houstonj1/cdk repository overview

⁠houstonj1/cdk

AWS CDK and cdk8s on a Node LTS base (Debian slim), bundled with AWS CLI v2 — a ready made image for synthesizing and deploying infrastructure-as-code from CI or your shell. TypeScript/JavaScript only: no Python, no cdktf.

The design goal is freshness. Rather than pinning versions, aws-cdk and cdk8s-cli are installed from npm @latest and the image is rebuilt weekly, so latest always tracks the latest stable toolchain. Security comes from frequent rebuilds (fresh tool + base patches) gated by container scanning, not from pinning.

⁠Tags

Platforms: linux/amd64, linux/arm64.

⁠Usage

docker run --rm -it houstonj1/cdk cdk --version
docker run --rm -it houstonj1/cdk:22-slim node --version

# Synth a project mounted from the host
docker run --rm -it -v "$PWD":/app houstonj1/cdk cdk synth

The image runs as the non-root node user with WORKDIR /app. Corepack is available but not enabled by default — run corepack enable if you need pnpm/yarn shims.

⁠What's inside

• Node LTS (22 / 24) on debian:bookworm-slim
• aws-cdk (latest stable, from npm)
• cdk8s-cli (latest stable, from npm)
• AWS CLI v2 (architecture-aware, checksum-verified install)

⁠Security posture

• Latest-stable, not pinned — tools install from npm @latest, rebuilt weekly.
• Patched slim base — apt-get upgrade applied at build, --no-install-recommends, cleaned apt lists, multi-stage build so build tooling never ships.
• Hardened — runs non-root, setuid/setgid bits stripped, OCI labels, and default builds carry SBOM + provenance attestations.
• Scanned — every published image is gated by container scanning.