Ubuntu
05ea40562c
Owns Dockerfile/CI and node1 workload YAML; ImagePolicy elects run_number-sha tags and ImageUpdateAutomation commits them into deploy/.
77 lines
2.4 KiB
Docker
77 lines
2.4 KiB
Docker
# Cursor Remote-SSH / personal devbox: OpenSSH + docker CLI (DinD sidecar at runtime).
|
|
FROM ubuntu:latest
|
|
|
|
ARG KUBECTL_VERSION=v1.31.2
|
|
ARG FLUX_VERSION=2.9.4
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive \
|
|
LANG=C.UTF-8
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
bash \
|
|
ca-certificates \
|
|
chromium \
|
|
curl \
|
|
docker.io \
|
|
git \
|
|
golang \
|
|
jq \
|
|
nodejs \
|
|
npm \
|
|
openssh-server \
|
|
python3 \
|
|
python3-venv \
|
|
ripgrep \
|
|
rustc \
|
|
sudo \
|
|
unzip \
|
|
vim-tiny \
|
|
wget \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& mkdir -p /var/run/sshd /etc/ssh/sshd_config.d /usr/share/devbox-http \
|
|
&& echo 'devbox ok' > /usr/share/devbox-http/index.html
|
|
|
|
# kubectl (same pattern as services/devops-ai)
|
|
RUN curl -fsSL --retry 5 --retry-all-errors --retry-delay 3 \
|
|
"https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
|
|
-o /usr/local/bin/kubectl \
|
|
&& chmod +x /usr/local/bin/kubectl
|
|
|
|
# flux CLI
|
|
RUN curl -fsSL --retry 5 --retry-all-errors --retry-delay 3 \
|
|
"https://github.com/fluxcd/flux2/releases/download/v${FLUX_VERSION}/flux_${FLUX_VERSION}_linux_amd64.tar.gz" \
|
|
| tar -xz -C /usr/local/bin flux \
|
|
&& chmod +x /usr/local/bin/flux
|
|
|
|
# Passwordless sudo for the interactive developer user.
|
|
# Official ubuntu images ship uid 1000 as user "ubuntu" — rename it.
|
|
RUN usermod -l developer ubuntu \
|
|
&& groupmod -n developer ubuntu \
|
|
&& usermod -d /home/developer -m developer \
|
|
&& echo 'developer ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/developer \
|
|
&& chmod 440 /etc/sudoers.d/developer
|
|
|
|
# SSH hardening: keys only, no root login.
|
|
RUN printf '%s\n' \
|
|
'PasswordAuthentication no' \
|
|
'KbdInteractiveAuthentication no' \
|
|
'PermitRootLogin no' \
|
|
'AllowUsers developer' \
|
|
'PubkeyAuthentication yes' \
|
|
'X11Forwarding no' \
|
|
'AllowTcpForwarding yes' \
|
|
'ClientAliveInterval 30' \
|
|
'ClientAliveCountMax 3' \
|
|
> /etc/ssh/sshd_config.d/99-devbox.conf \
|
|
&& ssh-keygen -A
|
|
|
|
RUN curl -L https://github.com/dolthub/dolt/releases/latest/download/install.sh | bash \
|
|
&& curl -fsSL https://raw.githubusercontent.com/gastownhall/beads/main/scripts/install.sh | bash
|
|
|
|
COPY entrypoint.sh /entrypoint.sh
|
|
RUN chmod +x /entrypoint.sh
|
|
|
|
EXPOSE 22 8080
|
|
USER root
|
|
ENTRYPOINT ["/entrypoint.sh"]
|