Kosmos is a comprehensive Docker-based development environment designed for modern cross-platform engineering. It provides a ready-to-use stack for Android, Java/Kotlin, Rust, and Web Automation, ensuring consistency across development and CI/CD pipelines.
- Overview
- Core Features
- Quick Start
- Environment Reference
- Build Configuration
- Project Structure
- Contributing
- License & Ethics
Developing across multiple ecosystems like Android, JVM, and Rust can be challenging due to complex toolchain dependencies. Kosmos eliminates this "works on my machine" syndrome by:
- Standardizing the Toolchain: Provides pre-configured versions of JDK, Android SDK, and Gradle.
- Integrating Native Support: Full Rust toolchain inclusion for native development and cross-compilation.
- Automating Web Testing: Pre-installed Headless Chrome for robust web automation and integration testing.
- Ensuring Security: Designed with non-root user execution as a default for improved container security.
Kosmos comes with a full Android SDK stack optimized for modern builds:
- Android SDK: Pre-installed Platform version 36.
- Build Tools: Version 36.1.0 included by default.
- Command-Line Tools: Includes
sdkmanager,platform-tools, andcmdline-toolsfor automated management.
Built on top of industry-standard runtimes:
- Eclipse Temurin JDK 17: High-performance, open-source Java distribution.
- Gradle 9.7.0: Optimized build system for JVM and Android projects.
- Ready for Kotlin: Fully compatible with Kotlin Multiplatform and JVM targets.
Seamless integration for native systems programming:
- Rustup & Cargo: Full access to the Rust ecosystem.
- Native Interop: Ideal for projects using JNI or Rust-based Kotlin Multiplatform components.
- Cross-Compilation: Ready for building native binaries within the container.
Headless browser support for modern web workflows:
- Google Chrome: Pre-installed for headless execution.
- Automation Ready: Compatible with Selenium, Playwright, and Puppeteer.
- System Binaries: Environment variable
CHROME_BINis pre-configured for easy tool discovery.
Full documentation is published to davils-com.github.io/kosmos
(built from docs/ with Writerside). It covers the variants, build configuration, security and
provenance, CI integration, and maintenance.
Kosmos is a multi-stage image with several build targets, so a CI job pulls only the toolchain
it actually needs instead of the whole multi-GB stack. The plain (prefix-less) tag always points
at full, so existing kosmos:<version> references keep resolving to the everything-image.
| Variant | Tag pattern | Contains | Typical use |
|---|---|---|---|
base |
:base-<ver> |
JDK 17, Gradle, Trivy, git | Plain Kotlin/JVM builds |
native |
:native-<ver> |
base + CMake, build-essential, Rust/Cargo |
JNI / C-interop (e.g. Kreate) |
android |
:android-<ver> |
base + Android SDK |
Android builds |
chrome |
:chrome-<ver> |
base + headless Chrome |
Web/UI automation |
full |
:<ver>, :latest |
native + Android SDK + Chrome |
Everything (default) |
Each variant is published as :<variant>-<version>, :<variant>-<major.minor> and
:<variant>-latest.
# Smallest image that can run a JNI/native Kotlin build:
docker pull ghcr.io/davils-com/kosmos:native-1.1
# The full everything-image:
docker pull ghcr.io/davils-com/kosmos:1.1All variants are defined in docker-bake.hcl:
docker buildx bake native # one variant
docker buildx bake # every variant
docker build --target native -t kosmos-native . # or a plain targeted buildRun an interactive shell inside the environment, mounting your current directory:
docker run -it --rm -v $(pwd):/app ghcr.io/davils-com/kosmos:native-1.1| Variable | Path | Description |
|---|---|---|
ANDROID_SDK_ROOT |
/sdk |
Root directory for Android SDK tools and platforms |
GRADLE_HOME |
/opt/gradle/gradle-9.7.0 |
Location of the Gradle installation |
CHROME_BIN |
/usr/bin/google-chrome |
Path to the Google Chrome binary |
CARGO_HOME |
/usr/local/cargo |
Storage for Rust Cargo binaries and packages |
RUSTUP_HOME |
/usr/local/rustup |
Directory for Rust toolchains and metadata |
Note: The system PATH is automatically updated to include Android tools, Gradle, and Cargo binaries.
You can customize the installed versions by passing --build-arg during the build process:
| Argument | Default Value | Description |
|---|---|---|
CMDLINE_TOOLS_VERSION |
15859902_latest |
Android command-line tools version |
ANDROID_SDK_VERSION |
36 |
Target Android Platform version |
BUILD_TOOLS_VERSION |
36.1.0 |
Android Build Tools version |
GRADLE_VERSION |
9.7.0 |
Installed Gradle version |
USER_NAME |
developer |
Default non-root user name |
USER_UID |
1000 |
UID for the non-root user |
USER_GID |
1000 |
GID for the non-root user |
docker build --build-arg GRADLE_VERSION=8.10.2 -t kosmos-dev:custom .Every published digest is built, scanned and signed before any human-readable tag is moved onto it (scan-then-promote), so an unscanned image can never win a tag:
- Vulnerability gate: Trivy scans each image; a fixable
CRITICAL/HIGHfails the build. Results are uploaded to GitHub code scanning. - SBOM: a CycloneDX SBOM is attached as an attestation and published as a workflow artifact.
- Provenance: SLSA provenance (
mode=max) is attached at build time. - Signing: images are signed keyless with cosign via GitHub OIDC.
Verify a pulled image:
# Signature (keyless — verify against the GitHub Actions OIDC identity):
cosign verify ghcr.io/davils-com/kosmos:native-1.1 \
--certificate-identity-regexp 'https://github.com/davils-com/kosmos/.github/workflows/.*' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
# SBOM / provenance attestations:
docker buildx imagetools inspect ghcr.io/davils-com/kosmos:native-1.1Base-image digest and GitHub Actions are pinned and kept current by Dependabot. Manifests left
behind by an overwritten tag are pruned weekly (.github/workflows/cleanup-ghcr.yml), by an action
that reads the indexes first — a platform manifest is untagged by design and deleting it empties
every release that references it.
Dockerfile: Multi-stage image definition with thebase/native/android/chrome/fulltargets.docker-bake.hcl: Target and tag definitions (source of truth for builds).scripts/: Modular shell scripts for component installation..github/workflows/: Build/scan/sign/publish and GHCR cleanup..github/dependabot.yml: Base-image and Actions update automation.README.md: This documentation.
We welcome contributions to improve the Kosmos environment!
- Issue Reporting: Use the GitHub issue tracker for bugs and feature requests.
- Pull Requests: Ensure any changes to installation scripts are tested and documented.
- License: Published under the Apache License 2.0. See
LICENSEfor details. - Code of Conduct: We adhere to our Code of Conduct.
Maintained by Davils