Repository navigation
Add Dev Container Feature for Dev Proxy - #2009
Open
waldekmastykarz wants to merge 4 commits into
Open
waldekmastykarz wants to merge 4 commits into
waldekmastykarz wants to merge 4 commits into
Conversation
Adds a Dev Container Feature (features/src/devproxy), published as ghcr.io/dotnet/dev-proxy/devproxy, that installs Dev Proxy and, after the container is created, generates a per-container root certificate and trusts it system-wide, for Node.js and Python. Includes tests for the devcontainer CLI and workflows to test and publish the Feature. Closes dotnet#1334 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
CA private-key isolation and permissions need correction, and certificate-leak assertions can miss root-owned files.
3 open issues
What changed in this PR
Adds a Dev Container Feature for Dev Proxy, addressing #1334 with installation and certificate-trust setup for Dev Containers and GitHub Codespaces.
Changes:
- Adds configurable installation and post-create certificate setup for Debian/Ubuntu containers on x64 and arm64.
- Adds installation, version-selection, restricted-user, and runtime-trust tests.
- Adds validation and publishing workflows, plus usage documentation.
| File | Description |
|---|---|
| skills/dev-proxy/references/installation.md | Documents Feature-based installation. |
| README.md | Adds a Dev Container usage example. |
| features/test/devproxy/test.sh | Tests default installation and trust. |
| features/test/devproxy/specific_version.sh | Tests a pinned version. |
| features/test/devproxy/specific_version_with_v.sh | Tests a version with the v prefix. |
| features/test/devproxy/scenarios.json | Defines integration-test scenarios. |
| features/test/devproxy/runtimes.sh | Tests trust across common runtimes. |
| features/test/devproxy/non_root_user/Dockerfile | Provides a restricted-user test image. |
| features/test/devproxy/non_root_user.sh | Tests restricted-user setup and permissions. |
| features/test/devproxy/no_trust_certificate/Dockerfile | Provides an image for disabled-trust testing. |
| features/test/devproxy/no_trust_certificate.sh | Tests installation without certificate setup. |
| features/test/devproxy/duplicate.sh | Tests repeated installation. |
| features/test/devproxy/common.sh | Provides shared proxy and certificate assertions. |
| features/test/devproxy/beta.sh | Tests beta installation and trust. |
| features/src/devproxy/scripts/trust-cert.sh | Validates and installs the public CA certificate. |
| features/src/devproxy/scripts/post-create.sh | Generates and trusts the user's certificate. |
| features/src/devproxy/README.md | Documents options, behavior, and limitations. |
| features/src/devproxy/install.sh | Installs Dev Proxy, dependencies, and helpers. |
| features/src/devproxy/devcontainer-feature.json | Defines options, environment, and lifecycle setup. |
| .github/workflows/devcontainer-feature-test.yml | Runs architecture-matrix tests and metadata validation. |
| .github/workflows/devcontainer-feature-release.yml | Publishes the Feature to GHCR. |
| .github/copilot-instructions.md | Adds Feature development and release guidance. |
Review effort: Balanced
- Pin DEV_PROXY_CERT_PATH to the throwaway home during the build-time version check so an inherited absolute path can't leave a CA in the image - Generate the root certificate with umask 077 and restrict it to 0600 - Scan for stray certificates as root when possible and fail on incomplete scans Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Publishes the Feature as ghcr.io/dotnet/dev-proxy/dev-proxy so the name is spelled consistently with the repository. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1334
Adds a Dev Container Feature that installs Dev Proxy and trusts a per-container root certificate, following the spec in #1334 (comment).
Usage
What's included
features/src/dev-proxy: the Feature (version1.0.0, versioned separately from Dev Proxy).version(latest,beta,2.2.0orv2.2.0) andtrustCertificate(defaulttrue).install.shruns at build time as root. It installs dependencies (curl, unzip, ca-certificates, openssl, ICU) and resolves the version. It downloads the x64/arm64 Linux release into/opt/devproxy, symlinks/usr/local/bin/devproxy(plusdevproxy-betafor betas) and creates~/.config/dev-proxyfor the remote user. It also installs a root-owned cert-trust helper that the remote user can run withsudoand no password, then verifiesdevproxy --version. It's idempotent and non-interactive, and fails clearly on Alpine/musl and non-apt distros.postCreateCommand, the remote user runsdevproxy cert ensure, then the helper validates the certificate (CA:TRUE) and adds it to/usr/local/share/ca-certificates+update-ca-certificates.containerEnv:NODE_EXTRA_CA_CERTS,REQUESTS_CA_BUNDLEandSSL_CERT_FILE, all pointing to the system CA bundle.HTTP(S)_PROXYor support Java.features/test/dev-proxy: tests fordevcontainer features test.v), beta,trustCertificate: false(verifies no cert is generated or trusted), and end-to-end trust through Dev Proxy for curl, Node.js, Python urllib and requests, and .NET.devcontainer-feature-test.yml: runs on PRs/pushes touchingfeatures/**, on x64 and arm64 runners, plus metadata validation.devcontainer-feature-release.yml: publishes to GHCR withdevcontainers/actionon pushes tomainthat touchfeatures/src/**, or manually.Design decisions and notes for reviewers
installToolkitoption dropped. Featurecustomizationsare static metadata and can't depend on option values. The Feature always addsgarrytrinder.dev-proxy-toolkit, and users can opt out with"-garrytrinder.dev-proxy-toolkit"in theirdevcontainer.json(documented).VERIFY_X509_STRICT, which rejects v3's leaf certificates because they lack an Authority Key Identifier. v4 (the Kestrel engine onmain) already adds it. The runtimes scenario usesbetafor this reason, and the limitation is documented in the Feature README.--version. The install-time check runs in an isolated temporary HOME so no certificate is left in the image.After merging
dev-proxyGHCR package (ghcr.io/dotnet/dev-proxy/dev-proxy) public after the first publish.Open questions from the spec
Testing
Ran
devcontainer features test(CLI 0.89.0) locally with Docker on arm64. All autogenerated tests (debian, ubuntu, devcontainers/base:ubuntu, including the duplicate install) and all scenarios pass.