From 91e9afc3556f5b96314542a9be92eec79103d41c Mon Sep 17 00:00:00 2001 From: Michael Trip Date: Wed, 24 Jun 2026 14:59:41 +0200 Subject: [PATCH 01/12] Add apt-get clean to Dockerfile to reduce image size --- Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Dockerfile b/Dockerfile index e65f657..314e38e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -57,6 +57,7 @@ RUN apt-get update \ openssl \ sudo \ tini \ + && apt-get clean \ && rm -rf /var/lib/apt/lists/* \ && mkdir -p /var/run/sshd /var/lib/k8s-mgmt-pod /etc/ssh/sshd_config.d \ && useradd --create-home --shell /bin/bash admin \ From 0613ebca661185e73ba484360370ae3e8c78a602 Mon Sep 17 00:00:00 2001 From: Michael Trip Date: Wed, 24 Jun 2026 15:00:17 +0200 Subject: [PATCH 02/12] Add apt-get clean to Dockerfile to optimize image size --- Dockerfile | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 314e38e..8fd38ac 100644 --- a/Dockerfile +++ b/Dockerfile @@ -57,7 +57,6 @@ RUN apt-get update \ openssl \ sudo \ tini \ - && apt-get clean \ && rm -rf /var/lib/apt/lists/* \ && mkdir -p /var/run/sshd /var/lib/k8s-mgmt-pod /etc/ssh/sshd_config.d \ && useradd --create-home --shell /bin/bash admin \ @@ -95,7 +94,9 @@ RUN apt-get update \ /tmp/README.md \ /tmp/LICENSE \ /tmp/k9s_Linux_amd64.tar.gz \ - && rm -f /etc/ssh/ssh_host_* + && rm -f /etc/ssh/ssh_host_* \ + && apt-get clean + COPY docker/sshd/10-lfk-base.conf /etc/ssh/sshd_config.d/10-lfk-base.conf COPY docker/nginx/webssh.conf /etc/nginx/conf.d/webssh.conf From 68c6789ac4099a503b1ce2aca874427ac6555075 Mon Sep 17 00:00:00 2001 From: Michael Trip Date: Mon, 29 Jun 2026 08:52:08 +0200 Subject: [PATCH 03/12] Add OIDC login support and unzip utility to Dockerfile --- Dockerfile | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/Dockerfile b/Dockerfile index 8fd38ac..1ccdb90 100644 --- a/Dockerfile +++ b/Dockerfile @@ -30,6 +30,8 @@ ARG KUBECTL_VERSION=1.36.2 ARG HELM_VERSION=3.21.2 # renovate: datasource=github-releases depName=derailed/k9s ARG K9S_VERSION=0.51.0 +# renovate: datasource=github-releases depName=int128/kubelogin +ARG OIDC_LOGIN_VERSION=1.34.0 ENV DEBIAN_FRONTEND=noninteractive \ @@ -49,6 +51,7 @@ RUN apt-get update \ bash-completion \ ca-certificates \ curl \ + unzip \ tar \ nginx-light \ netcat-openbsd \ @@ -81,6 +84,11 @@ RUN apt-get update \ && curl -fsSLo "/tmp/k9s_Linux_amd64.tar.gz" "https://github.com/derailed/k9s/releases/download/v${K9S_VERSION}/k9s_Linux_amd64.tar.gz" \ && tar -xzf "/tmp/k9s_Linux_amd64.tar.gz" -C /tmp \ && install -m 0755 /tmp/k9s /usr/local/bin/k9s \ + && curl -fsSLo "/tmp/kubelogin_linux_amd64.zip" "https://github.com/int128/kubelogin/releases/download/v${OIDC_LOGIN_VERSION}/kubelogin_linux_amd64.zip" \ + && curl -fsSLo "/tmp/kubelogin_linux_amd64.zip.sha256" "https://github.com/int128/kubelogin/releases/download/v${OIDC_LOGIN_VERSION}/kubelogin_linux_amd64.zip.sha256" \ + && sed 's#\*kubelogin_linux_amd64.zip$#*/tmp/kubelogin_linux_amd64.zip#' /tmp/kubelogin_linux_amd64.zip.sha256 | sha256sum -c - \ + && unzip -p /tmp/kubelogin_linux_amd64.zip kubelogin > /usr/local/bin/kubectl-oidc_login \ + && chmod 0755 /usr/local/bin/kubectl-oidc_login \ && mkdir -p /etc/bash_completion.d \ && kubectl completion bash > /etc/bash_completion.d/kubectl \ && helm completion bash > /etc/bash_completion.d/helm \ @@ -93,6 +101,8 @@ RUN apt-get update \ /tmp/k9s \ /tmp/README.md \ /tmp/LICENSE \ + /tmp/kubelogin_linux_amd64.zip \ + /tmp/kubelogin_linux_amd64.zip.sha256 \ /tmp/k9s_Linux_amd64.tar.gz \ && rm -f /etc/ssh/ssh_host_* \ && apt-get clean From b6f7d1e1b7a6256d2668ab902f4bac33b3549200 Mon Sep 17 00:00:00 2001 From: Michael Trip Date: Mon, 29 Jun 2026 09:14:20 +0200 Subject: [PATCH 04/12] Update kubeconfig handling in entrypoint script for better clarity --- README.md | 2 ++ entrypoint.sh | 9 +++++++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 62f3935..20446e9 100644 --- a/README.md +++ b/README.md @@ -71,6 +71,8 @@ The included [docker-compose.yaml](docker-compose.yaml) enables kubeconfig boots That bootstrap is explicitly opt-in and defaults to off in the container itself, so it does not run in Kubernetes unless you deliberately enable it. +When both are available, the bootstrap kubeconfig is applied after the service-account kubeconfig and therefore takes precedence. + Start it with: ```bash diff --git a/entrypoint.sh b/entrypoint.sh index eb5a055..0a2d319 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -291,8 +291,13 @@ EOF prepare_runtime() { mkdir -p /var/run/sshd ensure_host_keys - install_serviceaccount_kubeconfig - install_bootstrap_kubeconfig + if [[ "${ENABLE_BOOTSTRAP_KUBECONFIG}" == "true" ]]; then + log "Kubeconfig mode: bootstrap-only (serviceaccount kubeconfig generation disabled)." + install_bootstrap_kubeconfig + else + log "Kubeconfig mode: in-cluster serviceaccount." + install_serviceaccount_kubeconfig + fi persist_kubernetes_login_env configure_user_auth admin ADMIN_SSH_PUBKEY ADMIN_PASSWORD configure_user_auth user USER_SSH_PUBKEY USER_PASSWORD From 62d68bea0ce890d1b01045d8126acc3f000210be Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 29 Jun 2026 07:24:07 +0000 Subject: [PATCH 05/12] Update dependency janosmiko/lfk to v0.14.18 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 1ccdb90..f9793af 100644 --- a/Dockerfile +++ b/Dockerfile @@ -23,7 +23,7 @@ RUN apt-get update \ FROM debian:trixie-slim # renovate: datasource=github-releases depName=janosmiko/lfk -ARG LFK_VERSION=0.14.15 +ARG LFK_VERSION=0.14.18 # renovate: datasource=github-releases depName=kubernetes/kubernetes ARG KUBECTL_VERSION=1.36.2 # renovate: datasource=github-releases depName=helm/helm From fba15a73c09f71f2b906ee8d9f562f9fe1f45263 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 29 Jun 2026 07:24:11 +0000 Subject: [PATCH 06/12] Update dependency int128/kubelogin to v1.36.2 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 1ccdb90..4e8d067 100644 --- a/Dockerfile +++ b/Dockerfile @@ -31,7 +31,7 @@ ARG HELM_VERSION=3.21.2 # renovate: datasource=github-releases depName=derailed/k9s ARG K9S_VERSION=0.51.0 # renovate: datasource=github-releases depName=int128/kubelogin -ARG OIDC_LOGIN_VERSION=1.34.0 +ARG OIDC_LOGIN_VERSION=1.36.2 ENV DEBIAN_FRONTEND=noninteractive \ From 47fe90296e7658bfa225301705261260542ea6b8 Mon Sep 17 00:00:00 2001 From: Michael Trip Date: Mon, 29 Jun 2026 09:26:47 +0200 Subject: [PATCH 07/12] Create cache directory and set ownership/permissions for kubeconfig --- entrypoint.