docs: mention container images

README.md

@@ -25,6 +25,13 @@ You can see planned work on the [roadmap](https://github.com/orgs/hackfixme/proj
 
 The easiest way to install Disco is by downloading one of the pre-built packages from the latest release on the [releases page](https://github.com/hackfixme/disco/releases). Unpack the `disco` binary and place it somewhere on your `$PATH`.
 
+Container images are also available on [Docker Hub](https://hub.docker.com/r/hackfixme/disco). Stable releases are published with version tags, e.g. `0.1.0`, and are also tagged with `latest`. Unstable releases track the `main` branch and are tagged with `main`.
+
+To pull and run the latest stable release:
+```sh
+docker run --rm -it hackfixme/disco --version
+```
+
 Alternatively, you can build a binary for your system.
 
 First, ensure [Git](https://github.com/git-guides/install-git) and [Go](https://golang.org/doc/install) are installed. Go must be version 1.22 and later.

docs/get_started.md

@@ -1,4 +1,4 @@
-# Getting Started Guide
+# Getting started
 
 After you've [installed Disco](/README.md#installation), confirm the version you installed by running:
 
@@ -48,8 +48,8 @@ Most Disco commands require the encryption key to read and write data. You can p
 > Be aware that on Linux the CLI arguments and process environment can be read by any
 > other process run by the same user via the `/proc` filesystem, which means another
 > process could read the Disco encryption key. If this is a concern for your use
-> case, consider running Disco from a container instead (an official OCI image will
-> be provided soon), or another isolation mechanism.
+> case, consider [running Disco inside a container instead](https://hub.docker.com/r/hackfixme/disco),
+> or using another isolation mechanism (e.g. a virtual machine).
 >
 > Also, be careful with your shell history. Depending on your shell configuration,
 > the Disco encryption key could be stored in your shell history. If using the