replica-omnisciente/infrastructure/proxmox/gcloud-box

Minimal gcloud multi-tenant boxes

One isolated LXC per Google account. Each box has only the gcloud CLI and its bundled Python runtime; no system Python stack, no extra gcloud components, no shared credentials.

Why

• gcloud bundles CPython internally, so we cannot remove Python entirely, but we avoid installing a system Python and any extra components (alpha, beta, kubectl, etc.).
• Each Google account lives in its own container, so you never need to gcloud auth revoke / gcloud auth login to switch accounts. You just pfctl ssh / pfctl exec the right box.
• Credentials are mounted per-box from Vaultwarden, not baked into the image.

Files

• create-base.sh — create a Debian 12 LXC template with minimal packages and gcloud CLI.
• clone-account.sh — clone the base template into a per-account box and assign a static IP.

Quick start

Run on the Proxmox hypervisor that will host the boxes (default: gigabyte):

cd /var/lib/vz/snippets   # or wherever you copied the scripts
bash create-base.sh       # creates CT 400 (template)
bash clone-account.sh fabio-gmail fabiorcoutada@gmail.com
bash clone-account.sh fabio-alt   fabiorcdcunha@gmail.com

Then from the laptop:

pfctl exec 401 "gcloud auth list"
pfctl exec 402 "gcloud auth list"

Credential model

• User OAuth: run pfctl ssh 401 then gcloud auth login inside the box.
• Service-account JSON: place the key in /root/gcloud-keys/<label>.json inside the box (or mount via Vaultwarden), then:

  pfctl exec 401 "gcloud auth activate-service-account --key-file=/root/gcloud-keys/fabio-gmail.json"
  

Future: C/C++ native path

For hot paths where gcloud is too heavy, we can add a small static binary using libcurl + openssl to call GCP REST APIs directly, authenticating with the same service-account JWT. This stays optional; the boxes still need gcloud for setup/IAM/project management.

Security

• Boxes are unprivileged LXC containers (--unprivileged 1).
• No credentials in the base template.
• Each clone gets its own static IP and isolated /home/gcloud/.config/gcloud.
• Keys are chmod 600 and sourced from Vaultwarden.