Tools¶
All tools below are pre-installed in the container image. Run which <tool> to
confirm availability. No local installation is needed.
Exact versions are not listed here to keep this page from drifting — run
<tool> --version inside the container for the running version. Version pins
live in the Dockerfile ARGs (most are Renovate-tracked; see Version
management for the exceptions).
| Category | Tool | Version | Purpose |
|---|---|---|---|
| IaC | Terraform | Renovate-pinned — see Dockerfile ARG | Infrastructure provisioning |
| IaC | Packer | Renovate-pinned — see Dockerfile ARG | Machine image building |
| Config Mgmt | Ansible | Renovate-pinned — see Dockerfile ARG | Agentless configuration management |
| Config Mgmt | hvac + community.hashi_vault |
Renovate-pinned — see Dockerfile ARG | HashiCorp Vault / OpenBao API client (Python) + Ansible collection for Vault/OpenBao lookups |
| Config Mgmt | Chef (chef-cli, cookstyle, test-kitchen, berkshelf) | latest gems | Cookbook-based config management |
| Runtime | Python | .mise.toml (mise) |
Ansible, OCI CLI, checkov |
| Runtime | Ruby | .mise.toml (mise) |
Chef tools |
| Runtime | Node.js | Alpine pkg | Claude Code |
| Runtime | Go | .mise.toml (mise) |
dev-monitor build + local go build/vet/test (stdlib-only, offline) |
| Python pkg | uv / uvx | Renovate-pinned — see Dockerfile ARG | Fast Python package + tool manager (Astral) |
| Python lib | jinja2 | Renovate-pinned — see Dockerfile ARG | Templating for config/scaffold generation |
| Python lib | pandas | Renovate-pinned — see Dockerfile ARG | Dataframes for inventory/cost/report munging |
| Browser | chromium (chromium-browser) |
Alpine pkg | Headless browser — render/screenshot/inspect local HTML; run via chromium-headless |
| Browser | chromedriver | Alpine pkg | WebDriver for chromium (version-locked to it via apk) |
| Browser | selenium | Renovate-pinned — see Dockerfile ARG | Python WebDriver client for scripted HTML testing (click/wait/assert) |
| Documents | poppler-utils (pdftotext, pdfinfo, pdftoppm, pdfimages) |
Alpine pkg | Extract PDF text (pdftotext -layout), metadata, and images; render pages. Claude Code's Read tool uses pdfinfo to count pages and pdftoppm to render page ranges (see ADR 0019) |
| Documents | pypdf | Renovate-pinned — see Dockerfile ARG | Python PDF library — text, metadata, split/merge, decrypt |
| Documents | pdfplumber | Renovate-pinned — see Dockerfile ARG | Layout-aware PDF text and table extraction (Python) |
| Documents | openpyxl | Renovate-pinned — see Dockerfile ARG | Read/write .xlsx/.xlsm; the engine pandas.read_excel uses for them |
| Documents | xlrd | Renovate-pinned — see Dockerfile ARG | Read legacy .xls; the engine pandas.read_excel uses for it |
| Cloud identity | PowerShell (pwsh) |
Renovate-pinned — see Dockerfile ARG | Cross-platform shell for Entra ID / M365 automation. amd64 only — no musl arm64 build (see ADR 0017) |
| Cloud identity | Microsoft Graph SDK (Microsoft.Graph.Authentication, .Users, .Groups) |
Renovate-pinned — see Dockerfile ARG | Microsoft Graph PowerShell submodules for Entra ID users/groups (Connect-MgGraph, Get-MgUser, Get-MgGroup). amd64 only |
| Cloud CLI | OCI CLI | Renovate-pinned — see Dockerfile ARG | Oracle Cloud management |
| Cloud CLI | govc | Renovate-pinned — see Dockerfile ARG | VMware vSphere CLI |
| Cloud CLI | proxmoxer | Renovate-pinned — see Dockerfile ARG | Proxmox VE API client |
| Security | 1Password CLI | Renovate-pinned — see Dockerfile ARG | Runtime secret retrieval |
| Security | OpenBao (bao) |
Renovate-pinned — see Dockerfile ARG | Vault-compatible secrets engine CLI |
| Security | gitleaks | Renovate-pinned — see Dockerfile ARG | Secret scanning (binary, called from pre-commit) |
| Security | sops | Renovate-pinned — see Dockerfile ARG | Encrypt/decrypt values inside YAML/JSON/ENV files; age support is built in (see ADR 0020) |
| Security | age (age, age-keygen) |
Alpine pkg | Simple file encryption and key generation; pairs with sops |
| Kubernetes | kubectl | Renovate-pinned — see Dockerfile ARG | Kubernetes CLI |
| Kubernetes | flux | Renovate-pinned — see Dockerfile ARG | Flux CD (GitOps) CLI |
| Containers | crane | Renovate-pinned — see Dockerfile ARG | Inspect and copy registry images without a container engine (crane ls, crane manifest, crane digest, crane copy) |
| Kubernetes | helm | Renovate-pinned — see Dockerfile ARG | Kubernetes package manager. Helm 4 (major) — see ADR 0021 |
| Kubernetes | kubectl-cnpg | Renovate-pinned — see Dockerfile ARG | CloudNativePG kubectl plugin; on PATH, so kubectl cnpg ... works |
| Kubernetes | cmctl | Renovate-pinned — see Dockerfile ARG | cert-manager CLI (certificate status, renewal, API checks) |
