diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 096a3d095..db939da5b 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -1,5 +1,5 @@ { - "image": "mcr.microsoft.com/devcontainers/javascript-node:1-18", + "image": "mcr.microsoft.com/devcontainers/javascript-node:3-22", "features": { "ghcr.io/devcontainers/features/docker-in-docker:2": {} }, diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml new file mode 100644 index 000000000..144149689 --- /dev/null +++ b/.github/dependabot.yaml @@ -0,0 +1,10 @@ +version: 2 +updates: + - package-ecosystem: "devcontainers" + directory: "/.devcontainer" + schedule: + interval: "weekly" + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" diff --git a/.github/workflows/docker-in-docker-stress-test.yaml b/.github/workflows/docker-in-docker-daemon-startup-bulk-test.yaml similarity index 71% rename from .github/workflows/docker-in-docker-stress-test.yaml rename to .github/workflows/docker-in-docker-daemon-startup-bulk-test.yaml index 1c9410a88..668879730 100644 --- a/.github/workflows/docker-in-docker-stress-test.yaml +++ b/.github/workflows/docker-in-docker-daemon-startup-bulk-test.yaml @@ -1,4 +1,4 @@ -name: "Stress test - Docker in Docker" +name: "Test Docker daemon startup in bulk - Docker in Docker" on: pull_request: paths: @@ -13,13 +13,13 @@ jobs: fail-fast: false runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: "Install latest devcontainer CLI" run: npm install -g @devcontainers/cli - - name: "Generating tests for 'docker-in-docker' which validates if docker daemon is running" - run: devcontainer features test --skip-scenarios -f docker-in-docker -i mcr.microsoft.com/devcontainers/base:ubuntu . + - name: "Generating tests for 'docker-in-docker' which validates if docker daemon is running (with iptablesSwitchAtRuntime=true)" + run: devcontainer features test -f docker-in-docker --skip-autogenerated --filter "docker_iptables_switch_at_runtime" . test-onCreate: strategy: @@ -28,10 +28,10 @@ jobs: fail-fast: false runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: "Install latest devcontainer CLI" run: npm install -g @devcontainers/cli - name: "Generating tests for 'docker-in-docker' which validates if docker daemon is available within 'onCreateCommand'" - run: devcontainer features test -f docker-in-docker --skip-autogenerated --filter "docker_with_on_create_command" \ No newline at end of file + run: devcontainer features test -f docker-in-docker --skip-autogenerated --filter "docker_with_on_create_command" -i mcr.microsoft.com/devcontainers/base:noble \ No newline at end of file diff --git a/.github/workflows/linter-automated.yaml b/.github/workflows/linter-automated.yaml index 46cbd085a..db57db29d 100644 --- a/.github/workflows/linter-automated.yaml +++ b/.github/workflows/linter-automated.yaml @@ -9,10 +9,10 @@ jobs: shellchecker: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Shell Linter - uses: azohra/shell-linter@v0.6.0 + uses: azohra/shell-linter@v0.8.0 with: path: "src/**/*.sh" severity: "error" # [style, info, warning, error] diff --git a/.github/workflows/linter-manual.yaml b/.github/workflows/linter-manual.yaml index 019724d35..ba72f8eaf 100644 --- a/.github/workflows/linter-manual.yaml +++ b/.github/workflows/linter-manual.yaml @@ -15,10 +15,10 @@ jobs: shellchecker: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Shell Linter - uses: azohra/shell-linter@v0.6.0 + uses: azohra/shell-linter@v0.8.0 with: path: ${{ github.event.inputs.path }} severity: ${{ github.event.inputs.severity }} diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 6890f5ae5..96c95398b 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -13,7 +13,7 @@ jobs: packages: write contents: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: "Publish" uses: devcontainers/action@v1 diff --git a/.github/workflows/test-all.yaml b/.github/workflows/test-all.yaml index 7e4c343bd..dd1d216a0 100644 --- a/.github/workflows/test-all.yaml +++ b/.github/workflows/test-all.yaml @@ -17,6 +17,7 @@ jobs: "azure-cli", "common-utils", "conda", + "copilot-cli", "desktop-lite", "docker-outside-of-docker", "docker-in-docker", @@ -42,7 +43,6 @@ jobs: ] baseImage: [ - "ubuntu:focal", "ubuntu:jammy", "debian:11", "debian:12", @@ -51,7 +51,7 @@ jobs: "mcr.microsoft.com/devcontainers/base:noble" ] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: "Install latest devcontainer CLI" run: npm install -g @devcontainers/cli @@ -70,6 +70,7 @@ jobs: "azure-cli", "common-utils", "conda", + "copilot-cli", "desktop-lite", "docker-outside-of-docker", "docker-in-docker", @@ -94,7 +95,7 @@ jobs: "nix", ] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: "Install latest devcontainer CLI" run: npm install -g @devcontainers/cli @@ -106,7 +107,7 @@ jobs: runs-on: ubuntu-latest continue-on-error: true steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: "Install latest devcontainer CLI" run: npm install -g @devcontainers/cli diff --git a/.github/workflows/test-manual.yaml b/.github/workflows/test-manual.yaml index 10d099b25..18dffd1b9 100644 --- a/.github/workflows/test-manual.yaml +++ b/.github/workflows/test-manual.yaml @@ -9,7 +9,7 @@ on: baseImage: description: "Base image" required: true - default: "ubuntu:focal" + default: "ubuntu:noble" logLevel: description: "Log Level (info/debug/trace)" required: true @@ -19,7 +19,7 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: "Install latest devcontainer CLI" run: npm install -g @devcontainers/cli diff --git a/.github/workflows/test-pr-arm64.yaml b/.github/workflows/test-pr-arm64.yaml new file mode 100644 index 000000000..0de1f066b --- /dev/null +++ b/.github/workflows/test-pr-arm64.yaml @@ -0,0 +1,88 @@ +name: "PR - Test Updated Features (arm64)" +on: + pull_request: + # NOTE: To extend this workflow to other features, add path entries below + # following the same pattern, e.g.: + # - "src//**" + # - "test//**" + paths: + - "src/powershell/**" + - "test/powershell/**" + - "src/docker-in-docker/**" + - "test/docker-in-docker/**" + +jobs: + detect-changes: + runs-on: ubuntu-latest + outputs: + features: ${{ steps.filter.outputs.changes }} + steps: + - uses: dorny/paths-filter@v4 + id: filter + with: + # NOTE: To extend this workflow to other features, add filter entries below + # following the same pattern, e.g.: + # : ./**//** + filters: | + powershell: ./**/powershell/** + docker-in-docker: ./**/docker-in-docker/** + + test: + needs: [detect-changes] + runs-on: ubuntu-24.04-arm + continue-on-error: true + strategy: + matrix: + features: ${{ fromJSON(needs.detect-changes.outputs.features) }} + # NOTE: ubuntu:focal and debian:11 are excluded because they ship + # GLIBC 2.31, but PowerShell >= 7.6.0 requires GLIBC 2.33+ on arm64. + # ubuntu:focal reached EOL Apr 2025; debian:11 reaches EOL Aug 2026. + baseImage: + [ + "ubuntu:jammy", + "debian:12", + "mcr.microsoft.com/devcontainers/base:ubuntu", + "mcr.microsoft.com/devcontainers/base:debian", + "mcr.microsoft.com/devcontainers/base:noble" + ] + exclude: + - features: docker-in-docker + baseImage: mcr.microsoft.com/devcontainers/base:debian + - features: docker-in-docker + baseImage: mcr.microsoft.com/devcontainers/base:ubuntu + steps: + - uses: actions/checkout@v7 + + - name: "Load erofs module and verify" + run: sudo modprobe erofs && grep erofs /proc/filesystems + + - name: "Install latest devcontainer CLI" + run: npm install -g @devcontainers/cli + + - name: "Generating tests for '${{ matrix.features }}' against '${{ matrix.baseImage }}'" + run: devcontainer features test --skip-scenarios -f ${{ matrix.features }} -i ${{ matrix.baseImage }} . + + test-scenarios: + needs: [detect-changes] + runs-on: ubuntu-24.04-arm + continue-on-error: true + strategy: + matrix: + features: ${{ fromJSON(needs.detect-changes.outputs.features) }} + steps: + - uses: actions/checkout@v7 + + - name: "Install latest devcontainer CLI" + run: npm install -g @devcontainers/cli + + - name: "Exclude iptables-isolation scenarios from docker-in-docker" + if: matrix.features == 'docker-in-docker' + run: | + sudo apt-get update && sudo apt-get install -y jq + sed 's://.*$::' test/docker-in-docker/scenarios.json \ + | jq 'del(.docker_with_default_iptables, .docker_with_default_iptables_ubuntu)' \ + > test/docker-in-docker/scenarios.json.tmp + mv test/docker-in-docker/scenarios.json.tmp test/docker-in-docker/scenarios.json + + - name: "Testing '${{ matrix.features }}' scenarios" + run: devcontainer features test -f ${{ matrix.features }} --skip-autogenerated . diff --git a/.github/workflows/test-pr.yaml b/.github/workflows/test-pr.yaml index 758ab2b74..e18291f09 100644 --- a/.github/workflows/test-pr.yaml +++ b/.github/workflows/test-pr.yaml @@ -8,7 +8,7 @@ jobs: outputs: features: ${{ steps.filter.outputs.changes }} steps: - - uses: dorny/paths-filter@v3 + - uses: dorny/paths-filter@v4 id: filter with: filters: | @@ -17,6 +17,7 @@ jobs: azure-cli: ./**/azure-cli/** common-utils: ./**/common-utils/** conda: ./**/conda/** + copilot-cli: ./**/copilot-cli/** desktop-lite: ./**/desktop-lite/** docker-outside-of-docker: ./**/docker-outside-of-docker/** docker-in-docker: ./**/docker-in-docker/** @@ -49,7 +50,6 @@ jobs: features: ${{ fromJSON(needs.detect-changes.outputs.features) }} baseImage: [ - "ubuntu:focal", "ubuntu:jammy", "debian:11", "debian:12", @@ -62,8 +62,16 @@ jobs: baseImage: ubuntu:jammy - features: oryx baseImage: mcr.microsoft.com/devcontainers/base:ubuntu + - features: docker-in-docker + baseImage: mcr.microsoft.com/devcontainers/base:debian + - features: docker-outside-of-docker + baseImage: mcr.microsoft.com/devcontainers/base:debian + - features: docker-in-docker + baseImage: mcr.microsoft.com/devcontainers/base:ubuntu + - features: docker-outside-of-docker + baseImage: mcr.microsoft.com/devcontainers/base:ubuntu steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: "Install latest devcontainer CLI" run: npm install -g @devcontainers/cli @@ -79,10 +87,47 @@ jobs: matrix: features: ${{ fromJSON(needs.detect-changes.outputs.features) }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: "Install latest devcontainer CLI" run: npm install -g @devcontainers/cli + - name: "Exclude iptables-isolation scenarios from docker-in-docker (run in separate 'iptables-isolation' job)" + if: matrix.features == 'docker-in-docker' + run: | + sudo apt-get update && sudo apt-get install -y jq + sed 's://.*$::' test/docker-in-docker/scenarios.json \ + | jq 'del(.docker_with_default_iptables, .docker_with_default_iptables_ubuntu)' \ + > test/docker-in-docker/scenarios.json.tmp + mv test/docker-in-docker/scenarios.json.tmp test/docker-in-docker/scenarios.json + - name: "Testing '${{ matrix.features }}' scenarios" run: devcontainer features test -f ${{ matrix.features }} --skip-autogenerated . + + iptables-isolation: + needs: [detect-changes] + if: contains(fromJSON(needs.detect-changes.outputs.features), 'docker-in-docker') + runs-on: ubuntu-latest + continue-on-error: true + strategy: + fail-fast: false + matrix: + scenario: + - docker_with_default_iptables + - docker_with_default_iptables_ubuntu + steps: + - uses: actions/checkout@v7 + + - name: "Install latest devcontainer CLI" + run: npm install -g @devcontainers/cli + + - name: "Isolate scenario '${{ matrix.scenario }}'" + run: | + sudo apt-get update && sudo apt-get install -y jq + sed 's://.*$::' test/docker-in-docker/scenarios.json \ + | jq '{ "${{ matrix.scenario }}": .["${{ matrix.scenario }}"] }' \ + > test/docker-in-docker/scenarios.json.tmp + mv test/docker-in-docker/scenarios.json.tmp test/docker-in-docker/scenarios.json + + - name: "Testing docker-in-docker scenario '${{ matrix.scenario }}'" + run: devcontainer features test --features docker-in-docker --filter ${{ matrix.scenario }} --skip-autogenerated . diff --git a/.github/workflows/update-aws-cli-completer-scripts.yml b/.github/workflows/update-aws-cli-completer-scripts.yml index 41d67189f..ea6090fe9 100644 --- a/.github/workflows/update-aws-cli-completer-scripts.yml +++ b/.github/workflows/update-aws-cli-completer-scripts.yml @@ -9,10 +9,20 @@ jobs: runs-on: ubuntu-latest environment: documentation # grants access to secrets.PAT, for creating pull requests permissions: - contents: write - pull-requests: write + contents: read steps: - - uses: actions/checkout@v4 + - name: Generate a token + id: app-token + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ vars.DEVCONTAINERS_REPO_AUTOMATION_ID }} + private-key: ${{ secrets.DEVCONTAINERS_REPO_AUTOMATION_PRIVATE_KEY }} + + - name: Checkout + id: checkout + uses: actions/checkout@v7 + with: + token: ${{ steps.app-token.outputs.token }} - name: Run fetch-latest-completer-scripts.sh run: src/aws-cli/scripts/fetch-latest-completer-scripts.sh @@ -20,7 +30,7 @@ jobs: - name: Create a PR for completer scripts id: push_image_info env: - GITHUB_TOKEN: ${{ secrets.PAT }} + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} run: | set -e echo "Start." diff --git a/.github/workflows/update-documentation.yml b/.github/workflows/update-documentation.yml index d74d970d5..c766a6871 100644 --- a/.github/workflows/update-documentation.yml +++ b/.github/workflows/update-documentation.yml @@ -10,11 +10,21 @@ jobs: runs-on: ubuntu-latest environment: documentation permissions: - contents: write - pull-requests: write + contents: read if: "github.ref == 'refs/heads/main'" steps: - - uses: actions/checkout@v4 + - name: Generate a token + id: app-token + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ vars.DEVCONTAINERS_REPO_AUTOMATION_ID }} + private-key: ${{ secrets.DEVCONTAINERS_REPO_AUTOMATION_PRIVATE_KEY }} + + - name: Checkout + id: checkout + uses: actions/checkout@v7 + with: + token: ${{ steps.app-token.outputs.token }} - name: Generate Documentation uses: devcontainers/action@v1 @@ -25,7 +35,7 @@ jobs: - name: Create a PR for Documentation id: push_image_info env: - GITHUB_TOKEN: ${{ secrets.PAT }} + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} run: | set -e echo "Start." diff --git a/.github/workflows/update-dotnet-install-script.yml b/.github/workflows/update-dotnet-install-script.yml index 604f6880b..fd2161d27 100644 --- a/.github/workflows/update-dotnet-install-script.yml +++ b/.github/workflows/update-dotnet-install-script.yml @@ -9,10 +9,20 @@ jobs: runs-on: ubuntu-latest environment: documentation # grants access to secrets.PAT, for creating pull requests permissions: - contents: write - pull-requests: write + contents: read steps: - - uses: actions/checkout@v4 + - name: Generate a token + id: app-token + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ vars.DEVCONTAINERS_REPO_AUTOMATION_ID }} + private-key: ${{ secrets.DEVCONTAINERS_REPO_AUTOMATION_PRIVATE_KEY }} + + - name: Checkout + id: checkout + uses: actions/checkout@v7 + with: + token: ${{ steps.app-token.outputs.token }} - name: Run fetch-latest-dotnet-install.sh run: src/dotnet/scripts/fetch-latest-dotnet-install.sh @@ -20,7 +30,7 @@ jobs: - name: Create a PR for dotnet-install.sh id: push_image_info env: - GITHUB_TOKEN: ${{ secrets.PAT }} + GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} run: | set -e echo "Start." diff --git a/.github/workflows/validate-metadata-files.yml b/.github/workflows/validate-metadata-files.yml index 863418e93..5b24dfbee 100644 --- a/.github/workflows/validate-metadata-files.yml +++ b/.github/workflows/validate-metadata-files.yml @@ -7,7 +7,7 @@ jobs: validate: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: "Validate devcontainer-feature.json files" uses: devcontainers/action@v1 diff --git a/src/anaconda/NOTES.md b/src/anaconda/NOTES.md index 394dd6f1d..4a372cade 100644 --- a/src/anaconda/NOTES.md +++ b/src/anaconda/NOTES.md @@ -17,4 +17,7 @@ conda install python=3.7 This