Tools

All tools below are pre-installed in the container image. Run which <tool> to confirm availability. No local installation is needed.

Exact versions are not listed here to keep this page from drifting — run <tool> --version inside the container for the running version. Version pins live in the Dockerfile ARGs (most are Renovate-tracked; see Version management for the exceptions).

Category	Tool	Version	Purpose
IaC	Terraform	Renovate-pinned — see Dockerfile ARG	Infrastructure provisioning
IaC	Packer	Renovate-pinned — see Dockerfile ARG	Machine image building
Config Mgmt	Ansible	Renovate-pinned — see Dockerfile ARG	Agentless configuration management
Config Mgmt	hvac + community.hashi_vault	Renovate-pinned — see Dockerfile ARG	HashiCorp Vault / OpenBao API client (Python) + Ansible collection for Vault/OpenBao lookups
Config Mgmt	Chef (chef-cli, cookstyle, test-kitchen, berkshelf)	latest gems	Cookbook-based config management
Runtime	Python	.mise.toml (mise)	Ansible, OCI CLI, checkov
Runtime	Ruby	.mise.toml (mise)	Chef tools
Runtime	Node.js	Alpine pkg	Claude Code
Runtime	Go	.mise.toml (mise)	dev-monitor build + local go build/vet/test (stdlib-only, offline)
Python pkg	uv / uvx	Renovate-pinned — see Dockerfile ARG	Fast Python package + tool manager (Astral)
Python lib	jinja2	Renovate-pinned — see Dockerfile ARG	Templating for config/scaffold generation
Python lib	pandas	Renovate-pinned — see Dockerfile ARG	Dataframes for inventory/cost/report munging
Browser	chromium (chromium-browser)	Alpine pkg	Headless browser — render/screenshot/inspect local HTML; run via chromium-headless
Browser	chromedriver	Alpine pkg	WebDriver for chromium (version-locked to it via apk)
Browser	selenium	Renovate-pinned — see Dockerfile ARG	Python WebDriver client for scripted HTML testing (click/wait/assert)
Cloud identity	PowerShell (pwsh)	Renovate-pinned — see Dockerfile ARG	Cross-platform shell for Entra ID / M365 automation. amd64 only — no musl arm64 build (see ADR 0017)
Cloud identity	Microsoft Graph SDK (Microsoft.Graph.Authentication, .Users, .Groups)	Renovate-pinned — see Dockerfile ARG	Microsoft Graph PowerShell submodules for Entra ID users/groups (Connect-MgGraph, Get-MgUser, Get-MgGroup). amd64 only
Cloud CLI	OCI CLI	Renovate-pinned — see Dockerfile ARG	Oracle Cloud management
Cloud CLI	govc	Renovate-pinned — see Dockerfile ARG	VMware vSphere CLI
Cloud CLI	proxmoxer	Renovate-pinned — see Dockerfile ARG	Proxmox VE API client
Security	1Password CLI	Renovate-pinned — see Dockerfile ARG	Runtime secret retrieval
Security	OpenBao (bao)	Renovate-pinned — see Dockerfile ARG	Vault-compatible secrets engine CLI
Security	gitleaks	Renovate-pinned — see Dockerfile ARG	Secret scanning (binary, called from pre-commit)
Quality	pre-commit	Renovate-pinned — see Dockerfile ARG	Git hook framework
Quality	hadolint	Renovate-pinned — see Dockerfile ARG	Dockerfile linting
Quality	shellcheck	Renovate-pinned — see Dockerfile ARG	Shell script linting (binary, called from pre-commit)
Quality	tflint	Renovate-pinned — see Dockerfile ARG	Terraform linting
Quality	terraform-docs	Renovate-pinned — see Dockerfile ARG	Terraform module documentation
Quality	checkov	Renovate-pinned — see Dockerfile ARG	IaC security scanning
Quality	ansible-lint	Renovate-pinned — see Dockerfile ARG	Ansible linting
AI	Claude Code	Renovate-pinned — see Dockerfile ARG	AI-assisted development
Dev	gh	Renovate-pinned — see Dockerfile ARG	GitHub CLI
Dev	glab	Renovate-pinned — see Dockerfile ARG	GitLab CLI (used when GIT_PLATFORM=gitlab)
Dev	tea	Manually pinned Dockerfile ARG (not Renovate-tracked)	Gitea CLI (used when GIT_PLATFORM=gitea)
Dev	Podman	Alpine pkg	Rootless container engine
Dev	podman-docker	Alpine pkg	docker → podman symlink
Dev	tmux	Alpine pkg	Terminal multiplexer
Dev	htop	Alpine pkg	Interactive process viewer
General	coreutils, findutils, diffutils	Alpine pkg	GNU replacements for BusyBox
General	bind-tools, net-tools	Alpine pkg	DNS and network debugging
General	rsync, tree, wget, gnupg	Alpine pkg	File sync, directory view, downloads, encryption
General	procps	Alpine pkg	ps, pgrep, watch
General	envsubst (gettext)	Alpine pkg	Template variable substitution

Version management

Most pinned versions are tracked by Renovate, which runs weekly (Sunday). See CI/CD & Releases for details.

• Dockerfile ARGs — each Renovate-tracked tool has a # renovate: datasource=X depName=Y comment directly above its ARG. The custom regex manager matches on that comment shape. gitleaks and uv use the same ARG-plus-comment mechanism as Terraform.
• .mise.toml — Python/Ruby versions via the native mise manager
• .pre-commit-config.yaml — hook IDs only; pins live on Dockerfile ARGs because the hooks shell out to in-image binaries (no upstream rev: to track)
• .github/workflows/ — action SHAs via the github-actions manager

glab is Renovate-tracked via the gitlab-releases datasource (gitlab-org/cli). Its Dockerfile ARG keeps the upstream v-prefixed tag (what Renovate writes); the build strips the v because GitLab's package-registry path and asset filenames use a bare version.

PowerShell is Renovate-tracked via the github-releases datasource (PowerShell/PowerShell). The Microsoft Graph modules share one Dockerfile ARG (MSGRAPH_VERSION) tracked via the nuget datasource pointed at the PowerShell Gallery NuGet v2 feed (registryUrl=https://www.powershellgallery.com/api/v2/); the Authentication, Users, and Groups submodules release in lockstep, so a single pin keeps them mutually compatible. Both are grouped as powershell in renovate.json. PowerShell is installed on amd64 only (no musl arm64 build).

Not Renovate-tracked: tea is a manually pinned Dockerfile ARG and is not listed in renovate.json, so bumping it is a manual edit.