| Kubernetes | k9s | Renovate-pinned — see Dockerfile ARG | Terminal UI for Kubernetes clusters |
| Kubernetes | stern | Renovate-pinned — see Dockerfile ARG | Tail logs from multiple pods and containers |
| Kubernetes | kubeconform | Renovate-pinned — see Dockerfile ARG | Validate Kubernetes manifests against JSON schemas |
| Observability | promtool | Renovate-pinned — see Dockerfile ARG | Check Prometheus config and rules, run rule unit tests (the prometheus server is not installed) |
| Observability | amtool | Renovate-pinned — see Dockerfile ARG | Alertmanager CLI: validate config, query alerts, manage silences (the alertmanager server is not installed) |
| Quality | actionlint | Renovate-pinned — see Dockerfile ARG | GitHub Actions workflow linter |
| Quality | vale | Renovate-pinned — see Dockerfile ARG | Prose linter (styles come from a project's .vale.ini) |
| Quality | yq (mikefarah) | Alpine pkg (yq-go) |
YAML/JSON/TOML/XML processor; BATS asserts it is the Go implementation |
| Database | PostgreSQL client (psql, pg_dump, pg_restore, ...) |
Alpine pkg (postgresql18-client) |
PostgreSQL 18 client tools; the major is pinned in the package name |
| Backup | restic | Renovate-pinned — see Dockerfile ARG | Encrypted, deduplicated backups |
| Benchmark | sysbench | Alpine pkg | CPU, memory, threads and mutex benchmarks |
| Benchmark | fio | Alpine pkg | Flexible disk I/O benchmark |
| Quality | pre-commit | Renovate-pinned — see Dockerfile ARG | Git hook framework |
| Quality | hadolint | Renovate-pinned — see Dockerfile ARG | Dockerfile linting |
| Quality | shellcheck | Renovate-pinned — see Dockerfile ARG | Shell script linting (binary, called from pre-commit) |
| Quality | tflint | Renovate-pinned — see Dockerfile ARG | Terraform linting |
| Quality | terraform-docs | Renovate-pinned — see Dockerfile ARG | Terraform module documentation |
| Quality | checkov | Renovate-pinned — see Dockerfile ARG | IaC security scanning |
| Quality | ansible-lint | Renovate-pinned — see Dockerfile ARG | Ansible linting |
| AI | Claude Code | Renovate-pinned — see Dockerfile ARG | AI-assisted development |
| AI | GitHub Copilot CLI (copilot) |
Renovate-pinned — see Dockerfile ARG | Terminal agent for Copilot subscribers; npm package with a musl platform binary (~200 MB). Needs the Copilot allowlist entries and a GitHub account with a Copilot subscription |
| Dev | gh | Renovate-pinned — see Dockerfile ARG | GitHub CLI |
| Dev | glab | Renovate-pinned — see Dockerfile ARG | GitLab CLI (used when GIT_PLATFORM=gitlab) |
| Dev | tea | Renovate-pinned — see Dockerfile ARG | Gitea CLI (used when GIT_PLATFORM=gitea) |
| Dev | Podman | Alpine pkg | Rootless container engine |
| Dev | podman-docker | Alpine pkg | docker → podman symlink |
| Dev | tmux | Alpine pkg | Terminal multiplexer |
| Dev | htop | Alpine pkg | Interactive process viewer |
| General | coreutils, findutils, diffutils | Alpine pkg | GNU replacements for BusyBox |
| General | bind-tools, net-tools | Alpine pkg | DNS and network debugging |
| General | rsync, tree, wget, gnupg | Alpine pkg | File sync, directory view, downloads, encryption |
| General | procps | Alpine pkg | ps, pgrep, watch |
| General | envsubst (gettext) | Alpine pkg | Template variable substitution |
Version management¶
Most pinned versions are tracked by Renovate, which runs weekly (Sunday). See CI/CD & Releases for details.
- Dockerfile ARGs — each Renovate-tracked tool has a
# renovate: datasource=X depName=Ycomment directly above its ARG. The custom regex manager matches on that comment shape. gitleaks and uv use the same ARG-plus-comment mechanism as Terraform. .mise.toml— Python/Ruby versions via the native mise manager.pre-commit-config.yaml— hook IDs only; pins live on Dockerfile ARGs because the hooks shell out to in-image binaries (no upstreamrev:to track).github/workflows/— action SHAs via the github-actions manager
glab is Renovate-tracked via the gitlab-releases datasource (gitlab-org/cli).
Its Dockerfile ARG keeps the upstream v-prefixed tag (what Renovate writes); the
build strips the v because GitLab's package-registry path and asset filenames use
a bare version.
PowerShell is Renovate-tracked via the github-releases datasource
(PowerShell/PowerShell). The Microsoft Graph modules share one Dockerfile
ARG (MSGRAPH_VERSION) tracked via the nuget datasource pointed at the
PowerShell Gallery NuGet v2 feed (registryUrl=https://www.powershellgallery.com/api/v2/);
the Authentication, Users, and Groups submodules release in lockstep, so a
single pin keeps them mutually compatible. Both are grouped as powershell in
renovate.json. PowerShell is installed on amd64 only (no musl arm64 build).
tea is tracked through the Dockerfile ARG's gitea-releases annotation
(registryUrl=https://gitea.com), like the other annotated pins.