#33 - Add the Google Cloud CLI and Terraform to every variant #34

Merged

GuillaumeHemmen merged 1 commit from 33-add-gcloud-terraform into master

2026-10-23 10:22:09 +00:00

claude-bot commented

2026-10-23 09:35:15 +00:00

Member

What

Every variant now ships the Google Cloud CLI (gcloud, gsutil, bq) and Terraform, installed from Google's and HashiCorp's official APT repos.

Why

See #33. Neither tool was in any variant. The desktop variant is built FROM coder, which is built FROM base, and ci is built FROM base, so the shared base stage is the one place that reaches both ci and the desktop. The headless coder variant gets them as well.

Changes

Dockerfile (base stage): one new RUN step after the Kubernetes QA tools:
- fetches both signing keys into /etc/apt/keyrings and asserts their fingerprints before trusting them: Google 35BAA0B3…DC6315A3, HashiCorp D55C0D1A…CA026560 (the key HashiCorp rotated to in 2026-09);
- writes google-cloud-sdk.list and hashicorp.list; the HashiCorp suite comes from /etc/os-release instead of a hard-coded noble;
- installs google-cloud-cli and terraform, then runs gcloud --version and terraform version so a broken install fails the build.
README.md: ci feature list and use case, and a Version Information entry, including how to add gcloud components with apt-get, since gcloud components install is disabled for APT installs.

Things to weigh in review

Image size: +437 MB on every variant, measured with df around the real step. Most of it is the Python runtime bundled with google-cloud-cli.
Unpinned versions: each build takes the current release of both, like the other APT-sourced tools. If you'd rather pin Terraform for reproducible CI runs, it's a one-line terraform=<version>-1.

Verification

Check	Result
Both repos' `InRelease` checked with `gpgv` against the pinned keys	`Good signature` from both
New `RUN` step, extracted from the Dockerfile, run as root in a throwaway pod from `ci-latest`	exit 0 in 34 s, no `W:`/`E:` lines; `google-cloud-cli 590.0.0`, `terraform 1.17.0`
`command -v gcloud terraform` before the step	nothing found
Both tools as a non-root user	`gcloud config list` and `terraform -help` run
`gcloud components install kubectl`	refused, component manager disabled (matches the README)
`google-cloud-cli-gke-gcloud-auth-plugin`	available from the new repo (`590.0.0-0`)

The test pod is deleted. Not verified: the full kaniko builds, which the branch push has started in docker-dev; arm64.

Closes #33

🤖 Generated with Claude Code

https://claude.ai/code/session_01DXCqoaBNpoW7PszVNNbjZh

## What Every variant now ships the **Google Cloud CLI** (`gcloud`, `gsutil`, `bq`) and **Terraform**, installed from Google's and HashiCorp's official APT repos. ## Why See #33. Neither tool was in any variant. The desktop variant is built `FROM coder`, which is built `FROM base`, and `ci` is built `FROM base`, so the shared `base` stage is the one place that reaches both `ci` and the desktop. The headless `coder` variant gets them as well. ## Changes - **`Dockerfile` (`base` stage):** one new `RUN` step after the Kubernetes QA tools: - fetches both signing keys into `/etc/apt/keyrings` and asserts their fingerprints before trusting them: Google `35BAA0B3…DC6315A3`, HashiCorp `D55C0D1A…CA026560` (the key HashiCorp rotated to in 2026-09); - writes `google-cloud-sdk.list` and `hashicorp.list`; the HashiCorp suite comes from `/etc/os-release` instead of a hard-coded `noble`; - installs `google-cloud-cli` and `terraform`, then runs `gcloud --version` and `terraform version` so a broken install fails the build. - **`README.md`:** `ci` feature list and use case, and a Version Information entry, including how to add gcloud components with `apt-get`, since `gcloud components install` is disabled for APT installs. ## Things to weigh in review - **Image size: +437 MB** on every variant, measured with `df` around the real step. Most of it is the Python runtime bundled with `google-cloud-cli`. - **Unpinned versions:** each build takes the current release of both, like the other APT-sourced tools. If you'd rather pin Terraform for reproducible CI runs, it's a one-line `terraform=<version>-1`. ## Verification | Check | Result | |---|---| | Both repos' `InRelease` checked with `gpgv` against the pinned keys | `Good signature` from both | | New `RUN` step, extracted from the Dockerfile, run as root in a throwaway pod from `ci-latest` | **exit 0 in 34 s**, no `W:`/`E:` lines; `google-cloud-cli 590.0.0`, `terraform 1.17.0` | | `command -v gcloud terraform` before the step | nothing found | | Both tools as a non-root user | `gcloud config list` and `terraform -help` run | | `gcloud components install kubectl` | refused, component manager disabled (matches the README) | | `google-cloud-cli-gke-gcloud-auth-plugin` | available from the new repo (`590.0.0-0`) | The test pod is deleted. **Not verified:** the full kaniko builds, which the branch push has started in `docker-dev`; arm64. Closes #33 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01DXCqoaBNpoW7PszVNNbjZh

claude-bot added 1 commit

2026-10-23 09:35:15 +00:00

#33 - Add the Google Cloud CLI and Terraform to every variant

/ docker-dev-ci (push) Successful in 5m31s

Details

/ docker-dev-coder (push) Successful in 5m55s

Details

/ docker-dev-coder-xfce-vnc (push) Successful in 20m49s

Details

d278c2b857

Install google-cloud-cli and terraform from Google's and HashiCorp's
official APT repos in the base stage, so the ci image and both workspace
variants ship gcloud, gsutil, bq and terraform. Both signing-key
fingerprints are asserted before the keys are trusted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DXCqoaBNpoW7PszVNNbjZh