karlender/bezalel repository overview

⁠Bezalel 🔨 — The NetDevOps & CI/CD Toolbox

https://github.com/lucas-weiselowski/bezalel.git⁠

Bezalel is the master artisan. In this repository, it represents the ultimate NetDevOps container toolbox. This image gives you the power and tools to build, automate, and craft robust network infrastructure.

Vendor-agnostic network automation container built for speed, consistency, and scale. Named after the master artisan — the non-root user is artisan, the workshop is /forge.

Bezalel eliminates the "works on my machine" problem: one pre-configured, multi-arch (amd64/arm64) environment for Python scripts, Ansible playbooks, OpenTofu deployments and automated network tests — in GitLab/GitHub CI pipelines or ephemerally on your laptop.

⁠🚀 Image Variants

Both flavors ship uv, OpenTofu (tofu) and gnmic binaries, plus git, ssh and curl. Python environment is uv-managed and locked (uv.lock).

⁠🛠️ Ecosystem & Protocols

* full image only (plus Nornir, NAPALM, rich, yamllint).

⁠✨ Key Features

• Arbitrary-UID safe — run with -u $(id -u):$(id -g); generated files belong to you, not root. Works on OpenShift and GitLab runners with random UIDs (entrypoint self-registers unknown UIDs in /etc/passwd).
• Auto .env discovery — entrypoint sources /forge/.env when present; python-dotenv is preinstalled for your own scripts.
• Dedicated workspace — /forge, non-root user artisan, TZ=Europe/Berlin.

⁠💻 Quick Start (local)

Add to ~/.bashrc / ~/.zshrc:

# Bezalel – ephemeral network automation toolbox
bezalel() {
    local args=(--rm -it --hostname forge -u "$(id -u):$(id -g)" --group-add 0 -v "${PWD}:/forge")
    # global defaults first, project-local .env second (wins on conflict)
    [[ -f "${HOME}/.bezalel.env" ]] && args+=(--env-file "${HOME}/.bezalel.env")
    [[ -f "${PWD}/.env" ]]          && args+=(--env-file "${PWD}/.env")
    docker run "${args[@]}" "${BEZALEL_IMAGE:-karlender/bezalel:full}" "$@"
}

bezalel                                      # interactive shell in /forge
bezalel ansible-playbook deploy_fabric.yml
bezalel python gather_facts.py
bezalel gnmic -a router1:57400 capabilities
bezalel tofu plan
BEZALEL_IMAGE=karlender/bezalel:slim bezalel pytest tests/

⁠🔄 CI Usage

# GitLab CI
deploy_network:
  image: karlender/bezalel:slim
  script:
    - tofu init
    - tofu apply -auto-approve
    - pytest tests/test_reachability.py

# GitHub Actions
jobs:
  lint:
    runs-on: ubuntu-latest
    container: karlender/bezalel:slim
    steps:
      - uses: actions/checkout@v4
      - run: ansible-playbook --syntax-check site.yml

⁠🏗️ Building

docker build --target runtime-slim -t karlender/bezalel:slim .
docker build --target runtime-full -t karlender/bezalel:full .

Pin tool versions: --build-arg TOFU_VERSION=1.12.3 --build-arg GNMIC_VERSION=0.46.0 --build-arg UV_VERSION=0.7.12.

Releases are automated: pushing a vX.Y.Z tag triggers the GitHub Actions workflow which builds multi-arch images, scans them with Trivy and pushes slim, full, latest, X.Y.Z, X.Y.Z-slim, X.Y.Z-full to Docker Hub.

⁠🔐 .env Handling

1. bezalel() function passes ~/.bezalel.env and ./.env via --env-file.
2. entrypoint.sh sources /forge/.env — covers CI and plain docker run.
3. python-dotenv — your scripts can load_dotenv().

Never bake credentials into the image; .env stays in .gitignore.

⁠License

MIT⁠