Skip to content

Choosing the Right Image

Use this guide to pick the best image for you. Answer three quick questions, or read on for the full comparison.

Interactive picker

This picker needs JavaScript. Without it, use the decision tree below.

Decision tree

flowchart TD
    START["Which image should I use?"] --> Q1{"Working with<br/>more than one cloud?"}
    Q1 -->|Yes| ALL["all-devops<br/>AWS + Google Cloud"]
    Q1 -->|No| Q2{"Which cloud?"}
    Q2 -->|AWS| AWS["aws-devops<br/>AWS CLI v2 + Session Manager"]
    Q2 -->|Google Cloud| GCP["gcp-devops<br/>gcloud + GKE auth plugin"]
    Q2 -->|"Neither / not sure"| ALL
    ALL --> DONE["Head to Quick Start"]
    AWS --> DONE
    GCP --> DONE

    classDef q fill:#334155,stroke:#1e293b,color:#fff
    classDef all fill:#059669,stroke:#047857,color:#fff
    classDef aws fill:#ea7a0c,stroke:#c2410c,color:#fff
    classDef gcp fill:#2563eb,stroke:#1d4ed8,color:#fff
    classDef done fill:#0891b2,stroke:#0e7490,color:#fff
    class START,Q1,Q2 q
    class ALL all
    class AWS aws
    class GCP gcp
    class DONE done

Everything else is identical

All three images share the same base: Terraform, Terragrunt, TFLint, Packer, kubectl, Helm, k9s, Ansible, Trivy, Python, Node.js, the four AI coding agents, database clients and network tools. You're only choosing which cloud CLIs come on top.

At a glance

all-devops aws-devops gcp-devops
Shared base toolkit
AWS CLI v2 + Session Manager plugin —
boto3, cfn-lint, s3cmd, pytest —
gcloud (+ beta), gsutil, bq —
GKE auth plugin, docker-credential-gcr —
Download (compressed, amd64) ~1.6 GB ~1.55 GB ~1.5 GB
On disk (unpacked, amd64) ~5.0 GB ~4.6 GB ~4.6 GB
Best for Multi-cloud and platform teams AWS-first teams Google Cloud-first teams

Size isn't a big differentiator

The shared base is most of each image, so the single-cloud images are only about 0.4 GB smaller on disk than all-devops. Choose on the tools you need, not on size. If you do need something slimmer, build a custom image from the base target.

Scenarios

Use all-devops

  • Try AWS and Google Cloud without switching images
  • Every tool is there when you need it
docker pull ghcr.io/jinalshah/devops/images/all-devops:latest

Use aws-devops

  • AWS CLI v2, SSO profiles and the Session Manager plugin for EC2 access without SSH
  • boto3 and cfn-lint for scripting and CloudFormation
  • No Google Cloud SDK to keep patched
docker pull ghcr.io/jinalshah/devops/images/aws-devops:latest

Use gcp-devops

  • gcloud with beta components, gsutil and bq
  • gke-gcloud-auth-plugin, so gcloud container clusters get-credentials and kubectl work against GKE
  • docker-credential-gcr for Artifact Registry authentication
docker pull ghcr.io/jinalshah/devops/images/gcp-devops:latest

Use all-devops with a pinned tag

  • One image for every deployment target
  • Pin a per-commit 1.0.<short-sha> tag, or a @sha256: digest for exact bits (scheduled rebuilds refresh tags with newer tools)
container:
  image: ghcr.io/jinalshah/devops/images/all-devops:1.0.abc1234

Use the single-cloud image you need, and scan it

  • Fewer tools means a smaller attack surface
  • Trivy is included, and it can scan any registry image directly (no Docker daemon needed):
docker run --rm ghcr.io/jinalshah/devops/images/aws-devops:latest \
  trivy image --severity HIGH,CRITICAL ghcr.io/jinalshah/devops/images/aws-devops:latest

Tool matrix

Tool all aws gcp Notes
Terraform Latest at build time; switch versions with tfswitch
Terragrunt Pinned per build, bumped automatically
TFLint Pinned per build, bumped automatically
Packer Pinned per build, bumped automatically
Tool all aws gcp Notes
kubectl Latest stable from dl.k8s.io at build time
Helm 3 Package manager
k9s Terminal UI
gke-gcloud-auth-plugin — Needed for GKE clusters
Tool all aws gcp Notes
AWS CLI v2 —
Session Manager plugin — aws ssm start-session
gcloud, gsutil, bq — With beta components
docker-credential-gcr — Registry credential helper
Tool all aws gcp Notes
Claude Code (claude) Anthropic
Codex CLI (codex) OpenAI
Copilot CLI (copilot) GitHub
Antigravity CLI (agy) Google (replaces Gemini CLI)
Tool all aws gcp Notes
Ansible + ansible-lint
pre-commit Git hook framework
Task Taskfile runner
Trivy Vulnerability and IaC scanner

The tool explorer lets you search all of them.

Registry choice

ghcr.io/jinalshah/devops/images/<image>:latest

The recommended registry, and it's where each image's package page lives.

registry.gitlab.com/jinal-shah/devops/images/<image>:latest

Handy if your pipelines already run on GitLab CI.

js01/<image>:latest

Familiar, but anonymous pulls are rate-limited, so log in with docker login in CI.

Next steps