Skip to content
Rocky Linux 10amd64 + arm64Rebuilt weekly3 registries

Your whole DevOps toolbox, in one container

Terraform, Kubernetes, AWS, Google Cloud, Ansible, security scanning, database clients and four AI coding agents, pre-installed and ready to go. You don't need to install anything on your machine or your CI runners.

Quick start Pick an image GitHub GitHub

3image variants
40+tools pre-installed
4AI coding agents
2CPU architectures

Choose your image

All three images share the same base toolkit. They differ only in which cloud CLIs they add on top.

  • all-devops

    Everything: AWS CLI v2 + Session Manager and Google Cloud CLI. Best for multi-cloud and platform teams.

    ghcr.io/jinalshah/devops/images/all-devops

    All DevOps guide

  • aws-devops

    AWS CLI v2, Session Manager plugin, boto3, cfn-lint and s3cmd, with no Google Cloud SDK.

    ghcr.io/jinalshah/devops/images/aws-devops

    AWS DevOps guide

  • Google Cloud gcp-devops

    Google Cloud CLI with beta components, gsutil, bq, docker-credential-gcr and the GKE auth plugin, with no AWS tooling.

    ghcr.io/jinalshah/devops/images/gcp-devops

    GCP DevOps guide

Not sure? The interactive image picker answers it in three clicks.

How the images are layered

flowchart TB
  R["Rocky Linux 10"] --> B["Shared base layer<br/>Terraform · Terragrunt · TFLint · Packer<br/>kubectl · Helm · k9s · Ansible · Trivy<br/>Python 3.14 · Node.js LTS · Git · gh<br/>Claude · Codex · Copilot · Antigravity<br/>mongosh · psql · mysql"]
  B --> A["all-devops<br/>+ AWS CLI + gcloud"]
  B --> W["aws-devops<br/>+ AWS CLI + SSM"]
  B --> G["gcp-devops<br/>+ gcloud + GKE auth"]

  classDef base fill:#0d9488,stroke:#0f766e,color:#fff
  classDef os fill:#334155,stroke:#1e293b,color:#fff
  classDef all fill:#7c3aed,stroke:#5b21b6,color:#fff
  classDef aws fill:#ea7a0c,stroke:#c2410c,color:#fff
  classDef gcp fill:#2563eb,stroke:#1d4ed8,color:#fff
  class R os
  class B base
  class A all
  class W aws
  class G gcp

What's inside

  • Terraform Infrastructure as code

    Terraform (via tfswitch), Terragrunt, TFLint, Packer

  • Kubernetes Kubernetes

    kubectl, Helm 3, k9s

  • Ansible Automation

    Ansible, ansible-lint, pre-commit, Task (go-task)

  • Trivy Security

    Trivy for image, filesystem and IaC scanning

  • AI coding agents

    Claude Code, OpenAI Codex CLI, GitHub Copilot CLI, Google Antigravity CLI (agy)

  • Database clients

    MongoDB Shell 8.0, PostgreSQL 17 psql, MySQL 8.4 client

  • Python Languages & dev tools

    Python 3.14, Node.js LTS, Git, GitHub CLI, ghorg, Zensical

  • Network & shells

    dig, nslookup, nmap, ncat, telnet, curl, wget, lftp, jq · zsh (Oh My Zsh), bash, fish

Want to search and filter the whole list? Open the interactive tool explorer.

Quick start

docker run -it --rm ghcr.io/jinalshah/devops/images/all-devops:latest

This drops you into a Zsh shell with every tool available.

docker run -it --rm \
  -v "$PWD":/srv -w /srv \
  -v ~/.ssh:/root/.ssh:ro \
  -v ~/.aws:/root/.aws \
  -v ~/.config/gcloud:/root/.config/gcloud \
  ghcr.io/jinalshah/devops/images/all-devops:latest

Your project is mounted at /srv, and your SSH keys and cloud credentials come with you.

jobs:
  plan:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/jinalshah/devops/images/all-devops:1.0.abc1234
    steps:
      - uses: actions/checkout@v7
      - run: terraform init
      - run: terraform plan

Pin a 1.0.<short-sha> tag so pipelines don't change under you, or pin the digest (@sha256:…) for byte-for-byte reproducibility.

Want every mount option? Use the docker run builder.

Registries and tags

Every image is published to three registries:

Registry Image path Best for
GitHub GitHub Container Registry ghcr.io/jinalshah/devops/images/<image>:<tag> Recommended for most users
GitLab GitLab Container Registry registry.gitlab.com/jinal-shah/devops/images/<image>:<tag> GitLab CI/CD pipelines
Docker Docker Hub js01/<image>:<tag> Alternative (mind the pull rate limits)
Tag Example Use for
Version 1.0.abc1234 CI/CD: one tag per commit (scheduled rebuilds refresh its tools)
Architecture-specific 1.0.abc1234-amd64 Debugging a single architecture
Latest latest Local development: always the newest build from main

Both linux/amd64 and linux/arm64 (including Apple Silicon) are published under the same tag, and Docker pulls the right one automatically.

Need byte-for-byte reproducibility?

Images are rebuilt weekly (and whenever tool versions are bumped), and a rebuild of the same commit refreshes its 1.0.<sha> tag with newer tools. To lock a pipeline to exact bits, pin the digest:

docker buildx imagetools inspect ghcr.io/jinalshah/devops/images/all-devops:latest --format '{{json .Manifest.Digest}}'
# then use ghcr.io/jinalshah/devops/images/all-devops@sha256:<digest>

Why use these images?

  • For individual developers

    • No local tool installation
    • Keep your host clean
    • Same setup on Intel, AMD and Apple Silicon

  • For teams

    • Everyone runs identical tool versions
    • New starters are productive in minutes
    • Pin a tag or digest for reproducibility

  • For CI/CD

    • Pre-built, so there's no install step in pipelines
    • Per-commit version tags (or pin a digest)
    • Works on x86 and ARM runners
    • Rebuilt weekly with the latest tools

Where next?