Quick Reference¶

Fast lookup guide for common DevOps Images commands, volume mounts, and usage patterns.

Tool explorer¶

Search every tool in the images and filter by image or category. Hover over a tool to see the command that checks it's installed.

Images and registries¶

Image	GHCR (recommended)	Download
all-devops	`ghcr.io/jinalshah/devops/images/all-devops`	~1.6 GB
aws-devops	`ghcr.io/jinalshah/devops/images/aws-devops`	~1.55 GB
gcp-devops	`ghcr.io/jinalshah/devops/images/gcp-devops`	~1.5 GB

The same images are at registry.gitlab.com/jinal-shah/devops/images/<image> and js01/<image> (Docker Hub). Tags are latest, a per-commit 1.0.<sha> (refreshed by scheduled rebuilds) and 1.0.<sha>-amd64 / -arm64. Pin by @sha256: digest for strict reproducibility.

Run¶

Shell One command Full workstation

docker run -it --rm -v "$PWD":/srv -w /srv \
  ghcr.io/jinalshah/devops/images/all-devops:latest

docker run --rm -v "$PWD":/srv -w /srv \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  terraform plan

docker run -it --rm \
  -v "$PWD":/srv -w /srv \
  -v ~/.ssh:/root/.ssh:ro \
  -v ~/.aws:/root/.aws \
  -v ~/.config/gcloud:/root/.config/gcloud \
  -v ~/.kube:/root/.kube \
  -v ~/.claude:/root/.claude \
  -v ~/.codex:/root/.codex \
  -v ~/.copilot:/root/.copilot \
  -v ~/.gemini:/root/.gemini \
  ghcr.io/jinalshah/devops/images/all-devops:latest

Mounts cheat sheet¶

Mount	For	Tools
`-v "$PWD":/srv -w /srv`	Your project	Everything
`-v ~/.ssh:/root/.ssh:ro`	SSH keys	`git`, `ssh`, Ansible
`-v ~/.aws:/root/.aws`	AWS profiles and SSO cache	`aws`, Terraform, boto3
`-v ~/.config/gcloud:/root/.config/gcloud`	gcloud accounts and ADC	`gcloud`, `gsutil`, `bq`, GKE, Terraform
`-v ~/.kube:/root/.kube`	kubeconfig	`kubectl`, `helm`, `k9s`
`-v ~/.claude:/root/.claude`	Claude Code login and settings	`claude`
`-v ~/.codex:/root/.codex`	Codex config and `auth.json`	`codex`
`-v ~/.copilot:/root/.copilot`	Copilot CLI login and config	`copilot`
`-v ~/.gemini:/root/.gemini`	Antigravity CLI settings and login	`agy`
`-v ~/.terraform.d:/root/.terraform.d`	Provider cache (with `-e TF_PLUGIN_CACHE_DIR=/root/.terraform.d/plugin-cache`)	Terraform

Everyday commands¶

Terraform Scan & lint Kubernetes AI agents

docker run --rm -v "$PWD":/srv -w /srv -v ~/.aws:/root/.aws \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  bash -c 'terraform init && terraform plan -out=tfplan'

# IaC misconfigurations
docker run --rm -v "$PWD":/srv -w /srv \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  trivy config .

# TFLint and ansible-lint
docker run --rm -v "$PWD":/srv -w /srv \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  bash -c 'tflint --init && tflint --recursive && ansible-lint'

Trivy downloads its vulnerability database on the first trivy image or trivy fs scan.

# kubectl and Helm
docker run --rm -v "$PWD":/srv -w /srv -v ~/.kube:/root/.kube \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  bash -c 'kubectl get pods -A && helm upgrade --install myapp ./charts/myapp'

# k9s needs a TTY
docker run -it --rm -v ~/.kube:/root/.kube \
  ghcr.io/jinalshah/devops/images/all-devops:latest k9s

For EKS or GKE clusters, also mount ~/.aws or ~/.config/gcloud, because the kubeconfig calls the cloud CLI to get tokens.

