Improve devcontainer SSH workflow and multi-arch support#2352
Merged
Conversation
- Replace blanket NOPASSWD:ALL sudo with a minimal allowlist (apt-get, chown, mkdir, service ssh) applied at the end of post-create after setup no longer needs full root. - Remove appPort Docker host binding for SSH (port 2222) and move it to forwardPorts, which tunnels through VS Code / Codespaces instead of exposing on the host network. - Add portsAttributes entry for SSH port. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The earlier hardening commit replaced appPort with forwardPorts for 2222. forwardPorts is only honored by the VS Code/Codespaces port-forwarding UI and does not publish a Docker port when the container is started via the devcontainer CLI, leaving localhost:2222 unreachable (Connection refused). Restore appPort but bind to 127.0.0.1 only, so host-side 'ssh typeagent-devcontainer' works without exposing 2222 on the LAN.
- VNC config: add dotnet:2 feature, appPort 127.0.0.1:2222:2222, port 3443, missing extensions (csharp, azure-functions, rest-client) - post-create: remove TypeAgent git hook helpers entirely; consolidate git identity warning into one message; replace em-dash header comment - post-create: expand restricted sudoers allowlist (apt-get remove, dpkg -i / --configure, service sshd) for legitimate package operations - setup-ssh-access: explicit warnings when WSL Windows SSH sync is skipped (missing cmd.exe / wslpath, unresolved %USERPROFILE%, wslpath translation failure) - README: fix 'teh' typo, split forwarded-ports table by config, add Container User section explaining UID/GID 1001 choice - devcontainer.json / vnc/devcontainer.json: drop redundant 'tr -d \r' wrapper in postCreateCommand/postStartCommand (.gitattributes already enforces eol=lf)
curtisman
had a problem deploying
to
development-fork
GitHub Actions
Error
curtisman
had a problem deploying
to
development-fork
GitHub Actions
Error
curtisman
requested a deployment
to
development-fork
GitHub Actions
Waiting
curtisman
requested a deployment
to
development-fork
GitHub Actions
Waiting
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR improves the TypeAgent devcontainer workflow for SSH-based agent windows and broadens local host support.
Key changes:
mcr.microsoft.com/devcontainers/base:ubuntu-24.04linux/arm64support for Apple Silicon hosts in the standard configcommon-utilsto restore the expectedcodespaceuser and zsh setup.devcontainer/scripts/setup-ssh-access.sh.devcontainer/scripts/start-devcontainer.shwith optional--sshssh typeagent-devcontaineraccess127.0.0.1:2222:2222/workspaces/<repo>.worktreesLOCAL_GIT_USER_NAME/LOCAL_GIT_USER_EMAILlibsecret-1-0andlibsecret-1-devduring post-createdotnet:2, SSH appPort, port 3443, missing VS Code extensionstr -d '\r'Why
VS Code agent windows currently support tunnel and SSH connections, so a reliable SSH path into the devcontainer is needed. This PR makes that workflow first-class while also addressing:
Notes
desktop-lite, which may still require amd64 emulation on Apple Silicon depending on feature supportValidation
Validated during development with:
bash -n .devcontainer/scripts/start-devcontainer.shbash -n .devcontainer/scripts/post-create.shbash -n .devcontainer/scripts/setup-ssh-access.shFollow-ups
Potential follow-up cleanups outside this PR:
typescript.tsdksetting tojs/ts.tsdk.pathterminal.integrated.defaultProfile.linuxsetting to match current VS Code schema