n8500x/devops-sak repository overview

⁠DevOps Swiss Army Knife (devops-sak)

A single, feature-rich container image bundling a curated set of CLI tools that platform and DevOps engineers reach for every day — Kubernetes, cloud, IaC, secrets, build toolchains, and networking utilities — plus an interactive launcher dashboard.

⁠Overview

devops-sak is a "grab one image and you have everything" toolbox built on Red Hat UBI10 Minimal. Run it interactively to get a menu-driven dashboard of the installed tools, drop into a shell, or invoke any bundled tool directly as a one-off command. Every tool is installed from pinned versions for reproducibility. This is intentionally a large, kitchen-sink image — not a slim single-purpose one.

⁠Quick start

docker pull n8500x/devops-sak

Interactive dashboard (default when run with a TTY and no command):

docker run -it n8500x/devops-sak

Straight to a shell:

docker run -it n8500x/devops-sak bash

Run any tool as a one-off command (bypasses the dashboard):

docker run --rm n8500x/devops-sak kubectl version --client

Mount your AWS credentials read-only:

docker run -it -v ~/.aws:/root/.aws:ro n8500x/devops-sak bash

The dashboard lists every installed tool with its detected version and lets you launch interactive tools (bash, python3, node, k9s, claude, opencode, vi), view CLI tool version/help, open a shell (s), run the certificate manager (c), or show system info (i).

⁠What's included

Built on Red Hat UBI10 Minimal. Highlights by category:

Kubernetes / containers

• kubectl v1.29.6, helm v3.12.0, kustomize v5.1.1
• k9s v0.32.7 (terminal UI), oc (OpenShift CLI) v4.17.0
• docker CE CLI

Infrastructure as Code / config management

• terraform v1.9.8, packer v1.11.2
• ansible + ansible-runner

Cloud SDKs & CLIs

• AWS: aws CLI v2, boto3, awscli (pip)
• Azure: azure-identity, azure-mgmt-resource, azure-mgmt-compute, azure-storage-blob
• GCP: google-auth, google-cloud-storage

Secrets / crypto

• HashiCorp vault CLI v1.17.6
• hvac, cryptography, python-dotenv

Languages & build toolchains

• Python 3 + pip
• Node.js 24 (NodeSource)
• Go (from UBI repos)
• Java 17 (Eclipse Temurin JDK, JAVA_HOME=/usr/lib/jvm/java-current)
• Maven, Gradle 8.8

AI / ML CLIs

• Claude Code CLI (claude), opencode
• Hugging Face Hub (huggingface-hub)

Source control / CI APIs

• git, PyGithub, python-gitlab

Networking, shell & utilities

• curl, wget, jq, yq, ncat (nmap-ncat), iputils
• openssh-clients, sshpass, openssl, vim-minimal, figlet
• libexpat 2.7.2 (built from source)

Python developer libraries (selection)

• HTTP/networking: requests, urllib3, httpx, aiohttp, websocket-client, dnspython
• Data formats & schema: pyyaml, ruamel.yaml, lxml, xmltodict, jsonschema, pydantic, cerberus
• CLI/output: rich, click, typer, loguru, tabulate, tqdm
• SSH/remote: paramiko, fabric
• Kubernetes/Docker/monitoring: kubernetes, docker, prometheus-client
• Testing: pytest (+ plugins), hypothesis, faker, responses, vcrpy, coverage

Bundled learning archives live under /app (learn-you-an-llm, learn-you-an-hf-llm, learn-you-a-nanochat, learn-you-an-sft).

⁠Configuration

Entrypoint behavior — the image's entrypoint decides what to run:

• docker run -it <img> (no command, TTY) → interactive dashboard
• docker run -it <img> bash (command given) → runs that command
• docker run <img> (no command, no TTY) → plain bash
• Set DEVOPS_NO_DASHBOARD=1 to skip the dashboard and drop straight to bash

Environment variables

• JAVA_HOME=/usr/lib/jvm/java-current (stable symlink to the Temurin JDK 17)
• PATH prepends ${JAVA_HOME}/bin and /usr/local/bin
• LD_LIBRARY_PATH=/usr/local/lib (for the custom-built libexpat)
• CHECKPOINT_DISABLE=1 — stops Terraform/Packer from phoning home (avoids hangs behind restrictive proxies)
• DEVOPS_NO_DASHBOARD — set to 1 to bypass the launcher

Mounts — nothing is required, but common patterns:

• -v ~/.aws:/root/.aws:ro — AWS credentials/config
• -v ~/.kube:/root/.kube:ro — kubeconfig for kubectl/helm/k9s
• -v $(pwd):/work -w /work — work on local files

Users — the container runs as root by default (WORKDIR /root). A non-root devops user also exists in the image if you prefer --user devops.

Certificate handling — certificates are managed on demand (not automatically at startup) via /usr/local/bin/update-certs.sh, which can install into the Java keystore (cacerts), the OS trust store, or both. It is also available from the dashboard (c).

Sources (choose exactly one):

• <hostname> — extract certs from a live TLS endpoint (e.g. update-certs.sh api.example.com -p 8443)
• --import-file FILE — import a single PEM/CRT
• --import-dir DIR — import all .pem/.crt/.cert files (aliases auto-generated from filenames)
• --endpoints-file FILE — read host or host:port entries, one per line

Install targets (default is both Java and OS):

• -j/--java-only — Java keystore only
• -s/--system-only — OS trust store only

Useful flags: --insecure (accept self-signed during extraction), -v (verbose), --java-cacerts PATH, --java-pass PASSWORD. Example:

docker run -it -v /path/to/certs:/certs n8500x/devops-sak \
  update-certs.sh --import-dir /certs -j

⁠Build

docker build -t n8500x/devops-sak .

Tool versions are controlled by ARGs in the Dockerfile (e.g. KUBECTL_VERSION, TERRAFORM_VERSION, VAULT_VERSION, NODE_VERSION, GRADLE_VERSION, TEMURIN17_VERSION). Override at build time as needed:

docker build --build-arg TERRAFORM_VERSION=1.9.8 -t n8500x/devops-sak .

The build verifies every major tool is present and runs a certificate-management test suite; it fails if any tool is missing.

⁠Notes

• Large image. This is a deliberately comprehensive toolbox — expect a big download. To slim it down, remove tool blocks in the Dockerfile or build a minimal variant.
• Java 17 from Temurin. UBI10 ships no Java 17, so it is pulled from a pinned Eclipse Temurin tarball (sha256-verified). java/javac resolve to 17 via JAVA_HOME, even though Maven drags in its own JRE.
• Built-from-source tools. sshpass (not in EPEL10) and libexpat are compiled during the build.
• Proxy friendliness. CHECKPOINT_DISABLE=1 is baked in so Terraform/Packer don't hang on checkpoint.hashicorp.com behind restrictive proxies. For TLS-intercepting proxies, import your CA with update-certs.sh.
• Version reference. Image documents itself as DevOps SAK v1.0.22 (/usr/local/share/doc/devops-sak/README.txt).