Always use the non-interactive mode in scripts. Pipe content in with docker run -i:

# Claude Code: pipe a diff into -p (there is no --file flag)
git diff | docker run --rm -i -v "$PWD":/srv -w /srv -v ~/.claude:/root/.claude \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  claude -p "Review this diff for security issues"

# Claude Code: write the answer to a file on the host (needs -p)
docker run --rm -v "$PWD":/srv -w /srv -v ~/.claude:/root/.claude \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  claude -p "Write a Terraform module for an AWS VPC. Output only HCL." > vpc.tf

# Codex, Copilot and Antigravity
docker run --rm -v "$PWD":/srv -w /srv -v ~/.codex:/root/.codex \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  codex exec "Explain what main.tf provisions"

docker run --rm -v "$PWD":/srv -w /srv -v ~/.copilot:/root/.copilot \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  copilot -p "Summarise the Helm chart in charts/myapp" --allow-all-tools

docker run --rm -v "$PWD":/srv -w /srv -v ~/.gemini:/root/.gemini \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  agy -p "List the Kubernetes resources defined in k8s/"

Sign in interactively once inside the container (claude then /login, codex login --device-auth, copilot then /login, agy) and the mounted directories keep you signed in. A login made on a macOS or Windows host may not carry over, because some of these CLIs keep their tokens in the OS keychain rather than in the mounted directory. See the AI CLI setup guide.

Credentials in CI¶

AWS Google Cloud AI CLIs

# Pass through variables already set in your shell or CI job
docker run --rm -v "$PWD":/srv -w /srv \
  -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN \
  -e AWS_DEFAULT_REGION=eu-west-2 \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  terraform apply -auto-approve

# GOOGLE_APPLICATION_CREDENTIALS covers Terraform and client libraries;
# gcloud itself needs activate-service-account
docker run --rm -v "$PWD":/srv -w /srv \
  -v /path/to/key.json:/secrets/key.json:ro \
  -e GOOGLE_APPLICATION_CREDENTIALS=/secrets/key.json \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  bash -c 'gcloud auth activate-service-account --key-file=/secrets/key.json && terraform apply -auto-approve'

# Claude Code: ANTHROPIC_API_KEY (or CLAUDE_CODE_OAUTH_TOKEN from `claude setup-token`)
docker run --rm -v "$PWD":/srv -w /srv -e ANTHROPIC_API_KEY \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  claude -p "Review main.tf for security issues"

# Codex: CODEX_API_KEY for codex exec
docker run --rm -v "$PWD":/srv -w /srv -e CODEX_API_KEY \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  codex exec "Review main.tf for security issues"

# Copilot: fine-grained PAT with the "Copilot Requests" permission
docker run --rm -v "$PWD":/srv -w /srv -e COPILOT_GITHUB_TOKEN \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  copilot -p "Review main.tf for security issues" --allow-all-tools

agy needs {"modelProvider": "gemini"} in ~/.gemini/antigravity-cli/settings.json and GEMINI_API_KEY; the variable alone isn't enough.

Aliases¶

Inside the container, zsh and bash already have shortcuts such as k (kubectl), kg, kd, kl, tf, tfi, tfp, tfa and aws-ssm. On your host, these save typing:

alias devops='docker run -it --rm -v "$PWD":/srv -w /srv -v ~/.ssh:/root/.ssh:ro -v ~/.aws:/root/.aws -v ~/.config/gcloud:/root/.config/gcloud -v ~/.kube:/root/.kube ghcr.io/jinalshah/devops/images/all-devops:latest'

devops                      # interactive shell
devops terraform plan       # one-off command
devops trivy config .

Check versions¶

docker run --rm ghcr.io/jinalshah/devops/images/all-devops:latest bash -c '
  terraform version; kubectl version --client; helm version --short
  ansible --version | head -1; aws --version; gcloud --version | head -1
  trivy --version | head -1; python3 --version; node --version'

k9s keys¶

Key	Action
`:` then `pods`, `deploy`, `svc` …	Jump to a resource type
`0`	All namespaces
`/`	Filter
`d`	Describe
`l`	Logs
`s`	Shell into the container
`Ctrl`+`C` or `:q`	Quit

Quick fixes¶

A pull fails or is slow

Try another registry: registry.gitlab.com/jinal-shah/devops/images/all-devops:latest or js01/all-devops:latest. Docker Hub rate-limits anonymous pulls.

Files in my project are owned by root

The container runs as root. Run sudo chown -R "$(id -u):$(id -g)" . afterwards, or chown inside the container as the last step. --user isn't a good fix because Terraform, claude and HOME live under /root, which only root can read. See Root-owned files.

Credentials aren't picked up

Check that the mount landed: docker run --rm -v ~/.aws:/root/.aws ghcr.io/jinalshah/devops/images/all-devops:latest ls -la /root/.aws. Then test with aws sts get-caller-identity or gcloud auth list.