Feature should work on recent versions of Debian/Ubuntu-based distributions with the `apt` package manager installed. +Also RHEL based linux distributions such as almalinux, rockylinux, fedora are supported now. +Please do note that Alpine and cbl-mariner aren't supported due system level restrictions with the anaconda installer. + `bash` is required to execute the `install.sh` script. diff --git a/src/anaconda/README.md b/src/anaconda/README.md index 3346823b4..f093ce618 100644 --- a/src/anaconda/README.md +++ b/src/anaconda/README.md @@ -35,7 +35,7 @@ conda install python=3.7 ## OS Support This Feature should work on recent versions of Debian/Ubuntu-based distributions with the `apt` package manager installed. - +Also RHEL based linux distributions such as almalinux, rockylinux, fedora are supported now. `bash` is required to execute the `install.sh` script. diff --git a/src/anaconda/devcontainer-feature.json b/src/anaconda/devcontainer-feature.json index e4779279b..ac76a9b99 100644 --- a/src/anaconda/devcontainer-feature.json +++ b/src/anaconda/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "anaconda", - "version": "1.0.13", + "version": "1.1.0", "name": "Anaconda", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/anaconda", "options": { diff --git a/src/anaconda/install.sh b/src/anaconda/install.sh index 7c7af5b00..6f57a3144 100755 --- a/src/anaconda/install.sh +++ b/src/anaconda/install.sh @@ -13,11 +13,63 @@ USERNAME="${USERNAME:-"${_REMOTE_USER:-"automatic"}"}" UPDATE_RC="${UPDATE_RC:-"true"}" CONDA_DIR="${CONDA_DIR:-"/usr/local/conda"}" -set -eux +set -euo pipefail export DEBIAN_FRONTEND=noninteractive +# Detect package manager and set install command +detect_package_manager() { + if command -v apt-get > /dev/null; then + PKG_MANAGER="apt-get" + PKG_UPDATE="apt-get update -y" + PKG_INSTALL="apt-get -y install --no-install-recommends" + PKG_CLEAN="apt-get -y clean" + PKG_LISTS="/var/lib/apt/lists/*" + PKG_QUERY="dpkg -s" + elif command -v apk > /dev/null; then + PKG_MANAGER="apk" + PKG_UPDATE="apk update" + PKG_INSTALL="apk add --no-cache" + PKG_CLEAN="rm -rf /var/cache/apk/*" + PKG_LISTS="/var/cache/apk/*" + PKG_QUERY="apk info -e" + elif command -v dnf > /dev/null; then + PKG_MANAGER="dnf" + PKG_UPDATE="dnf -y makecache" + PKG_INSTALL="dnf -y install" + PKG_CLEAN="dnf clean all" + PKG_LISTS="/var/cache/dnf/*" + PKG_QUERY="rpm -q" + elif command -v microdnf > /dev/null; then + PKG_MANAGER="microdnf" + PKG_UPDATE="microdnf update" + PKG_INSTALL="microdnf install -y" + PKG_CLEAN="microdnf clean all" + PKG_LISTS="/var/cache/yum/*" + PKG_QUERY="rpm -q" + elif command -v tdnf > /dev/null; then + PKG_MANAGER="tdnf" + PKG_UPDATE="tdnf makecache" + PKG_INSTALL="tdnf install -y" + PKG_CLEAN="tdnf clean all" + PKG_LISTS="/var/cache/tdnf/*" + PKG_QUERY="rpm -q" + elif command -v yum > /dev/null; then + PKG_MANAGER="yum" + PKG_UPDATE="yum -y makecache" + PKG_INSTALL="yum -y install" + PKG_CLEAN="yum clean all" + PKG_LISTS="/var/cache/yum/*" + PKG_QUERY="rpm -q" + else + echo "No supported package manager found (apt-get, apk, dnf, microdnf, tdnf, yum)." + exit 1 + fi +} + +detect_package_manager + # Clean up -rm -rf /var/lib/apt/lists/* +eval "$PKG_CLEAN" if [ "$(id -u)" -ne 0 ]; then echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.' @@ -47,7 +99,12 @@ elif [ "${USERNAME}" = "none" ] || ! id -u ${USERNAME} > /dev/null 2>&1; then fi architecture="$(uname -m)" -if [ "${architecture}" != "x86_64" ]; then +# Normalize arm64 to aarch64 for consistency +if [ "${architecture}" = "arm64" ]; then + architecture="aarch64" +fi + +if [ "${architecture}" != "x86_64" ] && [ "${architecture}" != "aarch64" ]; then echo "(!) Architecture $architecture unsupported" exit 1 fi @@ -66,12 +123,76 @@ updaterc() { # Checks if packages are installed and installs them if not check_packages() { - if ! dpkg -s "$@" > /dev/null 2>&1; then - if [ "$(find /var/lib/apt/lists/* | wc -l)" = "0" ]; then - echo "Running apt-get update..." - apt-get update -y + for pkg in "$@"; do + # Use PKG_QUERY variable to check if package is installed + if ! eval "$PKG_QUERY $pkg" > /dev/null 2>&1; then + # Package not installed, check if we need to update package lists + if [ "$PKG_MANAGER" = "apt-get" ]; then + # For apt-get, check if package lists are empty + if [ "$(find "$PKG_LISTS" | wc -l)" = "0" ]; then + echo "Running $PKG_UPDATE..." + eval "$PKG_UPDATE" + fi + else + # For other package managers, always update before installing + echo "Running $PKG_UPDATE..." + eval "$PKG_UPDATE" + fi + + # Install the package + echo "Installing package: $pkg" + eval "$PKG_INSTALL $pkg" + else + echo "Package $pkg is already installed" fi - apt-get -y install --no-install-recommends "$@" + done +} + +sudo_if() { + COMMAND="$*" + if [ "$(id -u)" -eq 0 ] && [ "$USERNAME" != "root" ]; then + if command -v runuser > /dev/null; then + runuser -l "$USERNAME" -c "$COMMAND" + elif command -v su > /dev/null; then + su - "$USERNAME" -c "$COMMAND" + elif command -v sudo > /dev/null; then + sudo -u "$USERNAME" -i bash -c "$COMMAND" + else + # Fallback: execute as root (not ideal but works in containers) + echo "Warning: No user switching command available, running as root" + eval "$COMMAND" + fi + else + eval "$COMMAND" + fi +} + +run_as_user() { + local user="$1" + shift + local cmd="$*" + + if command -v runuser > /dev/null; then + if [ "$PKG_MANAGER" = "apk" ]; then + runuser "$user" -c "$cmd" + else + runuser -l "$user" -c "$cmd" + fi + elif command -v su > /dev/null; then + if [ "$PKG_MANAGER" = "apk" ]; then + su "$user" -c "$cmd" + else + su --login -c "$cmd" "$user" + fi + elif command -v sudo > /dev/null; then + if [ "$PKG_MANAGER" = "apk" ]; then + sudo -u "$user" sh -c "$cmd" + else + sudo -u "$user" -i bash -c "$cmd" + fi + else + echo "Warning: No user switching command available, running as root" + eval "$cmd" fi } @@ -83,30 +204,46 @@ if ! conda --version &> /dev/null ; then usermod -a -G conda "${USERNAME}" # Install dependencies - check_packages wget ca-certificates + if [ "$PKG_MANAGER" = "apt-get" ]; then + check_packages wget ca-certificates libgtk-3-0 + elif [ "$PKG_MANAGER" = "apk" ]; then + check_packages wget ca-certificates gtk+3.0 + else + check_packages wget ca-certificates gtk3 + fi mkdir -p $CONDA_DIR + chown -R "${USERNAME}:conda" "${CONDA_DIR}" - chmod -R g+r+w "${CONDA_DIR}" - - find "${CONDA_DIR}" -type d -print0 | xargs -n 1 -0 chmod g+s + chmod -R g+r+w "${CONDA_DIR}" + echo "Installing Anaconda..." CONDA_VERSION=$VERSION if [ "${VERSION}" = "latest" ] || [ "${VERSION}" = "lts" ]; then - CONDA_VERSION="2021.11" + CONDA_VERSION="2024.10-1" fi - su --login -c "export http_proxy=${http_proxy:-} && export https_proxy=${https_proxy:-} \ - && wget -q https://repo.anaconda.com/archive/Anaconda3-${CONDA_VERSION}-Linux-x86_64.sh -O /tmp/anaconda-install.sh \ - && /bin/bash /tmp/anaconda-install.sh -u -b -p ${CONDA_DIR}" ${USERNAME} 2>&1 + if [ "${architecture}" = "x86_64" ]; then + run_as_user "${USERNAME}" "export http_proxy=${http_proxy:-} && export https_proxy=${https_proxy:-} \ + && wget -q https://repo.anaconda.com/archive/Anaconda3-${CONDA_VERSION}-Linux-x86_64.sh -O /tmp/anaconda-install.sh \ + && /bin/bash /tmp/anaconda-install.sh -u -b -p ${CONDA_DIR}" + elif [ "${architecture}" = "aarch64" ]; then + run_as_user "${USERNAME}" "export http_proxy=${http_proxy:-} && export https_proxy=${https_proxy:-} \ + && wget -q https://repo.anaconda.com/archive/Anaconda3-${CONDA_VERSION}-Linux-aarch64.sh -O /tmp/anaconda-install.sh \ + && /bin/bash /tmp/anaconda-install.sh -u -b -p ${CONDA_DIR}" + fi if [ "${VERSION}" = "latest" ] || [ "${VERSION}" = "lts" ]; then PATH=$PATH:${CONDA_DIR}/bin conda update -y conda fi - rm /tmp/anaconda-install.sh + chown -R "${USERNAME}:conda" "${CONDA_DIR}" + chmod -R g+r+w "${CONDA_DIR}" + + + rm /tmp/anaconda-install.sh updaterc "export CONDA_DIR=${CONDA_DIR}/bin" fi @@ -135,7 +272,6 @@ if [ -f "/etc/bash.bashrc" ]; then echo "${notice_script}" | tee -a /etc/bash.bashrc fi -# Clean up -rm -rf /var/lib/apt/lists/* - +# Final clean up +eval "$PKG_CLEAN" echo "Done!" diff --git a/src/aws-cli/devcontainer-feature.json b/src/aws-cli/devcontainer-feature.json index 54cc4b29b..75d24ca88 100644 --- a/src/aws-cli/devcontainer-feature.json +++ b/src/aws-cli/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "aws-cli", - "version": "1.1.2", + "version": "1.1.4", "name": "AWS CLI", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/aws-cli", "description": "Installs the AWS CLI along with needed dependencies. Useful for base Dockerfiles that often are missing required install dependencies like gpg.", @@ -12,6 +12,11 @@ ], "default": "latest", "description": "Select or enter an AWS CLI version." + }, + "verbose": { + "type": "boolean", + "default": true, + "description": "Suppress verbose output." } }, "customizations": { diff --git a/src/aws-cli/install.sh b/src/aws-cli/install.sh index 4ff9bfde6..1f6af54bd 100755 --- a/src/aws-cli/install.sh +++ b/src/aws-cli/install.sh @@ -13,6 +13,7 @@ set -e rm -rf /var/lib/apt/lists/* VERSION=${VERSION:-"latest"} +VERBOSE=${VERBOSE:-"true"} AWSCLI_GPG_KEY=FB5DB77FD5C118B80511ADA8A6310ACC4672475C AWSCLI_GPG_KEY_MATERIAL="-----BEGIN PGP PUBLIC KEY BLOCK----- @@ -110,19 +111,22 @@ install() { exit 1 fi - unzip "${scriptZipFile}" + if [ "${VERBOSE}" = "false" ]; then + unzip -q "${scriptZipFile}" + else + unzip "${scriptZipFile}" + fi + ./aws/install - # kubectl bash completion + # AWS bash completion mkdir -p /etc/bash_completion.d cp ./scripts/vendor/aws_bash_completer /etc/bash_completion.d/aws - # kubectl zsh completion - if [ -e "${USERHOME}/.oh-my-zsh" ]; then - mkdir -p "${USERHOME}/.oh-my-zsh/completions" - cp ./scripts/vendor/aws_zsh_completer.sh "${USERHOME}/.oh-my-zsh/completions/_aws" - chown -R "${USERNAME}" "${USERHOME}/.oh-my-zsh" - fi + # AWS zsh completion + mkdir -p /usr/local/share/zsh/site-functions/ + cp ./scripts/vendor/aws_zsh_completer.sh /usr/local/share/zsh/site-functions/_aws + sed -i '1s/^/#compdef aws\n/' /usr/local/share/zsh/site-functions/_aws rm -rf ./aws } diff --git a/src/azure-cli/devcontainer-feature.json b/src/azure-cli/devcontainer-feature.json index 3b731a6b3..7280ad2ad 100644 --- a/src/azure-cli/devcontainer-feature.json +++ b/src/azure-cli/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "azure-cli", - "version": "1.2.7", + "version": "1.3.0", "name": "Azure CLI", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/azure-cli", "description": "Installs the Azure CLI along with needed dependencies. Useful for base Dockerfiles that often are missing required install dependencies like gpg.", diff --git a/src/azure-cli/install.sh b/src/azure-cli/install.sh index 93e10ff52..425deafe9 100755 --- a/src/azure-cli/install.sh +++ b/src/azure-cli/install.sh @@ -19,7 +19,7 @@ AZ_BICEPVERSION=${BICEPVERSION:-latest} INSTALL_USING_PYTHON=${INSTALLUSINGPYTHON:-false} MICROSOFT_GPG_KEYS_URI="https://packages.microsoft.com/keys/microsoft.asc" AZCLI_ARCHIVE_ARCHITECTURES="amd64 arm64" -AZCLI_ARCHIVE_VERSION_CODENAMES="stretch bookworm buster bullseye bionic focal jammy noble" +AZCLI_ARCHIVE_VERSION_CODENAMES="stretch bookworm buster bullseye bionic focal jammy noble trixie resolute" if [ "$(id -u)" -ne 0 ]; then echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.' @@ -98,7 +98,15 @@ install_using_apt() { # Import key safely (new 'signed-by' method rather than deprecated apt-key approach) and install curl -sSL ${MICROSOFT_GPG_KEYS_URI} | gpg --dearmor > /usr/share/keyrings/microsoft-archive-keyring.gpg echo "deb [arch=${architecture} signed-by=/usr/share/keyrings/microsoft-archive-keyring.gpg] https://packages.microsoft.com/repos/azure-cli/ ${VERSION_CODENAME} main" > /etc/apt/sources.list.d/azure-cli.list - apt-get update + + # This is a workaround for the fact that Azure CLI is not yet a supported package for debian trixie. Once Azure CLI is supported we should revert to avoid script failure for non Azure CLI packages + if ! (apt-get update); then + echo "(!) Failed to update apt cache, removing repository file" + rm -f /etc/apt/sources.list.d/azure-cli.list + else + echo "WARNING: apt-get update succeeded. The workaround for broken Azure CLI install on Debian Trixie may no longer be needed." + echo "TODO: Consider reverting to a simple `apt-get update` if the Azure CLI repo works reliably for debian trixie" + fi if [ "${AZ_VERSION}" = "latest" ] || [ "${AZ_VERSION}" = "lts" ] || [ "${AZ_VERSION}" = "stable" ]; then # Empty, meaning grab the "latest" in the apt repo @@ -135,7 +143,7 @@ install_using_pip_strategy() { install_with_pipx() { echo "(*) Attempting to install globally with pipx..." - local ver="$1" + local ver="$1" export local @@ -192,6 +200,9 @@ CACHED_AZURE_VERSION="${AZ_VERSION}" # In case we need to fallback to pip and th if [ "${INSTALL_USING_PYTHON}" != "true" ]; then if [[ "${AZCLI_ARCHIVE_ARCHITECTURES}" = *"${architecture}"* ]] && [[ "${AZCLI_ARCHIVE_VERSION_CODENAMES}" = *"${VERSION_CODENAME}"* ]]; then install_using_apt || use_pip="true" + else + echo "(*) Codename '${VERSION_CODENAME}' or architecture '${architecture}' not in apt archive list, falling back to pip installation." + use_pip="true" fi else use_pip="true" diff --git a/src/common-utils/NOTES.md b/src/common-utils/NOTES.md index f2c7aa72e..9faa2eedd 100644 --- a/src/common-utils/NOTES.md +++ b/src/common-utils/NOTES.md @@ -2,6 +2,13 @@ This Feature should work on recent versions of Debian/Ubuntu, RedHat Enterprise Linux, Fedora, RockyLinux, and Alpine Linux. +## Included utilities + +In addition to the common CLI tools (curl, wget, git, jq, nano, vim, etc.), this Feature installs: + +- **bubblewrap** (`bwrap`) — a lightweight sandboxing tool used as a dependency by some desktop and container tooling. +- **socat** — a multipurpose relay for bidirectional data transfer between two independent data channels (e.g., sockets, files, pipes). + ## Using with dev container images This Feature is used in many of the [dev container images](https://github.com/search?q=repo%3Adevcontainers%2Fimages+%22ghcr.io%2Fdevcontainers%2Ffeatures%2Fcommon-utils%22&type=code), as a result diff --git a/src/common-utils/README.md b/src/common-utils/README.md index b8e37a8c8..3d21e8b3f 100644 --- a/src/common-utils/README.md +++ b/src/common-utils/README.md @@ -38,7 +38,7 @@ these images have already allocated UID & GID 1000. Attempting to add this Featu By default, this script provides a custom command prompt that includes information about the git repository for the current folder. However, with certain large repositories, this can result in a slow command prompt due to the performance of needed git operations. -For performance reasons, a "dirty" indicator that tells you whether or not there are uncommitted changes is disabled by default. You can opt to turn this on for smaller repositories by entering the following in a terminal or adding it to your `postCreateCommand`: +For performance reasons, a "dirty" indicator that tells you whether or not there are uncommitted changes is disabled by default. You can opt to turn this on for smaller repositories by entering the following in a terminal or adding it to your `postStartCommand`: ```bash git config devcontainers-theme.show-dirty 1 diff --git a/src/common-utils/devcontainer-feature.json b/src/common-utils/devcontainer-feature.json index 82ddde046..5b56f6184 100644 --- a/src/common-utils/devcontainer-feature.json +++ b/src/common-utils/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "common-utils", - "version": "2.5.3", + "version": "2.5.9", "name": "Common Utilities", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/common-utils", "description": "Installs a set of common command