Initial cursor-devbox: image, deploy manifests, and Flux SHA automation.

Owns Dockerfile/CI and node1 workload YAML; ImagePolicy elects run_number-sha tags and ImageUpdateAutomation commits them into deploy/.
2026-09-20 12:57:44 +00:00
commit 05ea40562c
8 changed files with 459 additions and 0 deletions
@@ -0,0 +1,76 @@
+# Cursor Remote-SSH / personal devbox: OpenSSH + docker CLI (DinD sidecar at runtime).
+FROM ubuntu:latest
+
+ARG KUBECTL_VERSION=v1.31.2
+ARG FLUX_VERSION=2.9.4
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    LANG=C.UTF-8
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        bash \
+        ca-certificates \
+        chromium \
+        curl \
+        docker.io \
+        git \
+        golang \
+        jq \
+        nodejs \
+        npm \
+        openssh-server \
+        python3 \
+        python3-venv \
+        ripgrep \
+        rustc \
+        sudo \
+        unzip \
+        vim-tiny \
+        wget \
+    && rm -rf /var/lib/apt/lists/* \
+    && mkdir -p /var/run/sshd /etc/ssh/sshd_config.d /usr/share/devbox-http \
+    && echo 'devbox ok' > /usr/share/devbox-http/index.html
+
+# kubectl (same pattern as services/devops-ai)
+RUN curl -fsSL --retry 5 --retry-all-errors --retry-delay 3 \
+        "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
+        -o /usr/local/bin/kubectl \
+    && chmod +x /usr/local/bin/kubectl
+
+# flux CLI
+RUN curl -fsSL --retry 5 --retry-all-errors --retry-delay 3 \
+        "https://github.com/fluxcd/flux2/releases/download/v${FLUX_VERSION}/flux_${FLUX_VERSION}_linux_amd64.tar.gz" \
+        | tar -xz -C /usr/local/bin flux \
+    && chmod +x /usr/local/bin/flux
+
+# Passwordless sudo for the interactive developer user.
+# Official ubuntu images ship uid 1000 as user "ubuntu" — rename it.
+RUN usermod -l developer ubuntu \
+    && groupmod -n developer ubuntu \
+    && usermod -d /home/developer -m developer \
+    && echo 'developer ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/developer \
+    && chmod 440 /etc/sudoers.d/developer
+
+# SSH hardening: keys only, no root login.
+RUN printf '%s\n' \
+      'PasswordAuthentication no' \
+      'KbdInteractiveAuthentication no' \
+      'PermitRootLogin no' \
+      'AllowUsers developer' \
+      'PubkeyAuthentication yes' \
+      'X11Forwarding no' \
+      'AllowTcpForwarding yes' \
+      'ClientAliveInterval 30' \
+      'ClientAliveCountMax 3' \
+      > /etc/ssh/sshd_config.d/99-devbox.conf \
+    && ssh-keygen -A
+
+RUN curl -L https://github.com/dolthub/dolt/releases/latest/download/install.sh | bash \
+    && curl -fsSL https://raw.githubusercontent.com/gastownhall/beads/main/scripts/install.sh | bash
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+EXPOSE 22 8080
+USER root
+ENTRYPOINT ["/entrypoint.sh"]