nnthanh101/k8s repository overview

⁠nnthanh101/k8s

A small Kubernetes deploy runner for CI: kubectl, Helm and a readiness wait, nothing else.

⁠Why this image exists

A pipeline step that only runs helm upgrade and waits for the rollout should not pull a full infrastructure toolchain. This image carries only what that step needs, so the deploy step pulls less and behaves the same on every runner. For Terraform, scanners or cost estimates, use nnthanh101/terraform instead.

⁠Choose a tag

Pin what you tested: docker buildx imagetools inspect nnthanh101/k8s:latest prints the digest to use as nnthanh101/k8s@sha256:<digest>. Measured on 2026-09-23, the image is about 0.3 GB to pull.

⁠What is included

Image version: 2.11.1 (from .devcontainer/k8s/VERSION).

Base image (every target): cgr.dev/chainguard/wolfi-base:latest@sha256:1d95114038f76513a9ace6fca107d5582b08c65981f81f61cb56bf7fd2ef216d

Wolfi = the signed Wolfi package, updated weekly.

⁠Get started

No cluster needed:

docker run --rm nnthanh101/k8s:latest sh -c 'kubectl version --client && helm version --short'

Against your cluster (the image runs as user toolkit, UID 1000):

docker run --rm -v "$HOME/.kube:/home/toolkit/.kube:ro" nnthanh101/k8s:latest kubectl get nodes

Wait until a rollout is ready (wait-for --help lists every kind):

wait-for deployment --namespace production --label app=myapp
TIMEOUT=600 POLL_INTERVAL=10 wait-for statefulset --namespace data --label app=db

GitHub Actions job:

jobs:
  deploy:
    runs-on: ubuntu-latest
    container:
      image: nnthanh101/k8s@sha256:<digest>
      options: --user 0  # prevents EACCES on the runner's temporary directories
    steps:
      - uses: actions/checkout@<commit-sha> # pin actions by commit
      - run: helm upgrade --install myapp ./chart -n production
      - run: wait-for deployment --namespace production --label app=myapp

⁠Security

• Base: Chainguard Wolfi, pinned by digest in versions.env.
• Verified downloads: kubectl is checked against its published SHA256; Helm comes from its release archive.
• Non-root: user toolkit (UID 1000). GitHub Actions container jobs need --user 0.
• Not signed: the k8s release workflow does not sign images yet. Pin by digest.
• Known gap: the image also installs the vendor coding CLI.

⁠Links

• Dockerfile⁠ | versions.env⁠
• nnthanh101/terraform⁠ for infrastructure as code
• Chainguard Wolfi⁠