nnthanh101/runbooks repository overview

⁠nnthanh101/runbooks — Enterprise CloudOps DevContainer

Enterprise CloudOps automation runtime for teams running AWS/Azure automation, AI agent workflows, Jupyter notebooks, and data analytics — all from a single supply-chain-hardened image family.

⁠Executive Summary

nnthanh101/runbooks is a Chainguard Wolfi-based container family for CloudOps automation, Jupyter analytics, and AI agent workflows. All variants share one non-root, supply-chain-hardened base — only the toolset changes. For Command-Center: pull :prod; for DevContainer or CI: pull :full.

⁠Quick Start

# Command-Center production (JupyterLab + runbooks + Vizro)
docker pull nnthanh101/runbooks:prod
docker run -it --rm -p 8888:8888 \
  -v ~/.aws:/home/os/.aws:ro \
  -v $(pwd):/app/notebooks \
  nnthanh101/runbooks:prod

# Full devcontainer (all features)
docker pull nnthanh101/runbooks:full
docker run -it --rm \
  -v ~/.aws:/home/os/.aws:ro \
  -e ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY \
  nnthanh101/runbooks:full

# VS Code DevContainer
# F1 → "Dev Containers: Reopen in Container"

# PyPI package (the runbooks CLI tool)
pip install runbooks
runbooks --help

⁠5W1H

⁠Image Variants

⁠Choosing the right tag

• Command-Center notebooks/dashboards → prod (JupyterLab + Vizro + runbooks PyPI, minimal size)
• AWS/Azure automation scripts → full (boto3 + AWS CLI v2 + Azure CLI included)
• Lightweight CI steps → core (Python + UV, no extras)
• Full devcontainer or local act runner → full (all tools, Node.js, act-compatible)

⁠Business Value

⁠Speed to Production

⁠Cost Optimization

• Right-size per workload: core (~500MB) for scripting, prod (~500MB) for notebooks, full (~1.5GB) for all-in-one
• Multi-arch: linux/amd64 + linux/arm64 — AWS Graviton spot instances for cost-sensitive batch
• Air-gap ready: Mirror once to ECR/ACR — no runtime Docker Hub dependency
• UV package manager: 10-100× faster dependency installs vs pip — measurable CI time savings at scale

⁠Risk Reduction

• Supply chain hardening: Chainguard Wolfi base, sigstore-signed — SHA256-pinned in versions.env
• Non-root by default: os user (UID 11111) — no privileged container risk
• No credentials in image: API keys via environment variables only
• Audit trail: Every release is git-tagged and CI-built — reproducible artifact traceable to commit

⁠GH Actions CI Job

jobs:
  automate:
    runs-on: ubuntu-latest
    container:
      image: nnthanh101/runbooks:full
      options: --user 0
    steps:
      - uses: actions/checkout@v4
      - run: python scripts/aws-automation.py

⁠What's Inside

⁠Exposed Ports

⁠Security Architecture

• Base: cgr.dev/chainguard/wolfi-base — sigstore-signed, minimal CVE surface
• Base SHA256: Pinned in RUNBOOKS_BASE_IMAGE in versions.env
• User: Non-root os (UID 11111) across all tags
• Dependencies: uv lockfile (uv.lock) for deterministic builds
• Scanning: Trivy on every CI release per tag, SARIF uploaded to GitHub Security tab

⁠CI/CD Pipeline

Validate → Build 3 tags (amd64+arm64) → Scan (Trivy) → Test → Push → GitHub Security (SARIF)

⁠Air-Gap Deployment

Mirror to ECR/ACR and reference by digest — no runtime Docker Hub dependency.

⁠Links

• ADLC Framework⁠
• Chainguard Wolfi⁠
• License: Apache 2.0