line utilities, Oh My Zsh!, and sets up a non-root user.", @@ -64,6 +64,11 @@ "type": "boolean", "default": false, "description": "Add packages from non-free Debian repository? (Debian only)" + }, + "installSsl": { + "type": "boolean", + "default": true, + "description": "Install SSL?" } } } diff --git a/src/common-utils/install.sh b/src/common-utils/install.sh index a89490347..313271d0a 100755 --- a/src/common-utils/install.sh +++ b/src/common-utils/install.sh @@ -18,6 +18,7 @@ USERNAME="${USERNAME:-"automatic"}" USER_UID="${UID:-"automatic"}" USER_GID="${GID:-"automatic"}" ADD_NON_FREE_PACKAGES="${NONFREEPACKAGES:-"false"}" +INSTALL_SSL="${INSTALLSSL:-"true"}" MARKER_FILE="/usr/local/etc/vscode-dev-containers/common" diff --git a/src/common-utils/main.sh b/src/common-utils/main.sh index abef18430..5e5487aa2 100644 --- a/src/common-utils/main.sh +++ b/src/common-utils/main.sh @@ -18,6 +18,7 @@ USERNAME="${USERNAME:-"automatic"}" USER_UID="${USERUID:-"automatic"}" USER_GID="${USERGID:-"automatic"}" ADD_NON_FREE_PACKAGES="${NONFREEPACKAGES:-"false"}" +INSTALL_SSL="${INSTALLSSL:-"true"}" MARKER_FILE="/usr/local/etc/vscode-dev-containers/common" @@ -29,52 +30,54 @@ install_debian_packages() { export DEBIAN_FRONTEND=noninteractive local package_list="" - if [ "${PACKAGES_ALREADY_INSTALLED}" != "true" ]; then - package_list="${package_list} \ - apt-utils \ - bash-completion \ - openssh-client \ - gnupg2 \ - dirmngr \ - iproute2 \ - procps \ - lsof \ - htop \ - net-tools \ - psmisc \ - curl \ - tree \ - wget \ - rsync \ - ca-certificates \ - unzip \ - bzip2 \ - xz-utils \ - zip \ - nano \ - vim-tiny \ - less \ - jq \ - lsb-release \ - apt-transport-https \ - dialog \ - libc6 \ - libgcc1 \ - libkrb5-3 \ - libgssapi-krb5-2 \ - libicu[0-9][0-9] \ - liblttng-ust[0-9] \ - libstdc++6 \ - zlib1g \ - locales \ - sudo \ - ncdu \ - man-db \ - strace \ - manpages \ - manpages-dev \ - init-system-helpers" - + package_list="${package_list} \ + apt-utils \ + bash-completion \ + openssh-client \ + gnupg2 \ + dirmngr \ + iproute2 \ + procps \ + lsof \ + htop \ + net-tools \ + psmisc \ + curl \ + tree \ + wget \ + rsync \ + ca-certificates \ + unzip \ + bzip2 \ + xz-utils \ + zip \ + nano \ + vim-tiny \ + less \ + jq \ + lsb-release \ + apt-transport-https \ + dialog \ + libc6 \ + libgcc1 \ + libkrb5-3 \ + libgssapi-krb5-2 \ + libicu[0-9][0-9] \ + liblttng-ust[0-9] \ + libstdc++6 \ + zlib1g \ + locales \ + sudo \ + ncdu \ + man-db \ + strace \ + manpages \ + manpages-dev \ + init-system-helpers \ + bubblewrap \ + socat" + + if [ "${INSTALL_SSL}" = "true" ]; then # Include libssl1.1 if available if [[ ! -z $(apt-cache --names-only search ^libssl1.1$) ]]; then package_list="${package_list} libssl1.1" @@ -96,11 +99,11 @@ install_debian_packages() { package_list="${package_list} libssl1.0.0" fi fi + fi - # Include git if not already installed (may be more recent than distro version) - if ! type git > /dev/null 2>&1; then - package_list="${package_list} git" - fi + # Include git if not already installed (may be more recent than distro version) + if ! type git > /dev/null 2>&1; then + package_list="${package_list} git" fi # Needed for adding manpages-posix and manpages-posix-dev which are non-free packages in Debian @@ -125,11 +128,22 @@ install_debian_packages() { package_list="${package_list} manpages-posix manpages-posix-dev" fi - # Install the list of packages - echo "Packages to verify are installed: ${package_list}" - rm -rf /var/lib/apt/lists/* - apt-get update -y - apt-get -y install --no-install-recommends ${package_list} 2> >( grep -v 'debconf: delaying package configuration, since apt-utils is not installed' >&2 ) + local missing_package_list="" + local packages=() + read -r -a packages <<< "${package_list}" + for package in "${packages[@]}"; do + if ! dpkg-query -W -f='${db:Status-Abbrev}\n' "${package}" 2>/dev/null | grep -q '^ii'; then + missing_package_list="${missing_package_list} ${package}" + fi + done + + # Install the list of missing packages + if [ -n "${missing_package_list}" ]; then + echo "Packages to verify are installed: ${missing_package_list}" + rm -rf /var/lib/apt/lists/* + apt-get update -y + apt-get -y install --no-install-recommends ${missing_package_list} 2> >( grep -v 'debconf: delaying package configuration, since apt-utils is not installed' >&2 ) + fi # Install zsh (and recommended packages) if needed if [ "${INSTALL_ZSH}" = "true" ] && ! type zsh > /dev/null 2>&1; then @@ -149,8 +163,6 @@ install_debian_packages() { LOCALE_ALREADY_SET="true" fi - PACKAGES_ALREADY_INSTALLED="true" - # Clean up apt-get -y clean rm -rf /var/lib/apt/lists/* @@ -172,66 +184,70 @@ install_redhat_packages() { else echo "Unable to find 'tdnf', 'dnf', or 'yum' package manager. Exiting." exit 1 -fi + fi - if [ "${PACKAGES_ALREADY_INSTALLED}" != "true" ]; then - package_list="${package_list} \ - gawk \ - bash-completion \ - openssh-clients \ - gnupg2 \ - iproute \ - procps \ - lsof \ - net-tools \ - psmisc \ - wget \ - ca-certificates \ - rsync \ - unzip \ - xz \ - zip \ - nano \ - vim-minimal \ - less \ - jq \ - openssl-libs \ - krb5-libs \ - libicu \ - zlib \ - sudo \ - sed \ - grep \ - which \ - man-db \ - strace" - - # rockylinux:9 installs 'curl-minimal' which clashes with 'curl' - # Install 'curl' for every OS except this rockylinux:9 - if [[ "${ID}" = "rocky" ]] && [[ "${VERSION}" != *"9."* ]]; then - package_list="${package_list} curl" - fi + package_list="${package_list} \ + gawk \ + bash-completion \ + openssh-clients \ + gnupg2 \ + iproute \ + procps \ + lsof \ + net-tools \ + psmisc \ + wget \ + ca-certificates \ + rsync \ + unzip \ + xz \ + zip \ + nano \ + vim-minimal \ + less \ + jq \ + openssl-libs \ + krb5-libs \ + libicu \ + zlib \ + sudo \ + sed \ + grep \ + which \ + man-db \ + strace \ + socat" - # Install OpenSSL 1.0 compat if needed - if ${install_cmd} -q list compat-openssl10 >/dev/null 2>&1; then - package_list="${package_list} compat-openssl10" - fi + # Install bubblewrap if available (not present in UBI repositories) + if ${install_cmd} -q list bubblewrap >/dev/null 2>&1; then + package_list="${package_list} bubblewrap" + fi - # Install lsb_release if available - if ${install_cmd} -q list redhat-lsb-core >/dev/null 2>&1; then - package_list="${package_list} redhat-lsb-core" - fi + # rockylinux:9 installs 'curl-minimal' which clashes with 'curl' + # Install 'curl' for every OS except this rockylinux:9 + if [[ "${ID}" = "rocky" ]] && [[ "${VERSION}" != *"9."* ]]; then + package_list="${package_list} curl" + fi - # Install git if not already installed (may be more recent than distro version) - if ! type git > /dev/null 2>&1; then - package_list="${package_list} git" - fi + # Install OpenSSL 1.0 compat if needed + if ${install_cmd} -q list compat-openssl10 >/dev/null 2>&1; then + package_list="${package_list} compat-openssl10" + fi - # Install EPEL repository if needed (required to install 'jq' for CentOS) - if ! ${install_cmd} -q list jq >/dev/null 2>&1; then - ${install_cmd} -y install epel-release - remove_epel="true" - fi + # Install lsb_release if available + if ${install_cmd} -q list redhat-lsb-core >/dev/null 2>&1; then + package_list="${package_list} redhat-lsb-core" + fi + + # Install git if not already installed (may be more recent than distro version) + if ! type git > /dev/null 2>&1; then + package_list="${package_list} git" + fi + + # Install EPEL repository if needed (required to install 'jq' for CentOS) + if [[ "${ID}" = "centos" ]] && ! rpm -q jq >/dev/null 2>&1; then + ${install_cmd} -y install epel-release + remove_epel="true" fi # Install zsh if needed @@ -239,89 +255,114 @@ fi package_list="${package_list} zsh" fi - if [ -n "${package_list}" ]; then - ${install_cmd} -y install ${package_list} + local missing_package_list="" + local packages=() + read -r -a packages <<< "${package_list}" + for package in "${packages[@]}"; do + if ! rpm -q "${package}" >/dev/null 2>&1; then + missing_package_list="${missing_package_list} ${package}" + fi + done + + if [ -n "${missing_package_list}" ]; then + echo "Packages to verify are installed: ${missing_package_list}" + echo "Running ${install_cmd} install..." + if [ "${install_cmd}" = "dnf" ]; then + ${install_cmd} -y install --allowerasing ${missing_package_list} + else + ${install_cmd} -y install ${missing_package_list} + fi fi # Get to latest versions of all packages if [ "${UPGRADE_PACKAGES}" = "true" ]; then + echo "Running ${install_cmd} upgrade..." ${install_cmd} upgrade -y fi if [[ "${remove_epel}" = "true" ]]; then ${install_cmd} -y remove epel-release fi - - PACKAGES_ALREADY_INSTALLED="true" } # Alpine Linux packages install_alpine_packages() { apk update + local package_list="" - if [ "${PACKAGES_ALREADY_INSTALLED}" != "true" ]; then - apk add --no-cache \ - openssh-client \ - bash-completion \ - gnupg \ - procps \ - lsof \ - htop \ - net-tools \ - psmisc \ - curl \ - wget \ - rsync \ - ca-certificates \ - unzip \ - xz \ - zip \ - nano \ - vim \ - less \ - jq \ - libgcc \ - libstdc++ \ - krb5-libs \ - libintl \ - lttng-ust \ - tzdata \ - userspace-rcu \ - zlib \ - sudo \ - coreutils \ - sed \ - grep \ - which \ - ncdu \ - shadow \ - strace - - # # Include libssl1.1 if available (not available for 3.19 and newer) - LIBSSL1_PKG=libssl1.1 - if [[ $(apk search --no-cache -a $LIBSSL1_PKG | grep $LIBSSL1_PKG) ]]; then - apk add --no-cache $LIBSSL1_PKG - fi + package_list="${package_list} \ + openssh-client \ + bash-completion \ + gnupg \ + procps \ + lsof \ + htop \ + net-tools \ + psmisc \ + curl \ + wget \ + rsync \ + ca-certificates \ + unzip \ + xz \ + zip \ + nano \ + vim \ + less \ + jq \ + libgcc \ + libstdc++ \ + krb5-libs \ + libintl \ + lttng-ust \ + tzdata \ + userspace-rcu \ + zlib \ + sudo \ + coreutils \ + sed \ + grep \ + which \ + ncdu \ + shadow \ + strace \ + bubblewrap \ + socat" - # Install man pages - package name varies between 3.12 and earlier versions - if apk info man > /dev/null 2>&1; then - apk add --no-cache man man-pages - else - apk add --no-cache mandoc man-pages - fi + # # Include libssl1.1 if available (not available for 3.19 and newer) + LIBSSL1_PKG=libssl1.1 + if [[ $(apk search --no-cache -a $LIBSSL1_PKG | grep $LIBSSL1_PKG) ]]; then + package_list="${package_list} $LIBSSL1_PKG" + fi - # Install git if not already installed (may be more recent than distro version) - if ! type git > /dev/null 2>&1; then - apk add --no-cache git - fi + # Install man pages - package name varies between 3.12 and earlier versions + if apk info man > /dev/null 2>&1; then + package_list="${package_list} man man-pages" + else + package_list="${package_list} mandoc man-pages" + fi + + # Install git if not already installed (may be more recent than distro version) + if ! type git > /dev/null 2>&1; then + package_list="${package_list} git" fi # Install zsh if needed if [ "${INSTALL_ZSH}" = "true" ] && ! type zsh > /dev/null 2>&1; then - apk add --no-cache zsh + package_list="${package_list} zsh" fi - PACKAGES_ALREADY_INSTALLED="true" + local missing_package_list="" + local packages=() + read -r -a packages <<< "${package_list}" + for package in "${packages[@]}"; do + if ! apk info -e "${package}" >/dev/null 2>&1; then + missing_package_list="${missing_package_list} ${package}" + fi + done + if [ -n "${missing_package_list}" ]; then + apk add --no-cache ${missing_package_list} + fi } # ****************** @@ -368,14 +409,6 @@ if [ "${ADJUSTED_ID}" = "rhel" ] && [ "${VERSION_CODENAME-}" = "centos7" ]; then sed -i s/^mirrorlist=http/#mirrorlist=http/g /etc/yum.repos.d/*.repo fi -if [ "${ADJUSTED_ID}" = "rhel" ] && [ "${VERSION_CODENAME-}" = "centos7" ]; then - # As of 1 July 2024, mirrorlist.centos.org no longer exists. - # Update the repo files to reference vault.centos.org. - sed -i s/mirror.centos.org/vault.centos.org/g /etc/yum.repos.d/*.repo - sed -i s/^#.*baseurl=http/baseurl=http/g /etc/yum.repos.d/*.repo - sed -i s/^mirrorlist=http/#mirrorlist=http/g /etc/yum.repos.d/*.repo -fi - # Install packages for appropriate OS case "${ADJUSTED_ID}" in "debian") @@ -558,7 +591,7 @@ if [ "${INSTALL_ZSH}" = "true" ]; then # Add devcontainer .zshrc template if [ "$INSTALL_OH_MY_ZSH_CONFIG" = "true" ]; then if ! [ -f "${template_path}" ] || ! grep -qF "$(head -n 1 "${template_path}")" "${user_rc_file}"; then - echo -e "$(cat "${template_path}")\nDISABLE_AUTO_UPDATE=true\nDISABLE_UPDATE_PROMPT=true" > ${user_rc_file} + echo -e "$(cat "${template_path}")\nzstyle ':omz:update' mode disabled" > ${user_rc_file} fi sed -i -e 's/ZSH_THEME=.*/ZSH_THEME="devcontainers"/g' ${user_rc_file} fi @@ -607,7 +640,6 @@ if [ ! -d "/usr/local/etc/vscode-dev-containers" ]; then mkdir -p "$(dirname "${MARKER_FILE}")" fi echo -e "\ - PACKAGES_ALREADY_INSTALLED=${PACKAGES_ALREADY_INSTALLED}\n\ LOCALE_ALREADY_SET=${LOCALE_ALREADY_SET}\n\ EXISTING_NON_ROOT_USER=${EXISTING_NON_ROOT_USER}\n\ RC_SNIPPET_ALREADY_ADDED=${RC_SNIPPET_ALREADY_ADDED}\n\ diff --git a/src/conda/NOTES.md b/src/conda/NOTES.md index ef8657ab4..98189ccc4 100644 --- a/src/conda/NOTES.md +++ b/src/conda/NOTES.md @@ -15,6 +15,6 @@ conda install python=3.7 ## OS Support -This Feature should work on recent versions of Debian/Ubuntu-based distributions with the `apt` package manager installed. +This Feature should work on recent versions of Debian/Ubuntu-based distributions with the `apt` package manager installed. Both `x86_64` and `aarch64` architectures are supported. `bash` is required to execute the `install.sh` script. diff --git a/src/conda/README.md b/src/conda/README.md index 2e123f2c7..eaee45b2d 100644 --- a/src/conda/README.md +++ b/src/conda/README.md @@ -7,7 +7,7 @@ A cross-platform, language-agnostic binary package manager ```json "features": { - "ghcr.io/devcontainers/features/conda:1": {} + "ghcr.io/devcontainers/features/conda:2": {} } ``` diff --git a/src/conda/devcontainer-feature.json b/src/conda/devcontainer-feature.json index 163696a20..8c66d4ef1 100644 --- a/src/conda/devcontainer-feature.json +++ b/src/conda/devcontainer-feature.json @@ -1,43 +1,43 @@ { - "id": "conda", - "version": "1.0.10", - "name": "Conda", - "description": "A cross-platform, language-agnostic binary package manager", - "documentationURL": "https://github.com/devcontainers/features/tree/main/src/conda", - "options": { - "version": { - "type": "string", - "proposals": [ - "latest", - "4.11.0", - "4.12.0" - ], - "default": "latest", - "description": "Select or enter a conda version." - }, - "addCondaForge": { - "type": "boolean", - "default": false, - "description": "Add conda-forge channel to the config?" - } + "id": "conda", + "version": "2.0.1", + "name": "Conda", + "description": "A cross-platform, language-agnostic binary package manager", + "documentationURL": "https://github.com/devcontainers/features/tree/main/src/conda", + "options": { + "version": { + "type": "string", + "proposals": [ + "latest", + "24.11.3", + "24.7.1" + ], + "default": "latest", + "description": "Select or enter a conda version." }, - "containerEnv": { - "CONDA_DIR": "/opt/conda", - "CONDA_SCRIPT":"/opt/conda/etc/profile.d/conda.sh", - "PATH": "/opt/conda/bin:${PATH}" - }, - "customizations": { - "vscode": { - "settings": { - "github.copilot.chat.codeGeneration.instructions": [ - { - "text": "This dev container includes the conda package manager pre-installed and available on the `PATH` for data science and Python development. Additional packages installed using Conda will be downloaded from Anaconda or another repository configured by the user. A user can install different versions of Python than the one in this dev container by running a command like: conda install python=3.7" - } - ] - } - } - }, - "installsAfter": [ - "ghcr.io/devcontainers/features/common-utils" - ] + "addCondaForge": { + "type": "boolean", + "default": false, + "description": "Add conda-forge channel to the config?" + } + }, + "containerEnv": { + "CONDA_DIR": "/opt/conda", + "CONDA_SCRIPT": "/opt/conda/etc/profile.d/conda.sh", + "PATH": "/opt/conda/bin:${PATH}" + }, + "customizations": { + "vscode": { + "settings": { + "github.copilot.chat.codeGeneration.instructions": [ + { + "text": "This dev container includes the conda package manager pre-installed and available on the `PATH` for data science and Python development. Additional packages installed using Conda will be downloaded from Anaconda or another repository configured by the user. A user can install different versions of Python than the one in this dev container by running a command like: conda install python=3.7" + } + ] + } + } + }, + "installsAfter": [ + "ghcr.io/devcontainers/features/common-utils" + ] } diff --git a/src/conda/install.sh b/src/conda/install.sh index 43ab82f54..fdc050c7a 100644 --- a/src/conda/install.sh +++ b/src/conda/install.sh @@ -45,10 +45,14 @@ elif [ "${USERNAME}" = "none" ] || ! id -u ${USERNAME} > /dev/null 2>&1; then fi architecture="$(uname -m)" -if [ "${architecture}" != "x86_64" ]; then - echo "(!) Architecture $architecture unsupported" - exit 1 -fi +case "${architecture}" in + x86_64) MINICONDA_ARCH="x86_64" ;; + aarch64|arm64) MINICONDA_ARCH="aarch64" ;; + *) + echo "(!) Architecture $architecture unsupported" + exit 1 + ;; +esac # Checks if packages are installed and installs them if not check_packages() { @@ -75,6 +79,30 @@ install_user_package() { sudo_if "${CONDA_DIR}/bin/python3" -m pip install --user --upgrade "$PACKAGE" } +accept_anaconda_tos_if_needed() { + if ! "${CONDA_DIR}/bin/conda" tos --help > /dev/null 2>&1; then + return 0 + fi + + for channel in "https://repo.anaconda.com/pkgs/main" "https://repo.anaconda.com/pkgs/r"; do + echo "Accepting Conda Terms of Service for ${channel}..." + # Accept as root (for install-time commands) + "${CONDA_DIR}/bin/conda" tos accept --override-channels --channel "${channel}" + # Accept as the target user (for runtime usage) + sudo_if "${CONDA_DIR}/bin/conda" tos accept --override-channels --channel "${channel}" + done +} + +clean_conda_cache() { + "${CONDA_DIR}/bin/conda" clean --all --yes + find "${CONDA_DIR}" -type f -name '*.pyc' -delete + find "${CONDA_DIR}" -type d -name '__pycache__' -exec rm -rf {} + + rm -rf "${CONDA_DIR}/pkgs/cache" /root/.cache/pip + if [ "${USERNAME}" != "root" ]; then + rm -rf "/home/${USERNAME}/.cache/pip" + fi +} + # Install Conda if it's missing if ! conda --version &> /dev/null ; then if ! cat /etc/group | grep -e "^conda:" > /dev/null 2>&1; then @@ -83,22 +111,38 @@ if ! conda --version &> /dev/null ; then usermod -a -G conda "${USERNAME}" # Install dependencies - check_packages curl ca-certificates gnupg2 + check_packages curl ca-certificates - echo "Installing Conda..." + echo "Installing Conda via Miniconda installer..." - curl -sS https://repo.anaconda.com/pkgs/misc/gpgkeys/anaconda.asc | gpg --dearmor > /usr/share/keyrings/conda-archive-keyring.gpg - echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/conda-archive-keyring.gpg] https://repo.anaconda.com/pkgs/misc/debrepo/conda stable main" > /etc/apt/sources.list.d/conda.list - apt-get update -y + # Download and run the official Miniconda installer + MINICONDA_INSTALLER="$(mktemp -t miniconda_XXXXXX.sh)" + MINICONDA_URL="https://repo.anaconda.com/miniconda/Miniconda3-latest-Linux-${MINICONDA_ARCH}.sh" - CONDA_PKG="conda=${VERSION}-0" - if [ "${VERSION}" = "latest" ]; then - CONDA_PKG="conda" + echo "Downloading Miniconda installer from ${MINICONDA_URL}..." + if ! curl -fsSL --connect-timeout 10 --max-time 120 "${MINICONDA_URL}" -o "${MINICONDA_INSTALLER}"; then + echo "ERROR: Failed to download Miniconda installer from ${MINICONDA_URL}" + rm -f "${MINICONDA_INSTALLER}" + exit 1 fi - check_packages $CONDA_PKG + # Run installer in batch mode (no prompts) and install to CONDA_DIR + bash "${MINICONDA_INSTALLER}" -b -p "${CONDA_DIR}" + rm -f "${MINICONDA_INSTALLER}" + + # Conda defaults channels now require a non-interactive ToS acknowledgement. + accept_anaconda_tos_if_needed + + # Install specific conda version if requested (latest Miniconda already bundles a recent conda) + if [ "${VERSION}" != "latest" ]; then + echo "Installing conda version ${VERSION}..." + if ! "${CONDA_DIR}/bin/conda" install -y "conda=${VERSION}"; then + echo "ERROR: Failed to install conda version ${VERSION}. Please verify the version is valid and available." + exit 1 + fi + fi - CONDA_SCRIPT="/opt/conda/etc/profile.d/conda.sh" + CONDA_SCRIPT="${CONDA_DIR}/etc/profile.d/conda.sh" . $CONDA_SCRIPT if [ "${ADD_CONDA_FORGE}" = "true" ]; then @@ -114,13 +158,7 @@ if ! conda --version &> /dev/null ; then find "${CONDA_DIR}" -type d -print0 | xargs -n 1 -0 chmod g+s - # Temporary fixes - # Due to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23491 - install_user_package certifi - # Due to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0286 and https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23931 - install_user_package cryptography - # Due to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40897 - install_user_package setuptools + clean_conda_cache fi # Display a notice on conda when not running in GitHub Codespaces diff --git a/src/copilot-cli/NOTES.md b/src/copilot-cli/NOTES.md new file mode 100644 index 000000000..c5393ab5a --- /dev/null +++ b/src/copilot-cli/NOTES.md @@ -0,0 +1,7 @@ + + +## OS Support + +This Feature should work on recent versions of Debian/Ubuntu-based distributions. + +`bash` is required to execute the `install.sh` script. diff --git a/src/copilot-cli/README.md b/src/copilot-cli/README.md new file mode 100644 index 000000000..3b7fc3be5 --- /dev/null +++ b/src/copilot-cli/README.md @@ -0,0 +1,31 @@ + +# GitHub Copilot CLI (copilot-cli) + +Installs the GitHub Copilot CLI. Auto-detects latest version and installs needed dependencies. + +## Example Usage + +```json +"features": { + "ghcr.io/devcontainers/features/copilot-cli:1": {} +} +``` + +## Options + +| Options Id | Description | Type | Default Value | +|-----|-----|-----|-----| +| version | Select version of the GitHub Copilot CLI, if not latest. | string | latest | + + + +## OS Support + +This Feature should work on recent versions of Debian/Ubuntu-based distributions. + +`bash` is required to execute the `install.sh` script. + + +--- + +_Note: This file was auto-generated from the [devcontainer-feature.json](https://github.com/devcontainers/features/blob/main/src/copilot-cli/devcontainer-feature.json). Add additional notes to a `NOTES.md`._ \ No newline at end of file diff --git a/src/copilot-cli/devcontainer-feature.json b/src/copilot-cli/devcontainer-feature.json new file mode 100644 index 000000000..f4db33ced --- /dev/null +++ b/src/copilot-cli/devcontainer-feature.json @@ -0,0 +1,34 @@ +{ + "id": "copilot-cli", + "version": "1.1.3", + "name": "GitHub Copilot CLI", + "documentationURL": "https://github.com/devcontainers/features/tree/main/src/copilot-cli", + "description": "Installs the GitHub Copilot CLI.", + "options": { + "version": { + "type": "string", + "proposals": [ + "latest", + "prerelease" + ], + "default": "latest", + "description": "Select version of the GitHub Copilot CLI, if not latest." + } + }, + "postStartCommand": "[ -f /etc/devcontainer-copilot-cli/auto-update ] && copilot update || true", + "customizations": { + "vscode": { + "settings": { + "github.copilot.chat.codeGeneration.instructions": [ + { + "text": "This dev container includes the GitHub Copilot CLI (`copilot`), which is pre-installed and available on the `PATH`." + } + ] + } + } + }, + "installsAfter": [ + "ghcr.io/devcontainers/features/common-utils" + ] +} + diff --git a/src/copilot-cli/install.sh b/src/copilot-cli/install.sh new file mode 100755 index 000000000..ad4a19701 --- /dev/null +++ b/src/copilot-cli/install.sh @@ -0,0 +1,98 @@ +#!/usr/bin/env bash +#------------------------------------------------------------------------------------------------------------- +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information. +#------------------------------------------------------------------------------------------------------------- +# +# Docs: https://github.com/devcontainers/features/blob/main/src/copilot-cli/README.md +# Maintainer: The VS Code and Codespaces Teams + +CLI_VERSION=${VERSION:-"latest"} + +set -e + +if [ "$(id -u)" -ne 0 ]; then + echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.' + exit 1 +fi + +apt_get_update() { + if [ "$(find /var/lib/apt/lists/* | wc -l)" = "0" ]; then + echo "Running apt-get update..." + apt-get update -y + fi +} + +# Checks if packages are installed and installs them if not +check_packages() { + if ! dpkg -s "$@" > /dev/null 2>&1; then + apt_get_update + apt-get -y install --no-install-recommends "$@" + fi +} + +resolve_prerelease_version() { + local repo_versions="${1:?resolve_prerelease_version requires the copilot-cli repo tags as input}" + printf '%s\n' "${repo_versions}" \ + | awk '{print $2}' | sed 's|refs/tags/||' \ + | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9]+)?$' \ + | sort -V | tail -n1 +} + +download_from_github() { + local release_url=$1 + echo "Downloading GitHub Copilot CLI from ${release_url}..." + + mkdir -p /tmp/copilotcli + pushd /tmp/copilotcli + wget --show-progress --progress=dot:giga ${release_url} + # curl -fL# -O ${release_url} + tar -xzf /tmp/copilotcli/${cli_filename} + mv copilot /usr/local/bin/copilot + popd + rm -rf /tmp/copilotcli +} + +install_using_github() { + check_packages wget tar ca-certificates git + echo "Finished setting up dependencies" + arch=$(dpkg --print-architecture) + if [ "${arch}" = "amd64" ]; then + arch="x64" + fi + if [ "${arch}" != "x64" ] && [ "${arch}" != "arm64" ]; then + echo "Unsupported architecture: ${arch}" >&2 + exit 1 + fi + cli_filename="copilot-linux-${arch}.tar.gz" + echo "Installing GitHub Copilot CLI for ${arch} architecture: ${cli_filename}" + + # Install latest + if [ "${CLI_VERSION}" = "latest" ]; then + download_from_github "https://github.com/github/copilot-cli/releases/latest/download/${cli_filename}" + elif [ "${CLI_VERSION}" = "prerelease" ]; then + + prerelease_version="$(resolve_prerelease_version "$(git ls-remote --tags https://github.com/github/copilot-cli)")" + download_from_github "https://github.com/github/copilot-cli/releases/download/${prerelease_version}/${cli_filename}" + + else + # Install specific version + # Add leading v to version if it doesn't start with v + if [[ ! "${CLI_VERSION}" =~ ^v[0-9] ]]; then + CLI_VERSION="v${CLI_VERSION}" + fi + download_from_github "https://github.com/github/copilot-cli/releases/download/${CLI_VERSION}/${cli_filename}" + fi +} + +# Install the GitHub Copilot CLI +echo "Downloading GitHub Copilot CLI..." + +install_using_github + +# Create a flag file if using "latest" or "prerelease" so the postStartCommand knows to auto-update +if [ "${CLI_VERSION}" = "latest" ] || [ "${CLI_VERSION}" = "prerelease" ]; then + mkdir -p /etc/devcontainer-copilot-cli + touch /etc/devcontainer-copilot-cli/auto-update +fi + diff --git a/src/desktop-lite/devcontainer-feature.json b/src/desktop-lite/devcontainer-feature.json index d33529873..891ac6d73 100644 --- a/src/desktop-lite/devcontainer-feature.json +++ b/src/desktop-lite/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "desktop-lite", - "version": "1.2.7", + "version": "1.2.10", "name": "Light-weight Desktop", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/desktop-lite", "description": "Adds a lightweight Fluxbox based desktop to the container that can be accessed using a VNC viewer or the web. GUI-based commands executed from the built-in VS code terminal will open on the desktop automatically.", diff --git a/src/desktop-lite/install.sh b/src/desktop-lite/install.sh index bb659e784..0d6d6e31d 100755 --- a/src/desktop-lite/install.sh +++ b/src/desktop-lite/install.sh @@ -31,7 +31,6 @@ package_list=" fbautostart \ at-spi2-core \ xterm \ - eterm \ nautilus\ mousepad \ seahorse \ @@ -169,6 +168,19 @@ check_packages() { fi } +find_available_package() { + local candidate + local package_name + for package_name in "$@"; do + candidate="$(apt-cache policy "${package_name}" | awk '/Candidate:/ {print $2}')" + if [ -n "${candidate}" ] && [ "${candidate}" != "(none)" ]; then + echo "${package_name}" + return 0 + fi + done + return 1 +} + ########################## # Install starts here # ########################## @@ -200,15 +212,12 @@ fi # Install X11, fluxbox and VS Code dependencies check_packages ${package_list} -# if Ubuntu-24.04, noble(numbat) found, then will install libasound2-dev instead of libasound2. -# this change is temporary, https://packages.ubuntu.com/noble/libasound2 will switch to libasound2 once it is available for Ubuntu-24.04, noble(numbat) -. /etc/os-release -if [ "${ID}" = "ubuntu" ] && [ "${VERSION_CODENAME}" = "noble" ]; then - echo "Ubuntu 24.04, Noble(Numbat) detected. Installing libasound2-dev package..." - check_packages "libasound2-dev" -else - check_packages "libasound2" +if ! alsa_package="$(find_available_package libasound2t64 libasound2 libasound2-dev)"; then + echo "(!) No supported ALSA package found. Tried: libasound2, libasound2t64, libasound2-dev." >&2 + exit 1 fi +echo "Installing ${alsa_package} package..." +check_packages "${alsa_package}" # On newer versions of Ubuntu (22.04), # we need an additional package that isn't provided in earlier versions @@ -410,9 +419,9 @@ else fi # Run whatever was passed in -if [ -n "$1" ]; then +if [ -n "\$1" ]; then log "Executing \"\$@\"." - exec "$@" + exec "\$@" else log "No command provided to execute." fi diff --git a/src/docker-in-docker/NOTES.md b/src/docker-in-docker/NOTES.md index b8156f8b6..693afd41f 100644 --- a/src/docker-in-docker/NOTES.md +++ b/src/docker-in-docker/NOTES.md @@ -4,7 +4,7 @@ This docker-in-docker Dev Container Feature is roughly based on the [official do * As the name implies, the Feature is expected to work when the host is running Docker (or the OSS Moby container engine it is built on). It may be possible to get running in other container engines, but it has not been tested with them. * The host and the container must be running on the same chip architecture. You will not be able to use it with an emulated x86 image with Docker Desktop on an Apple Silicon Mac, like in this example: ``` - FROM --platform=linux/amd64 mcr.microsoft.com/devcontainers/typescript-node:16 + FROM --platform=linux/amd64 mcr.microsoft.com/devcontainers/typescript-node:24 ``` See [Issue #219](https://github.com/devcontainers/features/issues/219) for more details. @@ -13,4 +13,19 @@ This docker-in-docker Dev Container Feature is roughly based on the [official do This Feature should work on recent versions of Debian/Ubuntu-based distributions with the `apt` package manager installed. +Debian Trixie (13) does not include moby-cli and related system packages, so the feature cannot install with "moby": "true". To use this feature on Trixie, please set "moby": "false" or choose a different base image (for example, Ubuntu 24.04). + +Ubuntu 26.04 (Resolute) does not currently have moby packages available, so the feature cannot install with "moby": "true". To use this feature on Resolute, please set "moby": "false". Additionally, the kernel on Ubuntu 26.04 no longer supports legacy iptables NAT tables, so the feature automatically falls back to `iptables-nft` when `iptables-legacy` is not functional. + `bash` is required to execute the `install.sh` script. + +## Persisted state + +This Feature mounts two named Docker volumes into the dev container so that the daemons have