hungnt612/devops-toolkit repository overview

⁠DevOps-Tools (All-In-One)

A single "Swiss-army-knife" container image that bundles the tools you reach for every day when working with Kubernetes, GitOps, Infrastructure-as-Code, cloud providers, supply-chain security and AI coding assistants — plus Docker-in-Docker so you can build and run containers from inside it.

The image is based on docker:24.0.2-dind-rootless⁠ (Alpine Linux) and published to Docker Hub as hungnt612/devops-toolkit⁠.

docker pull hungnt612/devops-toolkit:latest
docker run --rm -it hungnt612/devops-toolkit:latest

⁠What's inside

⁠Kubernetes

⁠Infrastructure-as-Code & Secrets

⁠Security & supply chain

⁠Cloud

⁠Git platforms

⁠Databases

⁠AI coding CLIs

⁠Documents & images

For reading and processing common file formats without extra setup:

• PDF: pdftotext, pdfinfo, pdftoppm (poppler-utils) and the pypdf Python library.
• Word / Excel: python-docx (.docx), openpyxl (.xlsx) and pandas for tabular data.
• Images: ImageMagick (convert, identify, mogrify) and the Pillow Python library.

⁠Misc

git, go, node/npm, python3 (+ msal, python-sonarqube-api, pypdf, python-docx, openpyxl, pandas, Pillow), jq, yq, openssl, nano (with a tuned .nanorc), vim, htop, lynx, curl, wget, and handy bash aliases/completions.

⁠Build

cd DevOps-Tools
docker build -t devops-tools:latest .

⁠Run

# Interactive shell (shows a version banner on start)
docker run --rm -it devops-tools:latest

# Mount your kube/aws/ssh config from the host
docker run --rm -it \
  -v "$HOME/.kube:/home/rootless/.kube" \
  -v "$HOME/.aws:/root/.aws" \
  devops-tools:latest

# Use it as a one-off CLI (banner goes to stderr, so stdout stays clean)
docker run --rm devops-tools:latest kubectl version --client

Environment toggles:

⁠Create a local Kubernetes cluster

The image ships a helper to spin up a kind⁠ cluster with an NGINX ingress controller:

# Inside the container
./create_cluster.sh my-cluster

config.yml configures the kind cluster (control-plane + worker, ports 80/443 exposed for ingress). config is an empty kubeconfig template.

⁠Tool versions (pinned)

Versions are pinned via ENV in the Dockerfile:

kubectl, kubecolor, stern, skaffold, az, semgrep and the AI CLIs (claude, codex, gemini) track their latest release at build time. Pin the AI CLIs with the CLAUDE_CODE_VERSION, CODEX_VERSION and GEMINI_CLI_VERSION build args if you need reproducible builds.

⁠Versioning

The image is tagged on Docker Hub as follows:

OS-CVE fixes land through a normal rebuild (the daily scan opens a PR — see below), so they ship as a new latest / main-<sha> rather than a separate tag.

Recommended flow — SemVer via git tags:

# Cut a release whenever the bundled tool set changes
git tag v1.2.0
git push origin v1.2.0      # CI builds & publishes v1.2.0, v1.2 and latest

• Use latest for convenience / dev.
• Pin to vX.Y.Z in anything that must be reproducible (CI runners, docs).
• Bump the version when any tool is added, removed, or version-changed. Treat a tool-version change as a minor bump and a breaking base/behaviour change as a major bump.

⁠CI/CD

Two GitHub Actions workflows live in .github/workflows/:

devops-tools.yml — runs on PRs, pushes to main, git tags, and manual dispatch:

1. lint — hadolint on the Dockerfile + shellcheck on the scripts.
2. build — build the image (Buildx + GHA cache).
3. smoke test — run devops-tools-versions inside the image and fail if any tool is MISSING, plus explicit kubectl / terraform checks.
4. scan — Trivy for CRITICAL/HIGH (reporting by default; set the step's exit-code to 1 for a hard gate) and a CycloneDX SBOM artifact.
5. publish — push to hungnt612/devops-toolkit with the tags above, then sync an enriched overview to the Docker Hub repository page so it is always up to date. The overview is this README plus, for the release being published, its release notes (auto-generated from commits/PRs on a git tag, or the recent commit log on main) and a Trivy security-scan summary (fixable CRITICAL/HIGH/MEDIUM counts, with a pointer to the full report in the GitHub Security tab).

devops-tools-autopatch.yml — runs daily (and on demand), against the published image rather than a fresh build:

1. Full scan (OS + libraries) with Trivy, uploaded as SARIF to the GitHub Security tab for tracking over time, plus a console summary.
2. Auto-fix via PR — when fixable OS-package CVEs are found, it bumps SECURITY_REFRESH in the Dockerfile and opens a PR to main (security/cve-autofix) listing the CVEs. Merging it triggers the main CI/CD workflow, which rebuilds with a fresh apk upgrade and publishes a patched image.

Requirements for the auto-fix PR:

• Repo setting Settings → Actions → General → "Allow GitHub Actions to create and approve pull requests" must be enabled.
• The PR's own build CI runs automatically only if a GH_PAT secret (a PAT with repo/workflow scope) is set; with the default token the PR is created but you merge it to trigger the publish rebuild.

⁠Required repository secret

⁠📦 Latest release — latest (main-7350a49)

Published 2026-10-14 09:14 UTC

⁠🔒 Security scan (Trivy — fixable OS + library CVEs)

Scanned 2026-10-14 09:14 UTC