docs: add Dev Container Template references to all image READMEs

README.md

@@ -43,7 +43,7 @@ See the individual image directories for more details on each image, including a
 
 ### Using a Dev Container Template (Recommended)
 
-The quickest way to get started is to use one of the pre-built templates from the [bare-devcontainer/templates](https://github.com/bare-devcontainer/templates) repository. These templates provide ready-to-use Dev Container configurations for available images.
+The quickest way to get started is to use one of the pre-built templates from the [bare-devcontainer/templates](https://github.com/bare-devcontainer/templates) repository. Each image in this repository has a corresponding template that provides the recommended Dev Container configuration out of the box, including security hardening (dropping all Linux capabilities, `no-new-privileges`, running as a non-root user) and volume mounts that persist language and package manager cache directories for faster rebuilds.
 
 ### Using Directly in devcontainer.json
 

bun/README.md

@@ -13,6 +13,13 @@ verified against Bun's release signing key before installation.
 ghcr.io/bare-devcontainer/bun:<tag>
 ```
 
+## Dev Container Template
+
+A ready-to-use Dev Container template for this image is available at
+[bare-devcontainer/templates](https://github.com/bare-devcontainer/templates/tree/main/src/bun).
+It provides the recommended configuration for this image, including security hardening and
+volume mounts that persist cache directories for faster rebuilds.
+
 ## Tags
 
 <!-- tags:begin -->

debian/README.md

@@ -8,6 +8,12 @@ Minimal Debian base image for dev containers. All other images in this repositor
 ghcr.io/bare-devcontainer/debian:<tag>
 ```
 
+## Dev Container Template
+
+A ready-to-use Dev Container template for this image is available at
+[bare-devcontainer/templates](https://github.com/bare-devcontainer/templates/tree/main/src/debian).
+It provides the recommended configuration for this image, including security hardening.
+
 ## Tags
 
 <!-- tags:begin -->

golang/README.md

@@ -10,6 +10,13 @@ The Go toolchain is downloaded directly from [go.dev](https://go.dev/dl/) and ve
 ghcr.io/bare-devcontainer/golang:<tag>
 ```
 
+## Dev Container Template
+
+A ready-to-use Dev Container template for this image is available at
+[bare-devcontainer/templates](https://github.com/bare-devcontainer/templates/tree/main/src/golang).
+It provides the recommended configuration for this image, including security hardening and
+volume mounts that persist cache directories for faster rebuilds.
+
 ## Tags
 
 <!-- tags:begin -->

mise/README.md

@@ -12,6 +12,13 @@ The mise binary is downloaded from GitHub Releases and verified with a minisign
 ghcr.io/bare-devcontainer/mise:<tag>
 ```
 
+## Dev Container Template
+
+A ready-to-use Dev Container template for this image is available at
+[bare-devcontainer/templates](https://github.com/bare-devcontainer/templates/tree/main/src/mise).
+It provides the recommended configuration for this image, including security hardening and
+volume mounts that persist cache directories for faster rebuilds.
+
 ## Tags
 
 <!-- tags:begin -->

node/README.md

@@ -10,6 +10,12 @@ The Node.js binary is downloaded from nodejs.org and verified against a GPG sign
 ghcr.io/bare-devcontainer/node:<tag>
 ```
 
+## Dev Container Template
+
+A ready-to-use Dev Container template for this image is available at
+[bare-devcontainer/templates](https://github.com/bare-devcontainer/templates/tree/main/src/node).
+It provides the recommended configuration for this image, including security hardening.
+
 ## Tags
 
 <!-- tags:begin -->

rust/README.md

@@ -10,6 +10,13 @@ Dev container image with Rust installed via `rustup`, built on the [debian](../d
 ghcr.io/bare-devcontainer/rust:<tag>
 ```
 
+## Dev Container Template
+
+A ready-to-use Dev Container template for this image is available at
+[bare-devcontainer/templates](https://github.com/bare-devcontainer/templates/tree/main/src/rust).
+It provides the recommended configuration for this image, including security hardening and
+volume mounts that persist cache directories for faster rebuilds.
+
 ## Tags
 
 <!-- tags:begin -->

terraform/README.md

@@ -15,6 +15,13 @@ key before installation.
 ghcr.io/bare-devcontainer/terraform:<tag>
 ```
 
+## Dev Container Template
+
+A ready-to-use Dev Container template for this image is available at
+[bare-devcontainer/templates](https://github.com/bare-devcontainer/templates/tree/main/src/terraform).
+It provides the recommended configuration for this image, including security hardening and
+volume mounts that persist cache directories for faster rebuilds.
+
 ## Tags
 
 <!-- tags:begin -->

uv/README.md

@@ -15,6 +15,13 @@ attestation bundle is fetched from GitHub's public REST API).
 ghcr.io/bare-devcontainer/uv:<tag>
 ```
 
+## Dev Container Template
+
+A ready-to-use Dev Container template for this image is available at
+[bare-devcontainer/templates](https://github.com/bare-devcontainer/templates/tree/main/src/uv).
+It provides the recommended configuration for this image, including security hardening and
+volume mounts that persist cache directories for faster rebuilds.
+
 ## Tags
 
 <!-- tags:begin -->

zig/README.md

@@ -10,6 +10,13 @@ The Zig binary is downloaded from ziglang.org and verified with a minisign signa
 ghcr.io/bare-devcontainer/zig:<tag>
 ```
 
+## Dev Container Template
+
+A ready-to-use Dev Container template for this image is available at
+[bare-devcontainer/templates](https://github.com/bare-devcontainer/templates/tree/main/src/zig).
+It provides the recommended configuration for this image, including security hardening and
+volume mounts that persist cache directories for faster rebuilds.
+
 ## Tags
 
 <!-- tags:begin -->