writable, non-overlay storage for their state: + +* `dind-var-lib-docker-${devcontainerId}` → `/var/lib/docker` +* `dind-var-lib-containerd-${devcontainerId}` → `/var/lib/containerd` + +The `/var/lib/containerd` mount is required when the dev container's root filesystem is itself an overlayfs mount (the default in Kubernetes / containerd-backed hosts, GitHub Codespaces, and Docker with the containerd image store enabled). Without it, the standalone `containerd` started by this Feature would place its overlayfs snapshotter data on an overlay rootfs, causing overlay-on-overlay mounts to fail with `invalid argument`. See [issue #1639](https://github.com/devcontainers/features/issues/1639) for background. + +Because both volumes are scoped to `${devcontainerId}`, each dev container gets its own state and rebuilds preserve images and snapshots. Removing the dev container does not automatically remove these volumes; clean them up with `docker volume rm` if you want to reclaim space. diff --git a/src/docker-in-docker/README.md b/src/docker-in-docker/README.md index 3fdbcc312..6bba801a8 100644 --- a/src/docker-in-docker/README.md +++ b/src/docker-in-docker/README.md @@ -7,7 +7,7 @@ Create child containers *inside* a container, independent from the host's docker ```json "features": { - "ghcr.io/devcontainers/features/docker-in-docker:2": {} + "ghcr.io/devcontainers/features/docker-in-docker:4": {} } ``` @@ -18,12 +18,13 @@ Create child containers *inside* a container, independent from the host's docker | version | Select or enter a Docker/Moby Engine version. (Availability can vary by OS version.) | string | latest | | moby | Install OSS Moby build instead of Docker CE | boolean | true | | mobyBuildxVersion | Install a specific version of moby-buildx when using Moby | string | latest | -| dockerDashComposeVersion | Default version of Docker Compose (v1, v2 or none) | string | v2 | +| dockerDashComposeVersion | Default version of Docker Compose (v1, v2, latest or none) | string | latest | | azureDnsAutoDetection | Allow automatically setting the dockerd DNS server when the installation script detects it is running in Azure | boolean | true | | dockerDefaultAddressPool | Define default address pools for Docker networks. e.g. base=192.168.0.0/16,size=24 | string | - | | installDockerBuildx | Install Docker Buildx | boolean | true | -| installDockerComposeSwitch | Install Compose Switch (provided docker compose is available) which is a replacement to the Compose V1 docker-compose (python) executable. It translates the command line into Compose V2 docker compose then runs the latter. | boolean | true | +| installDockerComposeSwitch | Install Compose Switch (provided docker compose is available) which is a replacement to the Compose V1 docker-compose (python) executable. It translates the command line into Compose V2 docker compose then runs the latter. | boolean | false | | disableIp6tables | Disable ip6tables (this option is only applicable for Docker versions 27 and greater) | boolean | false | +| iptablesSwitchAtRuntime | If true, the iptables alternative is selected at container start (inside docker-init.sh) instead of at image build time. Useful when the desired iptables backend depends on the host kernel at runtime rather than at build time. | boolean | true | ## Customizations diff --git a/src/docker-in-docker/devcontainer-feature.json b/src/docker-in-docker/devcontainer-feature.json index e44f2d666..2710a2e32 100644 --- a/src/docker-in-docker/devcontainer-feature.json +++ b/src/docker-in-docker/devcontainer-feature.json @@ -1,94 +1,105 @@ { - "id": "docker-in-docker", - "version": "2.12.2", - "name": "Docker (Docker-in-Docker)", - "documentationURL": "https://github.com/devcontainers/features/tree/main/src/docker-in-docker", - "description": "Create child containers *inside* a container, independent from the host's docker instance. Installs Docker extension in the container along with needed CLIs.", - "options": { - "version": { - "type": "string", - "proposals": [ - "latest", - "none", - "20.10" - ], - "default": "latest", - "description": "Select or enter a Docker/Moby Engine version. (Availability can vary by OS version.)" - }, - "moby": { - "type": "boolean", - "default": true, - "description": "Install OSS Moby build instead of Docker CE" - }, - "mobyBuildxVersion": { - "type": "string", - "default": "latest", - "description": "Install a specific version of moby-buildx when using Moby" - }, - "dockerDashComposeVersion": { - "type": "string", - "enum": [ - "none", - "v1", - "v2" - ], - "default": "v2", - "description": "Default version of Docker Compose (v1, v2 or none)" - }, - "azureDnsAutoDetection": { - "type": "boolean", - "default": true, - "description": "Allow automatically setting the dockerd DNS server when the installation script detects it is running in Azure" - }, - "dockerDefaultAddressPool": { - "type": "string", - "default": "", - "proposals": [], - "description": "Define default address pools for Docker networks. e.g. base=192.168.0.0/16,size=24" - }, - "installDockerBuildx": { - "type": "boolean", - "default": true, - "description": "Install Docker Buildx" - }, - "installDockerComposeSwitch": { - "type": "boolean", - "default": true, - "description": "Install Compose Switch (provided docker compose is available) which is a replacement to the Compose V1 docker-compose (python) executable. It translates the command line into Compose V2 docker compose then runs the latter." - }, - "disableIp6tables": { - "type": "boolean", - "default": false, - "description": "Disable ip6tables (this option is only applicable for Docker versions 27 and greater)" - } + "id": "docker-in-docker", + "version": "4.0.0", + "name": "Docker (Docker-in-Docker)", + "documentationURL": "https://github.com/devcontainers/features/tree/main/src/docker-in-docker", + "description": "Create child containers *inside* a container, independent from the host's docker instance. Installs Docker extension in the container along with needed CLIs.", + "options": { + "version": { + "type": "string", + "proposals": [ + "latest", + "none", + "20.10" + ], + "default": "latest", + "description": "Select or enter a Docker/Moby Engine version. (Availability can vary by OS version.)" }, - "entrypoint": "/usr/local/share/docker-init.sh", - "privileged": true, - "containerEnv": { - "DOCKER_BUILDKIT": "1" + "moby": { + "type": "boolean", + "default": true, + "description": "Install OSS Moby build instead of Docker CE" }, - "customizations": { - "vscode": { - "extensions": [ - "ms-azuretools.vscode-containers" - ], - "settings": { - "github.copilot.chat.codeGeneration.instructions": [ - { - "text": "This dev container includes the Docker CLI (`docker`) pre-installed and available on the `PATH` for running and managing containers using a dedicated Docker daemon running inside the dev container." - } - ] - } - } + "mobyBuildxVersion": { + "type": "string", + "default": "latest", + "description": "Install a specific version of moby-buildx when using Moby" }, - "mounts": [ - { - "source": "dind-var-lib-docker-${devcontainerId}", - "target": "/var/lib/docker", - "type": "volume" - } - ], - "installsAfter": [ - "ghcr.io/devcontainers/features/common-utils" - ] + "dockerDashComposeVersion": { + "type": "string", + "enum": [ + "none", + "latest", + "v1", + "v2" + ], + "default": "latest", + "description": "Default version of Docker Compose (v1, v2, latest or none)" + }, + "azureDnsAutoDetection": { + "type": "boolean", + "default": true, + "description": "Allow automatically setting the dockerd DNS server when the installation script detects it is running in Azure" + }, + "dockerDefaultAddressPool": { + "type": "string", + "default": "", + "proposals": [], + "description": "Define default address pools for Docker networks. e.g. base=192.168.0.0/16,size=24" + }, + "installDockerBuildx": { + "type": "boolean", + "default": true, + "description": "Install Docker Buildx" + }, + "installDockerComposeSwitch": { + "type": "boolean", + "default": false, + "description": "Install Compose Switch (provided docker compose is available) which is a replacement to the Compose V1 docker-compose (python) executable. It translates the command line into Compose V2 docker compose then runs the latter." + }, + "disableIp6tables": { + "type": "boolean", + "default": false, + "description": "Disable ip6tables (this option is only applicable for Docker versions 27 and greater)" + }, + "iptablesSwitchAtRuntime": { + "type": "boolean", + "default": true, + "description": "If true, the iptables alternative is selected at container start (inside docker-init.sh) instead of at image build time. Useful when the desired iptables backend depends on the host kernel at runtime rather than at build time." + } + }, + "entrypoint": "/usr/local/share/docker-init.sh", + "privileged": true, + "containerEnv": { + "DOCKER_BUILDKIT": "1" + }, + "customizations": { + "vscode": { + "extensions": [ + "ms-azuretools.vscode-containers" + ], + "settings": { + "github.copilot.chat.codeGeneration.instructions": [ + { + "text": "This dev container includes the Docker CLI (`docker`) pre-installed and available on the `PATH` for running and managing containers using a dedicated Docker daemon running inside the dev container." + } + ] + } + } + }, + "mounts": [ + { + "source": "dind-var-lib-docker-${devcontainerId}", + "target": "/var/lib/docker", + "type": "volume" + }, + { + "source": "dind-var-lib-containerd-${devcontainerId}", + "target": "/var/lib/containerd", + "type": "volume" + } + ], + "installsAfter": [ + "ghcr.io/devcontainers/features/common-utils" + ] } diff --git a/src/docker-in-docker/install.sh b/src/docker-in-docker/install.sh index b43a12918..dbef9ae32 100755 --- a/src/docker-in-docker/install.sh +++ b/src/docker-in-docker/install.sh @@ -11,16 +11,18 @@ DOCKER_VERSION="${VERSION:-"latest"}" # The Docker/Moby Engine + CLI should match in version USE_MOBY="${MOBY:-"true"}" MOBY_BUILDX_VERSION="${MOBYBUILDXVERSION:-"latest"}" -DOCKER_DASH_COMPOSE_VERSION="${DOCKERDASHCOMPOSEVERSION:-"v2"}" #v1, v2 or none +DOCKER_DASH_COMPOSE_VERSION="${DOCKERDASHCOMPOSEVERSION:-"latest"}" #v1, v2, latest or none AZURE_DNS_AUTO_DETECTION="${AZUREDNSAUTODETECTION:-"true"}" DOCKER_DEFAULT_ADDRESS_POOL="${DOCKERDEFAULTADDRESSPOOL:-""}" USERNAME="${USERNAME:-"${_REMOTE_USER:-"automatic"}"}" INSTALL_DOCKER_BUILDX="${INSTALLDOCKERBUILDX:-"true"}" -INSTALL_DOCKER_COMPOSE_SWITCH="${INSTALLDOCKERCOMPOSESWITCH:-"true"}" +INSTALL_DOCKER_COMPOSE_SWITCH="${INSTALLDOCKERCOMPOSESWITCH:-"false"}" MICROSOFT_GPG_KEYS_URI="https://packages.microsoft.com/keys/microsoft.asc" -DOCKER_MOBY_ARCHIVE_VERSION_CODENAMES="bookworm buster bullseye bionic focal jammy noble" -DOCKER_LICENSED_ARCHIVE_VERSION_CODENAMES="bookworm buster bullseye bionic focal hirsute impish jammy noble" +MICROSOFT_GPG_KEYS_ROLLING_URI="https://packages.microsoft.com/keys/microsoft-rolling.asc" +DOCKER_MOBY_ARCHIVE_VERSION_CODENAMES="trixie bookworm buster bullseye bionic focal jammy noble" +DOCKER_LICENSED_ARCHIVE_VERSION_CODENAMES="trixie bookworm buster bullseye bionic focal hirsute impish jammy noble resolute" DISABLE_IP6_TABLES="${DISABLEIP6TABLES:-false}" +IPTABLES_SWITCH_AT_RUNTIME="${IPTABLESSWITCHATRUNTIME:-true}" # Default: Exit on any failure. set -e @@ -60,20 +62,45 @@ elif [ "${USERNAME}" = "none" ] || ! id -u ${USERNAME} > /dev/null 2>&1; then USERNAME=root fi -apt_get_update() -{ - if [ "$(find /var/lib/apt/lists/* | wc -l)" = "0" ]; then - echo "Running apt-get update..." - apt-get update -y - fi +# Package manager update function +pkg_mgr_update() { + case ${ADJUSTED_ID} in + debian) + if [ "$(find /var/lib/apt/lists/* | wc -l)" = "0" ]; then + echo "Running apt-get update..." + apt-get update -y + fi + ;; + rhel) + if [ ${PKG_MGR_CMD} = "microdnf" ]; then + cache_check_dir="/var/cache/yum" + else + cache_check_dir="/var/cache/${PKG_MGR_CMD}" + fi + if [ "$(ls ${cache_check_dir}/* 2>/dev/null | wc -l)" = 0 ]; then + echo "Running ${PKG_MGR_CMD} makecache ..." + ${PKG_MGR_CMD} makecache + fi + ;; + esac } # Checks if packages are installed and installs them if not check_packages() { - if ! dpkg -s "$@" > /dev/null 2>&1; then - apt_get_update - apt-get -y install --no-install-recommends "$@" - fi + case ${ADJUSTED_ID} in + debian) + if ! dpkg -s "$@" > /dev/null 2>&1; then + pkg_mgr_update + apt-get -y install --no-install-recommends "$@" + fi + ;; + rhel) + if ! rpm -q "$@" > /dev/null 2>&1; then + pkg_mgr_update + ${PKG_MGR_CMD} -y install "$@" + fi + ;; + esac } # Figure out correct version of a three part version number is not passed @@ -188,65 +215,273 @@ get_github_api_repo_url() { # Ensure apt is in non-interactive to avoid prompts export DEBIAN_FRONTEND=noninteractive - # Source /etc/os-release to get OS info . /etc/os-release -# Fetch host/container arch. -architecture="$(dpkg --print-architecture)" + +# Determine adjusted ID and package manager +if [ "${ID}" = "debian" ] || [ "${ID_LIKE}" = "debian" ]; then + ADJUSTED_ID="debian" + PKG_MGR_CMD="apt-get" + # Use dpkg for Debian-based systems + architecture="$(dpkg --print-architecture 2>/dev/null || uname -m)" +elif [[ "${ID}" = "rhel" || "${ID}" = "fedora" || "${ID}" = "azurelinux" || "${ID}" = "mariner" || "${ID_LIKE}" = *"rhel"* || "${ID_LIKE}" = *"fedora"* || "${ID_LIKE}" = *"azurelinux"* || "${ID_LIKE}" = *"mariner"* ]]; then + ADJUSTED_ID="rhel" + # Determine the appropriate package manager for RHEL-based systems + for pkg_mgr in tdnf dnf microdnf yum; do + if command -v "$pkg_mgr" >/dev/null 2>&1; then + PKG_MGR_CMD="$pkg_mgr" + break + fi + done + + if [ -z "${PKG_MGR_CMD}" ]; then + err "Unable to find a supported package manager (tdnf, dnf, microdnf, yum)" + exit 1 + fi + + architecture="$(rpm --eval '%{_arch}' 2>/dev/null || uname -m)" +else + err "Linux distro ${ID} not supported." + exit 1 +fi + +# Azure Linux specific setup +if [ "${ID}" = "azurelinux" ]; then + VERSION_CODENAME="azurelinux${VERSION_ID}" +fi + +# Prevent attempting to install Moby on Debian trixie/resolute (packages removed) +if [ "${USE_MOBY}" = "true" ] && [ "${ADJUSTED_ID}" = "debian" ] && ([ "${VERSION_CODENAME}" = "trixie" ] || [ "${VERSION_CODENAME}" = "resolute" ]); then + err "The 'moby' option is not supported on ${ID} '${VERSION_CODENAME}' because 'moby-cli' and related system packages are not available in that distribution." + err "To continue, either set the feature option '\"moby\": false' or use a different base image." + exit 1 +fi # Check if distro is supported if [ "${USE_MOBY}" = "true" ]; then - if [[ "${DOCKER_MOBY_ARCHIVE_VERSION_CODENAMES}" != *"${VERSION_CODENAME}"* ]]; then - err "Unsupported distribution version '${VERSION_CODENAME}'. To resolve, either: (1) set feature option '\"moby\": false' , or (2) choose a compatible OS distribution" - err "Support distributions include: ${DOCKER_MOBY_ARCHIVE_VERSION_CODENAMES}" - exit 1 + if [ "${ADJUSTED_ID}" = "debian" ]; then + if [[ "${DOCKER_MOBY_ARCHIVE_VERSION_CODENAMES}" != *"${VERSION_CODENAME}"* ]]; then + err "Unsupported distribution version '${VERSION_CODENAME}'. To resolve, either: (1) set feature option '\"moby\": false' , or (2) choose a compatible OS distribution" + err "Supported distributions include: ${DOCKER_MOBY_ARCHIVE_VERSION_CODENAMES}" + exit 1 + fi + echo "(*) ${VERSION_CODENAME} is supported for Moby installation - setting up Microsoft repository" + elif [ "${ADJUSTED_ID}" = "rhel" ]; then + if [ "${ID}" = "azurelinux" ] || [ "${ID}" = "mariner" ]; then + echo " (*) ${ID} ${VERSION_ID} detected - using Microsoft repositories for Moby packages" + else + echo "RHEL-based system (${ID}) detected - Moby packages may require additional configuration" + fi fi - echo "Distro codename '${VERSION_CODENAME}' matched filter '${DOCKER_MOBY_ARCHIVE_VERSION_CODENAMES}'" else - if [[ "${DOCKER_LICENSED_ARCHIVE_VERSION_CODENAMES}" != *"${VERSION_CODENAME}"* ]]; then - err "Unsupported distribution version '${VERSION_CODENAME}'. To resolve, please choose a compatible OS distribution" - err "Support distributions include: ${DOCKER_LICENSED_ARCHIVE_VERSION_CODENAMES}" - exit 1 + if [ "${ADJUSTED_ID}" = "debian" ]; then + if [[ "${DOCKER_LICENSED_ARCHIVE_VERSION_CODENAMES}" != *"${VERSION_CODENAME}"* ]]; then + err "Unsupported distribution version '${VERSION_CODENAME}'. To resolve, please choose a compatible OS distribution" + err "Supported distributions include: ${DOCKER_LICENSED_ARCHIVE_VERSION_CODENAMES}" + exit 1 + fi + echo "(*) ${VERSION_CODENAME} is supported for Docker CE installation (supported: ${DOCKER_LICENSED_ARCHIVE_VERSION_CODENAMES}) - setting up Docker repository" + elif [ "${ADJUSTED_ID}" = "rhel" ]; then + + echo "RHEL-based system (${ID}) detected - using Docker CE packages" fi - echo "Distro codename '${VERSION_CODENAME}' matched filter '${DOCKER_LICENSED_ARCHIVE_VERSION_CODENAMES}'" fi -# Install dependencies -check_packages apt-transport-https curl ca-certificates pigz iptables gnupg2 dirmngr wget jq -if ! type git > /dev/null 2>&1; then +# Install base dependencies +# Note: erofs-utils provides mkfs.erofs, required by containerd >= 2.3.x snapshotter +# to avoid "failed to check mkfs.erofs availability" errors at dockerd startup +# (see https://github.com/devcontainers/features/issues/1642). +base_packages="curl ca-certificates pigz iptables gnupg2 wget jq" +case ${ADJUSTED_ID} in + debian) + check_packages apt-transport-https $base_packages dirmngr erofs-utils + ;; + rhel) + check_packages $base_packages tar gawk shadow-utils policycoreutils procps-ng systemd-libs systemd-devel + + ;; +esac + +# Install git if not already present +if ! command -v git >/dev/null 2>&1; then check_packages git fi -# Swap to legacy iptables for compatibility -if type iptables-legacy > /dev/null 2>&1; then - update-alternatives --set iptables /usr/sbin/iptables-legacy - update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy +# Update CA certificates to ensure HTTPS connections work properly +# This is especially important for Ubuntu 24.04 (Noble) and Debian Trixie +# Only run for Debian-based systems (RHEL uses update-ca-trust instead) +if [ "${ADJUSTED_ID}" = "debian" ] && command -v update-ca-certificates > /dev/null 2>&1; then + update-ca-certificates fi +# Swap to legacy iptables for compatibility (Debian only) - install-time path. +# When IPTABLES_SWITCH_AT_RUNTIME=true the same logic is emitted into +# docker-init.sh and runs at container start instead. +if [ "${IPTABLES_SWITCH_AT_RUNTIME}" != "true" ] && [ "${ADJUSTED_ID}" = "debian" ]; then + # On distros where legacy iptables is no longer kernel-supported (e.g. Ubuntu 26.04 / resolute), + # prefer iptables-nft. Otherwise prefer legacy for backward compatibility. + use_nft=false + case "${VERSION_CODENAME}" in + resolute) use_nft=true ;; + esac + if [ "${use_nft}" = "true" ] && type iptables-nft > /dev/null 2>&1; then + echo "(*) Setting iptables alternatives to nft for better compatibility with newer kernels" + update-alternatives --set iptables /usr/sbin/iptables-nft || true + update-alternatives --set ip6tables /usr/sbin/ip6tables-nft || true + elif type iptables-legacy > /dev/null 2>&1 && iptables-legacy -L > /dev/null 2>&1; then + echo "(*) Setting iptables alternatives to legacy for better compatibility with Docker and older kernels" + update-alternatives --set iptables /usr/sbin/iptables-legacy || true + update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy || true + elif type iptables-nft > /dev/null 2>&1; then + echo "(*) Setting iptables alternatives to nft for better compatibility with newer kernels for non resolute" + update-alternatives --set iptables /usr/sbin/iptables-nft || true + update-alternatives --set ip6tables /usr/sbin/ip6tables-nft || true + fi +fi -# Set up the necessary apt repos (either Microsoft's or Docker's) +# Set up the necessary repositories if [ "${USE_MOBY}" = "true" ]; then - # Name of open source engine/cli engine_package_name="moby-engine" cli_package_name="moby-cli" - # Import key safely and import Microsoft apt repo - curl -sSL ${MICROSOFT_GPG_KEYS_URI} | gpg --dearmor > /usr/share/keyrings/microsoft-archive-keyring.gpg - echo "deb [arch=${architecture} signed-by=/usr/share/keyrings/microsoft-archive-keyring.gpg] https://packages.microsoft.com/repos/microsoft-${ID}-${VERSION_CODENAME}-prod ${VERSION_CODENAME} main" > /etc/apt/sources.list.d/microsoft.list + case ${ADJUSTED_ID} in + debian) + # Import key safely and import Microsoft apt repo + { + curl -sSL ${MICROSOFT_GPG_KEYS_URI} + curl -sSL ${MICROSOFT_GPG_KEYS_ROLLING_URI} + } | gpg --dearmor > /usr/share/keyrings/microsoft-archive-keyring.gpg + echo "deb [arch=${architecture} signed-by=/usr/share/keyrings/microsoft-archive-keyring.gpg] https://packages.microsoft.com/repos/microsoft-${ID}-${VERSION_CODENAME}-prod ${VERSION_CODENAME} main" > /etc/apt/sources.list.d/microsoft.list + ;; + rhel) + echo "(*) ${ID} detected - checking for Moby packages..." + + # Check if moby packages are available in default repos + if ${PKG_MGR_CMD} list available moby-engine >/dev/null 2>&1; then + echo "(*) Using built-in ${ID} Moby packages" + else + case "${ID}" in + azurelinux) + echo "(*) Moby packages not found in Azure Linux repositories" + echo "(*) For Azure Linux, Docker CE ('moby': false) is recommended" + err "Moby packages are not available for Azure Linux ${VERSION_ID}." + err "Recommendation: Use '\"moby\": false' to install Docker CE instead." + exit 1 + ;; + mariner) + echo "(*) Adding Microsoft repository for CBL-Mariner..." + # Add Microsoft repository if packages aren't available locally + curl -sSL ${MICROSOFT_GPG_KEYS_URI} | gpg --dearmor > /etc/pki/rpm-gpg/microsoft.gpg + cat > /etc/yum.repos.d/microsoft.repo << EOF +[microsoft] +name=Microsoft Repository +baseurl=https://packages.microsoft.com/repos/microsoft-cbl-mariner-2.0-prod-base/ +enabled=1 +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/microsoft.gpg +EOF + # Verify packages are available after adding repo + pkg_mgr_update + if ! ${PKG_MGR_CMD} list available moby-engine >/dev/null 2>&1; then + echo "(*) Moby packages not found in Microsoft repository either" + err "Moby packages are not available for CBL-Mariner ${VERSION_ID}." + err "Recommendation: Use '\"moby\": false' to install Docker CE instead." + exit 1 + fi + ;; + *) + err "Moby packages are not available for ${ID}. Please use 'moby': false option." + exit 1 + ;; + esac + fi + ;; + esac else # Name of licensed engine/cli engine_package_name="docker-ce" cli_package_name="docker-ce-cli" - - # Import key safely and import Docker apt repo - curl -fsSL https://download.docker.com/linux/${ID}/gpg | gpg --dearmor > /usr/share/keyrings/docker-archive-keyring.gpg - echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/${ID} ${VERSION_CODENAME} stable" > /etc/apt/sources.list.d/docker.list + case ${ADJUSTED_ID} in + debian) + curl -fsSL https://download.docker.com/linux/${ID}/gpg | gpg --dearmor > /usr/share/keyrings/docker-archive-keyring.gpg + echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/${ID} ${VERSION_CODENAME} stable" > /etc/apt/sources.list.d/docker.list + ;; + rhel) + # Docker CE repository setup for RHEL-based systems + setup_docker_ce_repo() { + curl -fsSL https://download.docker.com/linux/centos/gpg > /etc/pki/rpm-gpg/docker-ce.gpg + cat > /etc/yum.repos.d/docker-ce.repo << EOF +[docker-ce-stable] +name=Docker CE Stable +baseurl=https://download.docker.com/linux/centos/9/\$basearch/stable +enabled=1 +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/docker-ce.gpg +skip_if_unavailable=1 +module_hotfixes=1 +EOF + } + install_azure_linux_deps() { + echo "(*) Installing device-mapper libraries for Docker CE..." + [ "${ID}" != "mariner" ] && ${PKG_MGR_CMD} -y install device-mapper-libs 2>/dev/null || echo "(*) Device-mapper install failed, proceeding" + echo "(*) Installing additional Docker CE dependencies..." + ${PKG_MGR_CMD} -y install libseccomp libtool-ltdl systemd-libs libcgroup tar xz || { + echo "(*) Some optional dependencies could not be installed, continuing..." + } + } + setup_selinux_context() { + if command -v getenforce >/dev/null 2>&1 && [ "$(getenforce 2>/dev/null)" != "Disabled" ]; then + echo "(*) Creating minimal SELinux context for Docker compatibility..." + mkdir -p /etc/selinux/targeted/contexts/files/ 2>/dev/null || true + echo "/var/lib/docker(/.*)? system_u:object_r:container_file_t:s0" >> /etc/selinux/targeted/contexts/files/file_contexts.local 2>/dev/null || true + fi + } + + # Special handling for RHEL Docker CE installation + case "${ID}" in + azurelinux|mariner) + echo "(*) ${ID} detected" + echo "(*) Note: Moby packages work better on Azure Linux. Consider using 'moby': true" + echo "(*) Setting up Docker CE repository..." + + setup_docker_ce_repo + install_azure_linux_deps + + if [ "${USE_MOBY}" != "true" ]; then + echo "(*) Docker CE installation for Azure Linux - skipping container-selinux" + echo "(*) Note: SELinux policies will be minimal but Docker will function normally" + setup_selinux_context + else + echo "(*) Using Moby - container-selinux not required" + fi + ;; + *) + # Standard RHEL/CentOS/Fedora approach + if command -v dnf >/dev/null 2>&1; then + dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo + elif command -v yum-config-manager >/dev/null 2>&1; then + yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo + else + # Manual fallback + setup_docker_ce_repo + fi + ;; + esac + ;; + esac fi -# Refresh apt lists -apt-get update +# Refresh package database +case ${ADJUSTED_ID} in + debian) + apt-get update + ;; + rhel) + pkg_mgr_update + ;; +esac # Soft version matching if [ "${DOCKER_VERSION}" = "latest" ] || [ "${DOCKER_VERSION}" = "lts" ] || [ "${DOCKER_VERSION}" = "stable" ]; then @@ -254,6 +489,8 @@ if [ "${DOCKER_VERSION}" = "latest" ] || [ "${DOCKER_VERSION}" = "lts" ] || [ "$ engine_version_suffix="" cli_version_suffix="" else + case ${ADJUSTED_ID} in + debian) # Fetch a valid version from the apt-cache (eg: the Microsoft repo appends +azure, breakfix, etc...) docker_version_dot_escaped="${DOCKER_VERSION//./\\.}" docker_version_dot_plus_escaped="${docker_version_dot_escaped//+/\\+}" @@ -268,8 +505,27 @@ else apt-cache madison ${cli_package_name} | awk -F"|" '{print $2}' | grep -oP '^(.+:)?\K.+' exit 1 fi - echo "engine_version_suffix ${engine_version_suffix}" - echo "cli_version_suffix ${cli_version_suffix}" + ;; +rhel) + # For RHEL-based systems, use dnf/yum to find versions + docker_version_escaped="${DOCKER_VERSION//./\\.}" + set +e # Don't exit if finding version fails - will handle gracefully + if [ "${USE_MOBY}" = "true" ]; then + available_versions=$(${PKG_MGR_CMD} list --available moby-engine 2>/dev/null | grep -v "Available Packages" | awk '{print $2}' | grep -E "^${docker_version_escaped}" | head -1) + else + available_versions=$(${PKG_MGR_CMD} list --available docker-ce 2>/dev/null | grep -v "Available Packages" | awk '{print $2}' | grep -E "^${docker_version_escaped}" | head -1) + fi + set -e + if [ -n "${available_versions}" ]; then + engine_version_suffix="-${available_versions}" + cli_version_suffix="-${available_versions}" + else + echo "(*) Exact version ${DOCKER_VERSION} not found, using latest available" + engine_version_suffix="" + cli_version_suffix="" + fi + ;; + esac fi # Version matching for moby-buildx @@ -278,6 +534,8 @@ if [ "${USE_MOBY}" = "true" ]; then # Empty, meaning grab whatever "latest" is in apt repo buildx_version_suffix="" else + case ${ADJUSTED_ID} in + debian) buildx_version_dot_escaped="${MOBY_BUILDX_VERSION//./\\.}" buildx_version_dot_plus_escaped="${buildx_version_dot_escaped//+/\\+}" buildx_version_regex="^(.+:)?${buildx_version_dot_plus_escaped}([\\.\\+ ~:-]|$)" @@ -289,6 +547,21 @@ if [ "${USE_MOBY}" = "true" ]; then apt-cache madison moby-buildx | awk -F"|" '{print $2}' | grep -oP '^(.+:)?\K.+' exit 1 fi + ;; + rhel) + # For RHEL-based systems, try to find buildx version or use latest + buildx_version_escaped="${MOBY_BUILDX_VERSION//./\\.}" + set +e + available_buildx=$(${PKG_MGR_CMD} list --available moby-buildx 2>/dev/null | grep -v "Available Packages" | awk '{print $2}' | grep -E "^${buildx_version_escaped}" | head -1) + set -e + if [ -n "${available_buildx}" ]; then + buildx_version_suffix="-${available_buildx}" + else + echo "(*) Exact buildx version ${MOBY_BUILDX_VERSION} not found, using latest available" + buildx_version_suffix="" + fi + ;; + esac echo "buildx_version_suffix ${buildx_version_suffix}" fi fi @@ -297,26 +570,141 @@ fi if type docker > /dev/null 2>&1 && type dockerd > /dev/null 2>&1; then echo "Docker / Moby CLI and Engine already installed." else - if [ "${USE_MOBY}" = "true" ]; then - # Install engine - set +e # Handle error gracefully - apt-get -y install --no-install-recommends moby-cli${cli_version_suffix} moby-buildx${buildx_version_suffix} moby-engine${engine_version_suffix} - exit_code=$? - set -e - - if [ ${exit_code} -ne 0 ]; then - err "Packages for moby not available in OS ${ID} ${VERSION_CODENAME} (${architecture}). To resolve, either: (1) set feature option '\"moby\": false' , or (2) choose a compatible OS version (eg: 'ubuntu-20.04')." - exit 1 - fi - - # Install compose - apt-get -y install --no-install-recommends moby-compose || err "Package moby-compose (Docker Compose v2) not available for OS ${ID} ${VERSION_CODENAME} (${architecture}). Skipping." - else - apt-get -y install --no-install-recommends docker-ce-cli${cli_version_suffix} docker-ce${engine_version_suffix} - # Install compose - apt-mark hold docker-ce docker-ce-cli - apt-get -y install --no-install-recommends docker-compose-plugin || echo "(*) Package docker-compose-plugin (Docker Compose v2) not available for OS ${ID} ${VERSION_CODENAME} (${architecture}). Skipping." - fi + case ${ADJUSTED_ID} in + debian) + if [ "${USE_MOBY}" = "true" ]; then + # Install engine + set +e # Handle error gracefully + apt-get -y install --no-install-recommends moby-cli${cli_version_suffix} moby-buildx${buildx_version_suffix} moby-engine${engine_version_suffix} + exit_code=$? + set -e + + if [ ${exit_code} -ne 0 ]; then + err "Packages for moby not available in OS ${ID} ${VERSION_CODENAME} (${architecture}). To resolve, either: (1) set feature option '\"moby\": false' , or (2) choose a compatible OS version (eg: 'ubuntu-24.04')." + exit 1 + fi + + # Install compose + apt-get -y install --no-install-recommends moby-compose || err "Package moby-compose (Docker Compose v2) not available for OS ${ID} ${VERSION_CODENAME} (${architecture}). Skipping." + else + apt-get -y install --no-install-recommends docker-ce-cli${cli_version_suffix} docker-ce${engine_version_suffix} + # Install compose + apt-mark hold docker-ce docker-ce-cli + apt-get -y install --no-install-recommends docker-compose-plugin || echo "(*) Package docker-compose-plugin (Docker Compose v2) not available for OS ${ID} ${VERSION_CODENAME} (${architecture}). Skipping." + fi + ;; + rhel) + if [ "${USE_MOBY}" = "true" ]; then + set +e # Handle error gracefully + ${PKG_MGR_CMD} -y install moby-cli${cli_version_suffix} moby-engine${engine_version_suffix} + exit_code=$? + set -e + + if [ ${exit_code} -ne 0 ]; then + err "Packages for moby not available in OS ${ID} ${VERSION_CODENAME} (${architecture}). To resolve, either: (1) set feature option '\"moby\": false' , or (2) choose a compatible OS version." + exit 1 + fi + + # Install compose + if [ "${DOCKER_DASH_COMPOSE_VERSION}" != "none" ]; then + ${PKG_MGR_CMD} -y install moby-compose || echo "(*) Package moby-compose not available for ${ID} ${VERSION_CODENAME} (${architecture}). Skipping." + fi + else + # Special handling for Azure Linux Docker CE installation + if [ "${ID}" = "azurelinux" ] || [ "${ID}" = "mariner" ]; then + echo "(*) Installing Docker CE on Azure Linux (bypassing container-selinux dependency)..." + + # Use rpm with --force and --nodeps for Azure Linux + set +e # Don't exit on error for this section + ${PKG_MGR_CMD} -y install docker-ce${cli_version_suffix} docker-ce-cli${engine_version_suffix} containerd.io + install_result=$? + set -e + + if [ $install_result -ne 0 ]; then + echo "(*) Standard installation failed, trying manual installation..." + + echo "(*) Standard installation failed, trying manual installation..." + + # Create directory for downloading packages + mkdir -p /tmp/docker-ce-install + + # Download packages manually using curl since tdnf doesn't support download + echo "(*) Downloading Docker CE packages manually..." + + # Derive repo arch from the current platform. The Docker CE centos + # repo uses 'x86_64' and 'aarch64' as the per-arch directory names, + # which matches the values produced by `rpm --eval '%{_arch}'` / + # `uname -m` for those platforms. + case "${architecture}" in + amd64|x86_64) repo_arch="x86_64" ;; + arm64|aarch64) repo_arch="aarch64" ;; + *) repo_arch="${architecture}" ;; + esac + + # Get the repository baseurl + repo_baseurl="https://download.docker.com/linux/centos/9/${repo_arch}/stable" + + # Download packages directly + cd /tmp/docker-ce-install + + # Get package names with versions + if [ -n "${cli_version_suffix}" ]; then + docker_ce_version="${cli_version_suffix#-}" + docker_cli_version="${engine_version_suffix#-}" + else + # Get latest version from repository + docker_ce_version="latest" + fi + + echo "(*) Attempting to download Docker CE packages from repository..." + + # Try to download latest packages if specific version fails + if ! curl -fsSL "${repo_baseurl}/Packages/docker-ce-${docker_ce_version}.el9.