Languages and the rest of the toolchain
Nothing decorative, nothing you will not reach for eventually.
| Tool | What it is for |
|---|---|
| Node.js 22 | Current LTS-track Node, plus npm, for every JavaScript or TypeScript workload. |
Python 3, pip, uv | python is python3. pip install works system-wide for both dev and root; Debian's EXTERNALLY-MANAGED marker is removed so the interpreter does not refuse member installs. uv is there too when you want it. |
| Go 1.27 | The official toolchain at /usr/local/go, baked into the image. |
Rust (stable, via rustup) | rustc and cargo, installed system-wide (/usr/local/rustup, /usr/local/cargo) rather than per-user, so both dev and root see the identical toolchain; still yours to manage with rustup from either. |
| Swift 6.3 | The official Debian 12 build from swift.org, GPG-signature-verified at image build time before it is ever extracted. |
Nim (stable, via choosenim) | Installed to a shared location (/opt/nim) rather than a single user's home, for the same reason as Rust. |
git, openssh-client | Clone, push, pull, and SSH out to anything you already have keys for. |
curl, jq | Talk to any HTTP API and actually parse what comes back. |
ripgrep | The fast, correct way to search a codebase, wired into vim's own finder too. |
ffmpeg | Audio and video, in case a task ever needs it. |
dig, whois, mtr, traceroute, ping, nc, tcpdump, iproute2, net-tools, lynx | A full network diagnostics kit, for when something is unreachable and you need to know why. |
htop, strace, lsof, ncdu | The everyday process, syscall, open-file, and disk-usage tools; ncdu in particular earns its place given the real 2 GB disk quota every workspace has. |
rsync, tree, tig, ab (apache2-utils) | File sync, directory visualization, a text-mode git browser, and HTTP load testing, respectively. |
fzf, build-essential, bash-completion | The real fzf binary the bundled tmux-fzf plugin actually needs to function, a full C/C++ toolchain, and shell tab-completion. |
rzf | A fast terminal file explorer, built from source at image build time; see the multiplexing section for its prefix f shortcut. |
gitserve.py | A dependency-free git HTTP server on PATH as an executable. Serve a repo with gitserve.py --init --source .. |
tmux-shot | Drive a TUI inside tmux from Python and capture PNG screenshots of it. Installed globally via python -m pip. |
stealthii | An aiohttp/httpx-shaped HTTP client backed by a stealth-patched Chromium. Installed globally via python3 -m pip, with Playwright's Chromium at /opt/playwright-browsers. |
sudo works, with no password, the moment you need to
apt install something this list does not cover, and the
package index is already warm (this image ends its own build with a
plain apt update) so that first install does not need a
ritual. It gets you real root inside your own container; it does not get
you off it. See the persistence section for what that boundary actually
means.