feat: Update toolbox-base and template with latest Docker configurations and documentation

\n- Updated Dockerfiles in both toolbox-base and toolbox-template - Modified build scripts and docker-compose configurations - Added new audit tools and documentation files - Created new toolbox-DocStack and toolbox-QADocker implementations - Updated README and maintenance documentation
2025-10-31 12:46:36 -05:00
parent 48530814d5
commit ab57e3a3a1
92 changed files with 4610 additions and 190 deletions
--- a/ToolboxStack/output/toolbox-base/Dockerfile.backup.pre-security-redesign
+++ b/ToolboxStack/output/toolbox-base/Dockerfile.backup.pre-security-redesign
@@ -0,0 +1,182 @@
+FROM ubuntu:24.04
+
+ARG USER_ID=1000
+ARG GROUP_ID=1000
+ARG USERNAME=toolbox
+ARG TEA_VERSION=0.11.1
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Install base packages with proper caching
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+    apt-get update \
+    && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        fish \
+        fzf \
+        git \
+        jq \
+        bc \
+        htop \
+        btop \
+        locales \
+        openssh-client \
+        ripgrep \
+        tmux \
+        screen \
+        entr \
+        fd-find \
+        bat \
+        httpie \
+        build-essential \
+        pkg-config \
+        libssl-dev \
+        zlib1g-dev \
+        libffi-dev \
+        libsqlite3-dev \
+        libreadline-dev \
+        wget \
+        zsh \
+        # Additional packages for better tool support
+        unzip \
+        zip \
+        gnupg \
+        software-properties-common \
+        apt-transport-https \
+        ca-certificates \
+        curl \
+        gnupg-agent \
+        software-properties-common \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+# Provide common aliases for fd and bat binaries
+RUN ln -sf /usr/bin/fdfind /usr/local/bin/fd \
+    && ln -sf /usr/bin/batcat /usr/local/bin/bat
+
+# Install Gitea tea CLI
+RUN curl -fsSL "https://dl.gitea.io/tea/${TEA_VERSION}/tea-${TEA_VERSION}-linux-amd64" -o /tmp/tea \
+    && curl -fsSL "https://dl.gitea.io/tea/${TEA_VERSION}/tea-${TEA_VERSION}-linux-amd64.sha256" -o /tmp/tea.sha256 \
+    && sed -n 's/ .*//p' /tmp/tea.sha256 | awk '{print $1 "  /tmp/tea"}' | sha256sum -c - \
+    && install -m 0755 /tmp/tea /usr/local/bin/tea \
+    && rm -f /tmp/tea /tmp/tea.sha256
+
+# Configure locale to ensure consistent tool behavior
+RUN locale-gen en_US.UTF-8
+ENV LANG=en_US.UTF-8 \
+    LANGUAGE=en_US:en \
+    LC_ALL=en_US.UTF-8
+
+# Install Starship prompt
+RUN curl -fsSL https://starship.rs/install.sh | sh -s -- -y -b /usr/local/bin
+
+# Install aqua package manager (manages additional CLI tooling)
+RUN curl -sSfL https://raw.githubusercontent.com/aquaproj/aqua-installer/v2.3.1/aqua-installer | AQUA_ROOT_DIR=/usr/local/share/aquaproj-aqua bash \
+    && ln -sf /usr/local/share/aquaproj-aqua/bin/aqua /usr/local/bin/aqua
+
+# Install system dependencies needed for mise and potential build tools
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+    apt-get update \
+    && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        build-essential \
+        pkg-config \
+        libssl-dev \
+        zlib1g-dev \
+        libffi-dev \
+        libsqlite3-dev \
+        libreadline-dev \
+        # Only install non-Node.js dependencies via apt-get
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install mise for runtime management
+RUN curl -sSfL https://mise.jdx.dev/install.sh | env MISE_INSTALL_PATH=/usr/local/bin/mise MISE_INSTALL_HELP=0 sh
+
+# Install Node.js runtime via mise and set globally (only once)
+RUN mise install node@22.13.0 && mise global node@22.13.0
+
+# Create non-root user with matching UID/GID for host mapping
+RUN if getent passwd "${USER_ID}" >/dev/null; then \
+        existing_user="$(getent passwd "${USER_ID}" | cut -d: -f1)"; \
+        userdel --remove "${existing_user}"; \
+    fi \
+    && if ! getent group "${GROUP_ID}" >/dev/null; then \
+        groupadd --gid "${GROUP_ID}" "${USERNAME}"; \
+    fi \
+    && useradd --uid "${USER_ID}" --gid "${GROUP_ID}" --shell /usr/bin/zsh --create-home "${USERNAME}"
+
+# Install Oh My Zsh and configure shells for the unprivileged user