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/entrypoint.sh b/entrypoint.sh index 0a2d319..0253f38 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -104,6 +104,9 @@ install_kubeconfig_for_user() { local kube_config="${kube_dir}/config" mkdir -p "${kube_dir}" + mkdir -p "${kube_dir}/cache" + chown -R "${username}:${username}" "${kube_dir}" + chmod 0700 "${kube_dir}" install -m 0600 -o "${username}" -g "${username}" "${source_kubeconfig}" "${kube_config}" } From 998012fdff27ba06fdada335f9868841027dce67 Mon Sep 17 00:00:00 2001 From: Michael Trip Date: Mon, 29 Jun 2026 09:42:12 +0200 Subject: [PATCH 08/12] Add locale support and environment variables to Dockerfile --- Dockerfile | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Dockerfile b/Dockerfile index 1ccdb90..0531748 100644 --- a/Dockerfile +++ b/Dockerfile @@ -35,6 +35,9 @@ ARG OIDC_LOGIN_VERSION=1.34.0 ENV DEBIAN_FRONTEND=noninteractive \ + LANG=en_US.UTF-8 \ + LANGUAGE=en_US:en \ + LC_ALL=en_US.UTF-8 \ WEB_SSH_PORT=3000 \ WEBSSH2_LISTEN_PORT=3001 \ WEBSSH2_SSH_HOST=127.0.0.1 \ @@ -51,6 +54,7 @@ RUN apt-get update \ bash-completion \ ca-certificates \ curl \ + locales \ unzip \ tar \ nginx-light \ @@ -93,6 +97,9 @@ RUN apt-get update \ && kubectl completion bash > /etc/bash_completion.d/kubectl \ && helm completion bash > /etc/bash_completion.d/helm \ && chmod 0644 /etc/bash_completion.d/kubectl /etc/bash_completion.d/helm \ + && sed -i 's/^# *en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen \ + && locale-gen en_US.UTF-8 \ + && update-locale LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 \ && rm -f /tmp/kubectl.sha256 \ && rm -rf /tmp/linux-amd64 \ && rm -f \ From e4f9f0667471dfdabf42f90ca9d639c6653640d1 Mon Sep 17 00:00:00 2001 From: Michael Trip Date: Mon, 29 Jun 2026 10:51:20 +0200 Subject: [PATCH 09/12] Fix formatting in the motd file for consistency --- docker/motd | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docker/motd b/docker/motd index 134af58..86ca94f 100644 --- a/docker/motd +++ b/docker/motd @@ -1,13 +1,13 @@ ╔════════════════════════════════════════════════════════════════╗ ║ ║ - ║ ██╗ ███████╗██╗ ██╗ ██╗ ██╗ █████╗ ███████╗ ║ - ║ ██║ ██╔════╝██║ ██╔╝ ██║ ██╔╝██╔══██╗██╔════╝ ║ - ║ ██║ █████╗ █████╔╝ █████╔╝ ╚█████╔╝███████╗ ║ - ║ ██║ ██╔══╝ ██╔═██╗ ██╔═██╗ ██╔══██╗╚════██║ ║ - ║ ███████╗██║ ██║ ██╗ ██║ ██╗╚█████╔╝███████║ ║ - ║ ╚══════╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚════╝ ╚══════╝ ║ - ║ Kubernetes Management Pod - Jump Box ║ + ║ ██╗ ███████╗██╗ ██╗ ██╗ ██╗ █████╗ ███████╗ ║ + ║ ██║ ██╔════╝██║ ██╔╝ ██║ ██╔╝██╔══██╗██╔════╝ ║ + ║ ██║ █████╗ █████╔╝ █████╔╝ ╚█████╔╝███████╗ ║ + ║ ██║ ██╔══╝ ██╔═██╗ ██╔═██╗ ██╔══██╗╚════██║ ║ + ║ ███████╗██║ ██║ ██╗ ██║ ██╗╚█████╔╝███████║ ║ + ║ ╚══════╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚════╝ ╚══════╝ ║ + ║ Kubernetes Management Pod - Jump Box ║ ║ ║ ╠════════════════════════════════════════════════════════════════╣ ║ Toolbelt ║ From d5823119172a7bb51e6be7f5483be57642de4c4b Mon Sep 17 00:00:00 2001 From: Michael Trip Date: Mon, 29 Jun 2026 10:54:20 +0200 Subject: [PATCH 10/12] Update ASCII art in motd for improved branding and consistency --- docker/motd | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docker/motd b/docker/motd index 86ca94f..9a3de0c 100644 --- a/docker/motd +++ b/docker/motd @@ -1,12 +1,12 @@ ╔════════════════════════════════════════════════════════════════╗ ║ ║ - ║ ██╗ ███████╗██╗ ██╗ ██╗ ██╗ █████╗ ███████╗ ║ - ║ ██║ ██╔════╝██║ ██╔╝ ██║ ██╔╝██╔══██╗██╔════╝ ║ - ║ ██║ █████╗ █████╔╝ █████╔╝ ╚█████╔╝███████╗ ║ - ║ ██║ ██╔══╝ ██╔═██╗ ██╔═██╗ ██╔══██╗╚════██║ ║ - ║ ███████╗██║ ██║ ██╗ ██║ ██╗╚█████╔╝███████║ ║ - ║ ╚══════╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚════╝ ╚══════╝ ║ + ║ ║ + ║ _ __ ___ ____ __ __ ____ __ __ _____ ║ + ║ | |/ / / _ \ / ___| | \/ | / ___|| \/ ||_ _| ║ + ║ | ' / | (_) |\___ \ | |\/| || | _ | |\/| | | | ║ + ║ | . \ \__, | ___) | | | | || |_| || | | | | | ║ + ║ |_|\_\ /_/ |____/ |_| |_| \____||_| |_| |_| ║ ║ Kubernetes Management Pod - Jump Box ║ ║ ║ ╠════════════════════════════════════════════════════════════════╣ From df0eaf0a218dd2141e0d35dc6d31f77bb1411ca5 Mon Sep 17 00:00:00 2001 From: Michael Trip Date: Mon, 29 Jun 2026 13:40:34 +0200 Subject: [PATCH 11/12] Add kubectx and kubens support to Dockerfile and bash completion scripts --- Dockerfile | 12 +++++++++++- README.md | 4 +++- docker/motd | 2 +- docker/profile/20-k8s-tools-completion.sh | 8 ++++++++ 4 files changed, 23 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index c21f111..481e097 100644 --- a/Dockerfile +++ b/Dockerfile @@ -32,6 +32,8 @@ ARG HELM_VERSION=3.21.2 ARG K9S_VERSION=0.51.0 # renovate: datasource=github-releases depName=int128/kubelogin ARG OIDC_LOGIN_VERSION=1.36.2 +# renovate: datasource=github-tags depName=ahmetb/kubectx +ARG KUBECTX_VERSION=0.9.5 ENV DEBIAN_FRONTEND=noninteractive \ @@ -54,9 +56,12 @@ RUN apt-get update \ bash-completion \ ca-certificates \ curl \ + jq \ locales \ unzip \ tar \ + vim \ + yq \ nginx-light \ netcat-openbsd \ openssh-client \ @@ -93,10 +98,15 @@ RUN apt-get update \ && sed 's#\*kubelogin_linux_amd64.zip$#*/tmp/kubelogin_linux_amd64.zip#' /tmp/kubelogin_linux_amd64.zip.sha256 | sha256sum -c - \ && unzip -p /tmp/kubelogin_linux_amd64.zip kubelogin > /usr/local/bin/kubectl-oidc_login \ && chmod 0755 /usr/local/bin/kubectl-oidc_login \ + && curl -fsSLo /usr/local/bin/kubectx "https://raw.githubusercontent.com/ahmetb/kubectx/v${KUBECTX_VERSION}/kubectx" \ + && curl -fsSLo /usr/local/bin/kubens "https://raw.githubusercontent.com/ahmetb/kubectx/v${KUBECTX_VERSION}/kubens" \ + && chmod 0755 /usr/local/bin/kubectx /usr/local/bin/kubens \ && mkdir -p /etc/bash_completion.d \ + && curl -fsSLo /etc/bash_completion.d/kubectx "https://raw.githubusercontent.com/ahmetb/kubectx/v${KUBECTX_VERSION}/completion/kubectx.bash" \ + && curl -fsSLo /etc/bash_completion.d/kubens "https://raw.githubusercontent.com/ahmetb/kubectx/v${KUBECTX_VERSION}/completion/kubens.bash" \ && kubectl completion bash > /etc/bash_completion.d/kubectl \ && helm completion bash > /etc/bash_completion.d/helm \ - && chmod 0644 /etc/bash_completion.d/kubectl /etc/bash_completion.d/helm \ + && chmod 0644 /etc/bash_completion.d/kubectl /etc/bash_completion.d/helm /etc/bash_completion.d/kubectx /etc/bash_completion.d/kubens \ && sed -i 's/^# *en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen \ && locale-gen en_US.UTF-8 \ && update-locale LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 \ diff --git a/README.md b/README.md index 20446e9..ca220cc 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,9 @@ - `kubectl` preinstalled from a pinned upstream binary release - `helm` preinstalled from a pinned upstream binary release - `k9s` preinstalled from a pinned GitHub release tarball -- `kubectl` and `helm` bash autocompletion enabled for both `admin` and `user` +- `kubectx` and `kubens` preinstalled from a pinned upstream release +- `jq`, `yq`, and `vim` preinstalled from Debian packages +- `kubectl`, `helm`, `kubectx`, and `kubens` bash autocompletion enabled for both `admin` and `user` - local `openssh-server` on port `2222` - a browser-based SSH client on port `3000` - a custom ASCII-art MOTD on login diff --git a/docker/motd b/docker/motd index 9a3de0c..859b382 100644 --- a/docker/motd +++ b/docker/motd @@ -15,7 +15,7 @@ ║ - lfk : LFK kubernetes management ║ ║ - k9s : interactive cluster navigation ║ ║ - helm : chart install, upgrade, and rollback ║ - ║ - plus : kubectx, kubens, jq, yq, and more ║ + ║ - plus : kubectx, kubens, jq, yq, vim, and more ║ ║ ║ ╠════════════════════════════════════════════════════════════════╣ ║ Quick start ║ diff --git a/docker/profile/20-k8s-tools-completion.sh b/docker/profile/20-k8s-tools-completion.sh index b9092e6..5cb4a72 100644 --- a/docker/profile/20-k8s-tools-completion.sh +++ b/docker/profile/20-k8s-tools-completion.sh @@ -13,6 +13,14 @@ if [ -n "${BASH_VERSION:-}" ]; then if [ -r /etc/bash_completion.d/helm ]; then . /etc/bash_completion.d/helm fi + + if [ -r /etc/bash_completion.d/kubectx ]; then + . /etc/bash_completion.d/kubectx + fi + + if [ -r /etc/bash_completion.d/kubens ]; then + . /etc/bash_completion.d/kubens + fi fi alias k=kubectl From 9408691f86c617c0b5e35e59b26fc3ac363ffa86 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 29 Jun 2026 12:24:06 +0000 Subject: [PATCH 12/12] Update docker/build-push-action action to v7 --- .github/workflows/build-workflow.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-workflow.yaml b/.github/workflows/build-workflow.yaml index 3036ab7..81bd394 100644 --- a/.github/workflows/build-workflow.yaml +++ b/.github/workflows/build-workflow.yaml @@ -106,7 +106,7 @@ jobs: - name: Build and push id: build - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . file: ./Dockerfile