${repo_arch}.rpm" -o docker-ce.rpm 2>/dev/null; then + # Fallback: try to get latest available version + echo "(*) Specific version not found, trying latest..." + latest_docker=$(curl -s "${repo_baseurl}/Packages/" | grep -o "docker-ce-[0-9][^\"]*\.el9\.${repo_arch}\.rpm" | head -1) + latest_cli=$(curl -s "${repo_baseurl}/Packages/" | grep -o "docker-ce-cli-[0-9][^\"]*\.el9\.${repo_arch}\.rpm" | head -1) + latest_containerd=$(curl -s "${repo_baseurl}/Packages/" | grep -o "containerd\.io-[0-9][^\"]*\.el9\.${repo_arch}\.rpm" | head -1) + + if [ -n "${latest_docker}" ]; then + curl -fsSL "${repo_baseurl}/Packages/${latest_docker}" -o docker-ce.rpm + curl -fsSL "${repo_baseurl}/Packages/${latest_cli}" -o docker-ce-cli.rpm + curl -fsSL "${repo_baseurl}/Packages/${latest_containerd}" -o containerd.io.rpm + else + echo "(*) ERROR: Could not find Docker CE packages in repository" + echo "(*) Please check repository configuration or use 'moby': true" + exit 1 + fi + fi + # Install systemd libraries required by Docker CE + echo "(*) Installing systemd libraries required by Docker CE..." + ${PKG_MGR_CMD} -y install systemd-libs || ${PKG_MGR_CMD} -y install systemd-devel || { + echo "(*) WARNING: Could not install systemd libraries" + echo "(*) Docker may fail to start without these" + } + + # Install with rpm --force --nodeps + echo "(*) Installing Docker CE packages with dependency override..." + rpm -Uvh --force --nodeps *.rpm + + # Cleanup + cd / + rm -rf /tmp/docker-ce-install + + echo "(*) Docker CE installation completed with dependency bypass" + echo "(*) Note: Some SELinux functionality may be limited without container-selinux" + fi + else + # Standard installation for other RHEL-based systems + ${PKG_MGR_CMD} -y install docker-ce${cli_version_suffix} docker-ce-cli${engine_version_suffix} containerd.io + fi + # Install compose + if [ "${DOCKER_DASH_COMPOSE_VERSION}" != "none" ]; then + ${PKG_MGR_CMD} -y install docker-compose-plugin || echo "(*) Package docker-compose-plugin not available for ${ID} ${VERSION_CODENAME} (${architecture}). Skipping." + fi + fi + ;; + esac fi echo "Finished installing docker / moby!" @@ -337,11 +725,11 @@ fallback_compose(){ # If 'docker-compose' command is to be included if [ "${DOCKER_DASH_COMPOSE_VERSION}" != "none" ]; then case "${architecture}" in - amd64) target_compose_arch=x86_64 ;; - arm64) target_compose_arch=aarch64 ;; - *) - echo "(!) Docker in docker does not support machine architecture '$architecture'. Please use an x86-64 or ARM64 machine." - exit 1 + amd64|x86_64) target_compose_arch=x86_64 ;; + arm64|aarch64) target_compose_arch=aarch64 ;; + *) + echo "(!) Docker in docker does not support machine architecture '$architecture'. Please use an x86-64 or ARM64 machine." + exit 1 esac docker_compose_path="/usr/local/bin/docker-compose" @@ -362,11 +750,21 @@ if [ "${DOCKER_DASH_COMPOSE_VERSION}" != "none" ]; then err "Docker compose v1 is unavailable for 'bookworm' on Arm64. Kindly switch to use v2" exit 1 else - # Use pip to get a version that runs on this architecture + # Use pip (inside an isolated venv) to get a version that runs on this architecture. + # A dedicated venv avoids PEP 668 "externally-managed-environment" errors on newer + # distros (Debian trixie, Ubuntu noble, etc.) and guarantees we do not modify or + # shadow the distro-managed system Python site-packages. check_packages python3-minimal python3-pip libffi-dev python3-venv - echo "(*) Installing docker compose v1 via pip..." - export PYTHONUSERBASE=/usr/local - pip3 install --disable-pip-version-check --no-cache-dir --user "Cython<3.0" pyyaml wheel docker-compose --no-build-isolation + echo "(*) Installing docker compose v1 via pip into an isolated virtualenv..." + + compose_v1_venv="/usr/local/share/docker-compose-v1-venv" + python3 -m venv "${compose_v1_venv}" + "${compose_v1_venv}/bin/pip" install --disable-pip-version-check --no-cache-dir --upgrade pip setuptools wheel + "${compose_v1_venv}/bin/pip" install --disable-pip-version-check --no-cache-dir "Cython<3.0" pyyaml docker-compose --no-build-isolation + + # Expose the venv's docker-compose entrypoint on PATH at the expected location. + ln -sf "${compose_v1_venv}/bin/docker-compose" "${docker_compose_path}" + chmod +x "${docker_compose_path}" fi else compose_version=${DOCKER_DASH_COMPOSE_VERSION#v} @@ -397,19 +795,32 @@ fallback_compose-switch() { echo -e "\n(!) Failed to fetch the latest artifacts for compose-switch v${compose_switch_version}..." get_previous_version "$url" "$repo_url" compose_switch_version echo -e "\nAttempting to install v${compose_switch_version}" - curl -fsSL "https://github.com/docker/compose-switch/releases/download/v${compose_switch_version}/docker-compose-linux-${architecture}" -o /usr/local/bin/compose-switch + curl -fsSL "https://github.com/docker/compose-switch/releases/download/v${compose_switch_version}/docker-compose-linux-${target_switch_arch}" -o /usr/local/bin/compose-switch } - # Install docker-compose switch if not already installed - https://github.com/docker/compose-switch#manual-installation if [ "${INSTALL_DOCKER_COMPOSE_SWITCH}" = "true" ] && ! type compose-switch > /dev/null 2>&1; then if type docker-compose > /dev/null 2>&1; then echo "(*) Installing compose-switch..." - current_compose_path="$(which docker-compose)" + current_compose_path="$(command -v docker-compose)" target_compose_path="$(dirname "${current_compose_path}")/docker-compose-v1" compose_switch_version="latest" compose_switch_url="https://github.com/docker/compose-switch" + # Try to get latest version, fallback to known stable version if GitHub API fails + set +e find_version_from_git_tags compose_switch_version "$compose_switch_url" - curl -fsSL "https://github.com/docker/compose-switch/releases/download/v${compose_switch_version}/docker-compose-linux-${architecture}" -o /usr/local/bin/compose-switch || fallback_compose-switch "$compose_switch_url" + if [ $? -ne 0 ] || [ -z "${compose_switch_version}" ] || [ "${compose_switch_version}" = "latest" ]; then + echo "(*) GitHub API rate limited or failed, using fallback method" + fallback_compose-switch "$compose_switch_url" + fi + set -e + + # Map architecture for compose-switch downloads + case "${architecture}" in + amd64|x86_64) target_switch_arch=amd64 ;; + arm64|aarch64) target_switch_arch=arm64 ;; + *) target_switch_arch=${architecture} ;; + esac + curl -fsSL "https://github.com/docker/compose-switch/releases/download/v${compose_switch_version}/docker-compose-linux-${target_switch_arch}" -o /usr/local/bin/compose-switch || fallback_compose-switch "$compose_switch_url" chmod +x /usr/local/bin/compose-switch # TODO: Verify checksum once available: https://github.com/docker/compose-switch/issues/11 # Setup v1 CLI as alternative in addition to compose-switch (which maps to v2) @@ -442,7 +853,7 @@ fallback_buildx() { local repo_url=$(get_github_api_repo_url "$url") echo -e "\n(!) Failed to fetch the latest artifacts for docker buildx v${buildx_version}..." get_previous_version "$url" "$repo_url" buildx_version - buildx_file_name="buildx-v${buildx_version}.linux-${architecture}" + buildx_file_name="buildx-v${buildx_version}.linux-${target_buildx_arch}" echo -e "\nAttempting to install v${buildx_version}" wget https://github.com/docker/buildx/releases/download/v${buildx_version}/${buildx_file_name} } @@ -452,8 +863,16 @@ if [ "${INSTALL_DOCKER_BUILDX}" = "true" ]; then docker_buildx_url="https://github.com/docker/buildx" find_version_from_git_tags buildx_version "$docker_buildx_url" "refs/tags/v" echo "(*) Installing buildx ${buildx_version}..." - buildx_file_name="buildx-v${buildx_version}.linux-${architecture}" - + + # Map architecture for buildx downloads + case "${architecture}" in + amd64|x86_64) target_buildx_arch=amd64 ;; + arm64|aarch64) target_buildx_arch=arm64 ;; + *) target_buildx_arch=${architecture} ;; + esac + + buildx_file_name="buildx-v${buildx_version}.linux-${target_buildx_arch}" + cd /tmp wget https://github.com/docker/buildx/releases/download/v${buildx_version}/${buildx_file_name} || fallback_buildx "$docker_buildx_url" @@ -486,6 +905,62 @@ if [ "$DISABLE_IP6_TABLES" == true ]; then fi fi +# Workaround for https://github.com/devcontainers/features/issues/1642 +# containerd >= 2.3 ships an erofs snapshotter that requires mkfs.erofs >= 1.7. +# Older distros (Debian 12, Ubuntu 22.04) ship erofs-utils 1.4/1.5, so when the +# host kernel exposes the 'erofs' filesystem the snapshotter fails to +# initialize and dockerd times out waiting for containerd. Disable the plugin +# via the top-level `disabled_plugins` list so containerd always uses +# overlayfs, regardless of distro / mkfs.erofs version. +mkdir -p /etc/containerd +if [ ! -s /etc/containerd/config.toml ]; then + if command -v containerd >/dev/null 2>&1; then + containerd config default > /etc/containerd/config.toml 2>/dev/null || : > /etc/containerd/config.toml + elif [ -x /usr/sbin/containerd ]; then + /usr/sbin/containerd config default > /etc/containerd/config.toml 2>/dev/null || : > /etc/containerd/config.toml + elif [ -x /usr/bin/containerd ]; then + /usr/bin/containerd config default > /etc/containerd/config.toml 2>/dev/null || : > /etc/containerd/config.toml + else + : > /etc/containerd/config.toml + fi +fi + +EROFS_PLUGIN_URI='io.containerd.snapshotter.v1.erofs' +EROFS_MARKER='# devcontainers-features:disable-erofs' + +if ! grep -qF "${EROFS_MARKER}" /etc/containerd/config.toml; then + if grep -qE '^[[:space:]]*disabled_plugins[[:space:]]*=' /etc/containerd/config.toml; then + # Add erofs URI to the existing top-level disabled_plugins list. + # Branches are mutually exclusive and guarded so we never produce + # duplicate entries on re-runs. + if grep -qE '^[[:space:]]*disabled_plugins[[:space:]]*=[[:space:]]*\[[[:space:]]*\]' /etc/containerd/config.toml; then + # disabled_plugins = [] -> insert URI as the only entry. + sed -i -E \ + "s|^([[:space:]]*disabled_plugins[[:space:]]*=[[:space:]]*\[)[[:space:]]*\]|\1\"${EROFS_PLUGIN_URI}\"]|" \ + /etc/containerd/config.toml + elif ! grep -qF "\"${EROFS_PLUGIN_URI}\"" /etc/containerd/config.toml; then + # disabled_plugins = ["existing", ...] -> append URI. + sed -i -E \ + "s|^([[:space:]]*disabled_plugins[[:space:]]*=[[:space:]]*\[)([^]]*[^],[:space:]])[[:space:]]*\]|\1\2, \"${EROFS_PLUGIN_URI}\"]|" \ + /etc/containerd/config.toml + fi + else + # No disabled_plugins key in the config: prepend one. + tmp_cfg="$(mktemp)" + { + printf 'disabled_plugins = ["%s"]\n\n' "${EROFS_PLUGIN_URI}" + cat /etc/containerd/config.toml + } > "${tmp_cfg}" + mv "${tmp_cfg}" /etc/containerd/config.toml + fi + # Idempotency marker + printf '\n%s\n' "${EROFS_MARKER}" >> /etc/containerd/config.toml +fi + +if [ ! -d /usr/local/share ]; then + mkdir -p /usr/local/share +fi + tee /usr/local/share/docker-init.sh > /dev/null \ << EOF #!/bin/sh @@ -501,6 +976,29 @@ DOCKER_DEFAULT_ADDRESS_POOL=${DOCKER_DEFAULT_ADDRESS_POOL} DOCKER_DEFAULT_IP6_TABLES=${DOCKER_DEFAULT_IP6_TABLES} EOF +# On Debian-based images, re-assert the iptables alternative at container start +# (only when the user opted into runtime switching via iptablesSwitchAtRuntime=true). +if [ "${IPTABLES_SWITCH_AT_RUNTIME}" = "true" ] && [ "${ADJUSTED_ID}" = "debian" ]; then + tee -a /usr/local/share/docker-init.sh > /dev/null \ +<< 'EOF' +# Prefer legacy only when the ip_tables kernel module is actually present. +# (Do NOT call `iptables-legacy -L/-nL` to test this — it auto-modprobes ip_tables +# and would defeat hosts/scenarios where the module is intentionally absent +# such as the newer kernels which leaves out ip_tables legacy.) +if type iptables-legacy > /dev/null 2>&1 \ + && { grep -qE '^(ip_tables)\b' /proc/modules \ + || [ -d /sys/module/ip_tables ]; } \ + && update-alternatives --list iptables 2>/dev/null | grep -q '/usr/sbin/iptables-legacy'; then + update-alternatives --set iptables /usr/sbin/iptables-legacy || true + update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy || true +elif type iptables-nft > /dev/null 2>&1 \ + && update-alternatives --list iptables 2>/dev/null | grep -q '/usr/sbin/iptables-nft'; then + update-alternatives --set iptables /usr/sbin/iptables-nft || true + update-alternatives --set ip6tables /usr/sbin/ip6tables-nft || true +fi +EOF +fi + tee -a /usr/local/share/docker-init.sh > /dev/null \ << 'EOF' dockerd_start="AZURE_DNS_AUTO_DETECTION=${AZURE_DNS_AUTO_DETECTION} DOCKER_DEFAULT_ADDRESS_POOL=${DOCKER_DEFAULT_ADDRESS_POOL} DOCKER_DEFAULT_IP6_TABLES=${DOCKER_DEFAULT_IP6_TABLES} $(cat << 'INNEREOF' @@ -580,8 +1078,42 @@ dockerd_start="AZURE_DNS_AUTO_DETECTION=${AZURE_DNS_AUTO_DETECTION} DOCKER_DEFAU DEFAULT_ADDRESS_POOL="--default-address-pool $DOCKER_DEFAULT_ADDRESS_POOL" fi + + # Start our own containerd so it picks up /etc/containerd/config.toml + # (notably the disabled_plugins entry for the erofs snapshotter, see + # https://github.com/devcontainers/features/issues/1642). dockerd's + # built-in containerd child uses an auto-generated config that ignores + # /etc/containerd/config.toml, so we must run containerd ourselves and + # point dockerd at it via --containerd. + CONTAINERD_SOCK="/run/containerd/containerd.sock" + CONTAINERD_BIN="" + for candidate in /usr/local/bin/containerd /usr/bin/containerd /usr/sbin/containerd; do + if [ -x "$candidate" ]; then + CONTAINERD_BIN="$candidate" + break + fi + done + DOCKERD_CONTAINERD_ARG="" + if [ -n "$CONTAINERD_BIN" ] && [ -f /etc/containerd/config.toml ]; then + mkdir -p /run/containerd + if ! pgrep -x containerd > /dev/null 2>&1; then + ( "$CONTAINERD_BIN" --config /etc/containerd/config.toml > /tmp/containerd.log 2>&1 ) & + fi + # Wait up to ~5s for the socket