+hooks:
+  # runs before persistent home is loaded
+  before-home-load: |
+    bunkerbox-status status set 'Loading persistent home...'
+
+  # runs before app starts
+  before-app: |
+    bunkerbox-status status set 'Launching goose...'
+    bunkerbox-status popup hide --on-find-ascii
+
+  # runs after app exits
+  after-app: |
+    bunkerbox-status status set '' 'Exiting goose...'
+
+  # runs only when app exits non-zero
+  app-error: |
+    bunkerbox-status popup info 'Error' 'goose exited abnormally'
+
+  # runs after persistent home is saved
+  after-home-save: |
+    bunkerbox-status status set '' 'Saving home...'
+
+containerfile: |
+  FROM docker.io/library/alpine:3.22
+
+  ARG GOOSE_VERSION
+
+  RUN apk add --no-cache \
+        bash \
+        bzip2 \
+        ca-certificates \
+        curl \
+        git \
+        libstdc++ \
+        musl-locales \
+        ncurses-terminfo-base \
+        openssh-client \
+        ripgrep \
+      && curl -fsSL \
+        "https://github.com/aaif-goose/goose/releases/download/v${GOOSE_VERSION}/goose-x86_64-unknown-linux-musl.tar.bz2" \
+        -o /tmp/goose.tar.bz2 \
+      && mkdir /tmp/goose \
+      && tar -xjf /tmp/goose.tar.bz2 -C /tmp/goose \
+      && install -m 0755 /tmp/goose/goose /usr/local/bin/goose \
+      && rm -rf /tmp/goose /tmp/goose.tar.bz2 \
+      && goose --version
+
+  ENV LANG=C.UTF-8
+
+  RUN mkdir -p /workspace /home/bunkerbox /usr/local/bunkerbox/bin \
+      && chmod 0777 /workspace /home/bunkerbox /usr/local/bunkerbox/bin
+
+  COPY bunker-entrypoint /usr/local/bin/bunker-entrypoint
+  RUN chmod 0755 /usr/local/bin/bunker-entrypoint
+
+  COPY bunkerbox-vscomm /usr/local/bunkerbox/bin/bunkerbox-vscomm
+  COPY bunkerbox-status /usr/local/bunkerbox/bin/bunkerbox-status
+
+  ENV HOME=/home/bunkerbox \
+      XDG_CONFIG_HOME=/home/bunkerbox/.config \
+      XDG_DATA_HOME=/home/bunkerbox/.local/share \
+      XDG_STATE_HOME=/home/bunkerbox/.local/state \
+      XDG_CACHE_HOME=/home/bunkerbox/.cache
+
+  WORKDIR /workspace
+  ENTRYPOINT ["/usr/local/bin/bunker-entrypoint"]
+
+runtime:
+  workspace: cow
+  home: persist
+  session_mb: 50
+  network: bridge
+  allow:
+    - api.openai.com
+    - api.deepseek.com
+  encrypt:
+    - ".config/goose/secrets.yaml"