+RUN su - "${USERNAME}" -c 'git clone --depth=1 https://github.com/ohmyzsh/ohmyzsh.git ~/.oh-my-zsh' \
+    && su - "${USERNAME}" -c 'cp ~/.oh-my-zsh/templates/zshrc.zsh-template ~/.zshrc' \
+    && su - "${USERNAME}" -c 'mkdir -p ~/.config' \
+    && su - "${USERNAME}" -c 'sed -i "s/^plugins=(git)$/plugins=(git fzf)/" ~/.zshrc' \
+    && su - "${USERNAME}" -c 'printf "\nexport PATH=\"\$HOME/.local/share/aquaproj-aqua/bin:\$HOME/.local/share/mise/shims:\$HOME/.local/bin:\$PATH\"\n" >> ~/.zshrc' \
+    && su - "${USERNAME}" -c 'printf "\nexport AQUA_GLOBAL_CONFIG=\"\$HOME/.config/aquaproj-aqua/aqua.yaml\"\n" >> ~/.zshrc' \
+    && su - "${USERNAME}" -c 'printf "\n# Starship prompt\neval \"\$(starship init zsh)\"\n" >> ~/.zshrc' \
+    && su - "${USERNAME}" -c 'printf "\n# mise runtime manager\neval \"\$(mise activate zsh)\"\n" >> ~/.zshrc' \
+    && su - "${USERNAME}" -c 'printf "\n# direnv\nexport DIRENV_LOG_FORMAT=\"\"\neval \"\$(direnv hook zsh)\"\n" >> ~/.zshrc' \
+    && su - "${USERNAME}" -c 'printf "\n# zoxide\neval \"\$(zoxide init zsh)\"\n" >> ~/.zshrc' \
+    && su - "${USERNAME}" -c 'printf "\nexport AQUA_GLOBAL_CONFIG=\"\$HOME/.config/aquaproj-aqua/aqua.yaml\"\n" >> ~/.bashrc' \
+    && su - "${USERNAME}" -c 'printf "\n# mise runtime manager (bash)\neval \"\$(mise activate bash)\"\n" >> ~/.bashrc' \
+    && su - "${USERNAME}" -c 'printf "\n# direnv\nexport DIRENV_LOG_FORMAT=\"\"\neval \"\$(direnv hook bash)\"\n" >> ~/.bashrc' \
+    && su - "${USERNAME}" -c 'printf "\n# zoxide\neval \"\$(zoxide init bash)\"\n" >> ~/.bashrc' \
+    && su - "${USERNAME}" -c 'mkdir -p ~/.config/fish' \
+    && su - "${USERNAME}" -c 'printf "\nset -gx AQUA_GLOBAL_CONFIG \$HOME/.config/aquaproj-aqua/aqua.yaml\n# Shell prompt and runtime manager\nstarship init fish | source\nmise activate fish | source\ndirenv hook fish | source\nzoxide init fish | source\n" >> ~/.config/fish/config.fish'
+
+# Ensure toolbox user has access to Node.js runtime from mise
+RUN su - "${USERNAME}" -c 'mise use -g node@22.13.0'
+
+COPY aqua.yaml /tmp/aqua.yaml
+
+# Install aqua packages at both root and user level to ensure they're baked into the image
+RUN chown "${USER_ID}:${GROUP_ID}" /tmp/aqua.yaml \
+    && su - "${USERNAME}" -c 'mkdir -p ~/.config/aquaproj-aqua' \
+    && su - "${USERNAME}" -c 'cp /tmp/aqua.yaml ~/.config/aquaproj-aqua/aqua.yaml' \
+    && AQUA_GLOBAL_CONFIG=/tmp/aqua.yaml aqua install \
+    && su - "${USERNAME}" -c 'AQUA_GLOBAL_CONFIG=~/.config/aquaproj-aqua/aqua.yaml aqua install'
+
+# Install all AI CLI tools in one npm command to optimize layers
+RUN mise exec -- npm install -g \
+    @just-every/code@0.4.6 \
+    @qwen-code/qwen-code@0.1.1 \
+    @google/gemini-cli@0.11.0 \
+    @openai/codex@0.50.0 \
+    opencode-ai@0.15.29 && \
+    mise reshim
+
+# Install the same AI CLI tools for the toolbox user so they are available in the container runtime
+RUN su - "${USERNAME}" -c 'mise exec -- npm install -g @just-every/code@0.4.6 @qwen-code/qwen-code@0.1.1 @google/gemini-cli@0.11.0 @openai/codex@0.50.0 opencode-ai@0.15.29' && \
+    # Ensure mise shims are properly generated for the installed tools
+    su - "${USERNAME}" -c 'mise reshim'
+
+# Install BATS for testing framework
+RUN git clone https://github.com/bats-core/bats-core.git /tmp/bats-core \
+    && cd /tmp/bats-core \
+    && git checkout v1.11.0 \
+    && ./install.sh /usr/local \
+    && rm -rf /tmp/bats-core
+
+# Install additional testing tools
+# Using mise exec to ensure npm is available in the PATH
+RUN mise exec -- npm install -g bats@1.11.0
+
+# Prepare workspace directory with appropriate ownership
+RUN mkdir -p /workspace \
+    && chown "${USER_ID}:${GROUP_ID}" /workspace
+
+# Remove sudo to ensure no root escalation is possible at runtime (if installed)
+RUN apt-get remove -y sudo 2>/dev/null || true && apt-get autoremove -y 2>/dev/null || true && rm -rf /var/lib/apt/lists/* 2>/dev/null || true
+
+ENV SHELL=/usr/bin/zsh \
+    AQUA_GLOBAL_CONFIG=/home/${USERNAME}/.config/aquaproj-aqua/aqua.yaml \
+    PATH=/home/${USERNAME}/.local/share/aquaproj-aqua/bin:/home/${USERNAME}/.local/share/mise/shims:/home/${USERNAME}/.local/bin:${PATH}
+
+WORKDIR /workspace
+USER ${USERNAME}
+
+CMD ["/usr/bin/zsh"]