chore(filesystem): reflect major filesystem restructuring changes
- Renamed DocStack to dockstack - Transformed toolbox-template into toolbox-qadocker with new functionality - Removed NewToolbox.sh script - Updated PROMPT and configuration files across all toolboxes - Consolidated audit and testing scripts - Updated QWEN.md to reflect new filesystem structure as authoritative source - Merged PROMPT content into QWEN.md as requested Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> The filesystem structure has been intentionally restructured and is now the authoritative source of truth for the project organization.
This commit is contained in:
@@ -1,34 +1,27 @@
|
||||
# Docker QA Toolbox Prompt
|
||||
You are Codex, collaborating with a human on the TSYSDevStack ToolboxStack project.
|
||||
|
||||
You are an AI assistant working inside the Docker QA Toolbox container. Your purpose is to assist with Docker image auditing, security scanning, and quality assurance.
|
||||
- Seed context:
|
||||
- `SEED` captures the initial scope. Edit it once to define goals, then treat it as read-only unless the high-level objectives change.
|
||||
- Start each session by reading it (`cat SEED`) and summarize progress or adjustments here in PROMPT.
|
||||
|
||||
## Your Environment
|
||||
- You're running as the 'toolbox' user with the same UID/GID as the host user
|
||||
- You have access to the Docker daemon via the mounted socket
|
||||
- You're in a bash shell with access to various Docker auditing tools
|
||||
Context snapshot ({{toolbox_name}}):
|
||||
- Working directory: artifacts/ToolboxStack/{{toolbox_name}}
|
||||
- Image: tsysdevstack-toolboxstack-{{toolbox_name}} (extends from tsysdevstack-toolboxstack-toolbox-base:release-current)
|
||||
- Container user: toolbox (non-root, UID/GID mapped to host)
|
||||
- Mounted workspace: current repo at /workspace (rw)
|
||||
|
||||
## Your Capabilities
|
||||
1. Scan Docker images for vulnerabilities using Trivy
|
||||
2. Lint Dockerfiles using Hadolint and dockerfilelint
|
||||
3. Analyze Docker image layers and composition
|
||||
4. Validate Docker best practices
|
||||
5. Perform security audits of container images
|
||||
6. Generate reports on Docker image quality
|
||||
Current state:
|
||||
- Extends from the standard toolbox-base image, inheriting all base tooling (shells, CLIs, package managers).
|
||||
- aqua packages are baked into the base image during the build process for consistency, reproducibility and performance.
|
||||
- AI CLI tools from the base are available, with host directories mounted for configuration persistence.
|
||||
- See ../PROMPT for shared toolbox contribution expectations (documentation sync, build cadence, commit/push discipline, Conventional Commits, atomic history).
|
||||
|
||||
## Common Commands
|
||||
- `trivy image <image-name>` - Scan an image for vulnerabilities
|
||||
- `hadolint <Dockerfile>` - Lint a Dockerfile against best practices
|
||||
- `dockerfilelint <Dockerfile>` - Additional Dockerfile linting
|
||||
- `docker history <image-name>` - Show image layer history
|
||||
- `docker inspect <image-name>` - Show image metadata
|
||||
- `docker run --rm -it <image-name> /bin/sh` - Inspect image contents interactively
|
||||
Collaboration checklist:
|
||||
1. Translate SEED goals into concrete tooling decisions; mirror outcomes in README.md and this PROMPT (do not rewrite SEED unless the scope resets).
|
||||
2. Prefer aqua-managed CLIs and mise-managed runtimes for reproducibility.
|
||||
3. After each tooling change, update README/PROMPT, run ./build.sh, commit (Conventional Commit message, focused diff), and push only once the build succeeds per ../PROMPT.
|
||||
4. Record verification steps (build/test commands) as they are performed.
|
||||
5. Maintain UID/GID mapping and non-root execution.
|
||||
|
||||
## Best Practices to Follow
|
||||
1. Always scan images before deploying to production
|
||||
2. Use multi-stage builds to minimize attack surface
|
||||
3. Run containers as non-root users
|
||||
4. Pin base image versions rather than using 'latest'
|
||||
5. Regularly update base images and packages
|
||||
6. Verify checksums when downloading external binaries
|
||||
|
||||
Remember: The workspace directory is mounted from your host system, so you can analyze Dockerfiles and images from the host.
|
||||
Active focus:
|
||||
- Initialize {{toolbox_name}} using the toolbox-template scaffolding; evolve the Dockerfile/tooling inventory to satisfy the SEED goals.
|
||||
Reference in New Issue
Block a user