to appear + i=0 + while [ $i -lt 50 ] && [ ! -S "$CONTAINERD_SOCK" ]; do + sleep 0.1 + i=$((i + 1)) + done + if [ -S "$CONTAINERD_SOCK" ]; then + DOCKERD_CONTAINERD_ARG="--containerd $CONTAINERD_SOCK" + else + echo "(*) containerd socket not ready; letting dockerd spawn its own containerd." + fi + fi + # Start docker/moby engine - ( dockerd $CUSTOMDNS $DEFAULT_ADDRESS_POOL $DOCKER_DEFAULT_IP6_TABLES > /tmp/dockerd.log 2>&1 ) & + ( dockerd $DOCKERD_CONTAINERD_ARG $CUSTOMDNS $DEFAULT_ADDRESS_POOL $DOCKER_DEFAULT_IP6_TABLES > /tmp/dockerd.log 2>&1 ) & INNEREOF )" diff --git a/src/docker-outside-of-docker/NOTES.md b/src/docker-outside-of-docker/NOTES.md index 6e85010ea..f9d7dbc06 100644 --- a/src/docker-outside-of-docker/NOTES.md +++ b/src/docker-outside-of-docker/NOTES.md @@ -58,4 +58,16 @@ services: This Feature should work on recent versions of Debian/Ubuntu-based distributions with the `apt` package manager installed. +Debian Trixie (13) does not include moby-cli and related system packages, so the feature cannot install with "moby": "true". To use this feature on Trixie, please set "moby": "false" or choose a different base image (for example, Ubuntu 24.04). + +Ubuntu 26.04 LTS (Resolute) does not have moby-cli packages available, so the feature only supports installation with `"moby": false`. To use this feature on Ubuntu 26.04, set `"moby": false` in your feature configuration: + +```json +"features": { + "ghcr.io/devcontainers/features/docker-outside-of-docker:1": { + "moby": false + } +} +``` + `bash` is required to execute the `install.sh` script. diff --git a/src/docker-outside-of-docker/README.md b/src/docker-outside-of-docker/README.md index 1794d42e8..3b37028e2 100644 --- a/src/docker-outside-of-docker/README.md +++ b/src/docker-outside-of-docker/README.md @@ -20,9 +20,10 @@ Re-use the host docker socket, adding the Docker CLI to a container. Feature inv | version | Select or enter a Docker/Moby CLI version. (Availability can vary by OS version.) | string | latest | | moby | Install OSS Moby build instead of Docker CE | boolean | true | | mobyBuildxVersion | Install a specific version of moby-buildx when using Moby | string | latest | -| dockerDashComposeVersion | Compose version to use for docker-compose (v1 or v2 or none) | string | v2 | +| dockerDashComposeVersion | Compose version to use for docker-compose (v1 or v2 or none or latest) | string | latest | | installDockerBuildx | Install Docker Buildx | boolean | true | | installDockerComposeSwitch | Install Compose Switch (provided docker compose is available) which is a replacement to the Compose V1 docker-compose (python) executable. It translates the command line into Compose V2 docker compose then runs the latter. | boolean | true | +| socketPath | Path where the Docker socket is mounted inside the container. For rootless Docker, override the mount in devcontainer.json to map your host socket to this path. | string | /var/run/docker-host.sock | ## Customizations @@ -36,6 +37,30 @@ Re-use the host docker socket, adding the Docker CLI to a container. Feature inv - The host and the container must be running on the same chip architecture. You will not be able to use it with an emulated x86 image with Docker Desktop on an Apple Silicon Mac, for example. - This approach does not currently enable bind mounting the workspace folder by default, and cannot support folders outside of the workspace folder. Consider whether the [Docker-in-Docker Feature](../docker-in-docker) would better meet your needs given it does not have this limitation. +## Rootless Docker Support + +By default, this feature expects the Docker socket at `/var/run/docker.sock` on the host, which works for standard (root) Docker installations. For **rootless Docker** setups where the socket is located at `/run/user/$UID/docker.sock` or `$XDG_RUNTIME_DIR/docker.sock`, you need to override the mount in your `devcontainer.json`: + +```json +{ + "features": { + "ghcr.io/devcontainers/features/docker-outside-of-docker:1": {} + }, + "mounts": [ + { + "source": "/run/user/1000/docker.sock", + "target": "/var/run/docker-host.sock", + "type": "bind" + } + ] +} +``` + +**Notes:** +- Replace `1000` with your actual user ID (run `id -u` to find it) +- The feature will automatically detect the socket at `/var/run/docker-host.sock` +- Your custom mount will override the feature's default mount + ## Supporting bind mounts from the workspace folder A common question that comes up is how you can use `bind` mounts from the Docker CLI from within the a dev container using this Feature (e.g. via `-v`). If you cannot use the [Docker-in-Docker Feature](../docker-in-docker), the only way to work around this is to use the **host**'s folder paths instead of the container's paths. There are 2 ways to do this diff --git a/src/docker-outside-of-docker/devcontainer-feature.json b/src/docker-outside-of-docker/devcontainer-feature.json index 218df825f..3cf3513c0 100644 --- a/src/docker-outside-of-docker/devcontainer-feature.json +++ b/src/docker-outside-of-docker/devcontainer-feature.json @@ -1,6 +1,7 @@ { + "id": "docker-outside-of-docker", - "version": "1.6.3", + "version": "1.10.0", "name": "Docker (docker-outside-of-docker)", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/docker-outside-of-docker", "description": "Re-use the host docker socket, adding the Docker CLI to a container. Feature invokes a script to enable using a forwarded Docker socket within a container to run Docker commands.", @@ -29,11 +30,12 @@ "type": "string", "enum": [ "none", + "latest", "v1", "v2" ], - "default": "v2", - "description": "Compose version to use for docker-compose (v1 or v2 or none)" + "default": "latest", + "description": "Compose version to use for docker-compose (v1 or v2 or none or latest)" }, "installDockerBuildx": { "type": "boolean", @@ -42,39 +44,44 @@ }, "installDockerComposeSwitch": { "type": "boolean", - "default": true, + "default": false, "description": "Install Compose Switch (provided docker compose is available) which is a replacement to the Compose V1 docker-compose (python) executable. It translates the command line into Compose V2 docker compose then runs the latter." + }, + "socketPath": { + "type": "string", + "default": "/var/run/docker-host.sock", + "description": "Path where the Docker socket is mounted inside the container. For rootless Docker, override the mount in devcontainer.json to map your host socket to this path." } }, - "entrypoint": "/usr/local/share/docker-init.sh", - "customizations": { - "vscode": { - "extensions": [ - "ms-azuretools.vscode-containers" - ], - "settings": { - "github.copilot.chat.codeGeneration.instructions": [ - { - "text": "This dev container includes the Docker CLI (`docker`) pre-installed and available on the `PATH` for running and managing containers using the Docker daemon on the host machine." - } - ] - } - } - }, - "mounts": [ - { - "source": "/var/run/docker.sock", - "target": "/var/run/docker-host.sock", - "type": "bind" - } - ], - "securityOpt": [ - "label=disable" - ], - "installsAfter": [ - "ghcr.io/devcontainers/features/common-utils" - ], - "legacyIds": [ - "docker-from-docker" - ] + "entrypoint": "/usr/local/share/docker-init.sh", + "customizations": { + "vscode": { + "extensions": [ + "ms-azuretools.vscode-containers" + ], + "settings": { + "github.copilot.chat.codeGeneration.instructions": [ + { + "text": "This dev container includes the Docker CLI (`docker`) pre-installed and available on the `PATH` for running and managing containers using the Docker daemon on the host machine." + } + ] + } + } + }, + "mounts": [ + { + "source": "/var/run/docker.sock", + "target": "/var/run/docker-host.sock", + "type": "bind" + } + ], + "securityOpt": [ + "label=disable" + ], + "installsAfter": [ + "ghcr.io/devcontainers/features/common-utils" + ], + "legacyIds": [ + "docker-from-docker" + ] } diff --git a/src/docker-outside-of-docker/install.sh b/src/docker-outside-of-docker/install.sh index 04e35db0f..ae4c7ae51 100755 --- a/src/docker-outside-of-docker/install.sh +++ b/src/docker-outside-of-docker/install.sh @@ -10,18 +10,19 @@ DOCKER_VERSION="${VERSION:-"latest"}" USE_MOBY="${MOBY:-"true"}" MOBY_BUILDX_VERSION="${MOBYBUILDXVERSION:-"latest"}" -DOCKER_DASH_COMPOSE_VERSION="${DOCKERDASHCOMPOSEVERSION:-"v2"}" # v1 or v2 or none +DOCKER_DASH_COMPOSE_VERSION="${DOCKERDASHCOMPOSEVERSION:-"latest"}" # v1 or v2 or none or latest ENABLE_NONROOT_DOCKER="${ENABLE_NONROOT_DOCKER:-"true"}" -SOURCE_SOCKET="${SOURCE_SOCKET:-"/var/run/docker-host.sock"}" +SOCKET_PATH="${SOCKETPATH:-"/var/run/docker-host.sock"}" # From feature option +SOURCE_SOCKET="${SOURCE_SOCKET:-"${SOCKET_PATH}"}" TARGET_SOCKET="${TARGET_SOCKET:-"/var/run/docker.sock"}" USERNAME="${USERNAME:-"${_REMOTE_USER:-"automatic"}"}" INSTALL_DOCKER_BUILDX="${INSTALLDOCKERBUILDX:-"true"}" INSTALL_DOCKER_COMPOSE_SWITCH="${INSTALLDOCKERCOMPOSESWITCH:-"true"}" - MICROSOFT_GPG_KEYS_URI="https://packages.microsoft.com/keys/microsoft.asc" -DOCKER_MOBY_ARCHIVE_VERSION_CODENAMES="bookworm buster bullseye bionic focal jammy noble plucky" -DOCKER_LICENSED_ARCHIVE_VERSION_CODENAMES="bookworm buster bullseye bionic focal hirsute impish jammy noble plucky" +MICROSOFT_GPG_KEYS_ROLLING_URI="https://packages.microsoft.com/keys/microsoft-rolling.asc" +DOCKER_MOBY_ARCHIVE_VERSION_CODENAMES="trixie bookworm buster bullseye bionic focal jammy noble plucky" +DOCKER_LICENSED_ARCHIVE_VERSION_CODENAMES="trixie bookworm buster bullseye bionic focal hirsute impish jammy noble plucky resolute" set -e @@ -192,6 +193,11 @@ export DEBIAN_FRONTEND=noninteractive # Install dependencies check_packages apt-transport-https curl ca-certificates gnupg2 dirmngr wget +# Update CA certificates to ensure HTTPS connections work properly +# This is especially important for Ubuntu 24.04 (Noble) and Debian Trixie +if command -v update-ca-certificates > /dev/null 2>&1; then + update-ca-certificates +fi if ! type git > /dev/null 2>&1; then check_packages git fi @@ -201,18 +207,25 @@ fi # Fetch host/container arch. architecture="$(dpkg --print-architecture)" +# Prevent attempting to install Moby on Debian trixie or Ubuntu resolute (packages not available) +if [ "${USE_MOBY}" = "true" ] && ([ "${VERSION_CODENAME}" = "trixie" ] || [ "${VERSION_CODENAME}" = "resolute" ]); then + err "The 'moby' option is not supported on ${ID} '${VERSION_CODENAME}' because 'moby-cli' and related system packages are not available in that distribution." + err "To continue, either set the feature option '\"moby\": false' or use a different base image (for example: 'debian:bookworm' or 'ubuntu-24.04')." + exit 1 +fi + # Check if distro is supported if [ "${USE_MOBY}" = "true" ]; then if [[ "${DOCKER_MOBY_ARCHIVE_VERSION_CODENAMES}" != *"${VERSION_CODENAME}"* ]]; then err "Unsupported distribution version '${VERSION_CODENAME}'. To resolve, either: (1) set feature option '\"moby\": false' , or (2) choose a compatible OS distribution" - err "Support distributions include: ${DOCKER_MOBY_ARCHIVE_VERSION_CODENAMES}" + err "Supported distributions include: ${DOCKER_MOBY_ARCHIVE_VERSION_CODENAMES}" exit 1 fi echo "Distro codename '${VERSION_CODENAME}' matched filter '${DOCKER_MOBY_ARCHIVE_VERSION_CODENAMES}'" else if [[ "${DOCKER_LICENSED_ARCHIVE_VERSION_CODENAMES}" != *"${VERSION_CODENAME}"* ]]; then err "Unsupported distribution version '${VERSION_CODENAME}'. To resolve, please choose a compatible OS distribution" - err "Support distributions include: ${DOCKER_LICENSED_ARCHIVE_VERSION_CODENAMES}" + err "Supported distributions include: ${DOCKER_LICENSED_ARCHIVE_VERSION_CODENAMES}" exit 1 fi echo "Distro codename '${VERSION_CODENAME}' matched filter '${DOCKER_LICENSED_ARCHIVE_VERSION_CODENAMES}'" @@ -224,7 +237,10 @@ if [ "${USE_MOBY}" = "true" ]; then cli_package_name="moby-cli" # Import key safely and import Microsoft apt repo - curl -sSL ${MICROSOFT_GPG_KEYS_URI} | gpg --dearmor > /usr/share/keyrings/microsoft-archive-keyring.gpg + { + curl -sSL ${MICROSOFT_GPG_KEYS_URI} + curl -sSL ${MICROSOFT_GPG_KEYS_ROLLING_URI} + } | gpg --dearmor > /usr/share/keyrings/microsoft-archive-keyring.gpg echo "deb [arch=${architecture} signed-by=/usr/share/keyrings/microsoft-archive-keyring.gpg] https://packages.microsoft.com/repos/microsoft-${ID}-${VERSION_CODENAME}-prod ${VERSION_CODENAME} main" > /etc/apt/sources.list.d/microsoft.list else # Name of proprietary engine package @@ -302,24 +318,32 @@ else if [ "${INSTALL_DOCKER_BUILDX}" = "true" ]; then buildx=(moby-buildx${buildx_version_suffix}) fi - apt-get -y install --no-install-recommends ${cli_package_name}${cli_version_suffix} "${buildx[@]}" - apt-get -y install --no-install-recommends moby-compose || echo "(*) Package moby-compose (Docker Compose v2) not available for OS ${ID} ${VERSION_CODENAME} (${architecture}). Skipping." + apt-get -y install --no-install-recommends ${cli_package_name}${cli_version_suffix} "${buildx[@]}" || { err "It seems packages for moby not available in OS ${ID} ${VERSION_CODENAME} (${architecture}). To resolve, either: (1) set feature option '\"moby\": false' , or (2) choose a compatible OS version (eg: 'ubuntu-24.04')." ; exit 1 ; } + if [ "${DOCKER_DASH_COMPOSE_VERSION}" != "v1" ]; then + apt-get -y install --no-install-recommends moby-compose || echo "(*) Package moby-compose (Docker Compose v2) not available for OS ${ID} ${VERSION_CODENAME} (${architecture}). Skipping." + fi else buildx=() if [ "${INSTALL_DOCKER_BUILDX}" = "true" ]; then buildx=(docker-buildx-plugin) fi - apt-get -y install --no-install-recommends ${cli_package_name}${cli_version_suffix} "${buildx[@]}" docker-compose-plugin + #install cli + buildx first + apt-get -y install --no-install-recommends ${cli_package_name}${cli_version_suffix} "${buildx[@]}" + + # Backward compatibility: Older Docker CE versions bundled buildx with CLI + # Modern versions have separate packages, but this ensures consistent behavior buildx_path="/usr/libexec/docker/cli-plugins/docker-buildx" - # Older versions of Docker CE installs buildx as part of the CLI package if [ "${INSTALL_DOCKER_BUILDX}" = "false" ] && [ -f "${buildx_path}" ]; then - echo "(*) Removing docker-buildx installed from docker-ce-cli since installDockerBuildx is disabled..." + echo "(*) Removing docker-buildx (bundled in older Docker CE) since installDockerBuildx is disabled..." rm -f "${buildx_path}" fi + + if [ "${DOCKER_DASH_COMPOSE_VERSION}" != "v1" ]; then + apt-get -y install --no-install-recommends docker-compose-plugin + fi fi unset buildx buildx_path fi - # If 'docker-compose' command is to be included if [ "${DOCKER_DASH_COMPOSE_VERSION}" != "none" ]; then case "${architecture}" in @@ -423,6 +447,8 @@ echo "docker-init doesn't exist, adding..." # By default, make the source and target sockets the same if [ "${SOURCE_SOCKET}" != "${TARGET_SOCKET}" ]; then + # Create parent directory if it doesn't exist + mkdir -p "$(dirname "${SOURCE_SOCKET}")" touch "${SOURCE_SOCKET}" ln -s "${SOURCE_SOCKET}" "${TARGET_SOCKET}" fi diff --git a/src/dotnet/NOTES.md b/src/dotnet/NOTES.md index 584c90cef..c5d6f6071 100644 --- a/src/dotnet/NOTES.md +++ b/src/dotnet/NOTES.md @@ -10,9 +10,10 @@ Installing only the latest .NET SDK version (the default). Installing an additional SDK version. Multiple versions can be specified as comma-separated values. -``` json +``` jsonc "features": { "ghcr.io/devcontainers/features/dotnet:2": { + "version": "latest", // (this can be omitted) "additionalVersions": "lts" } } @@ -56,7 +57,7 @@ Installing only the .NET Runtime or the ASP.NET Core Runtime. (The SDK includes "ghcr.io/devcontainers/features/dotnet:2": { "version": "none", "dotnetRuntimeVersions": "latest, lts", - "aspnetCoreRuntimeVersions": "latest, lts", + "aspNetCoreRuntimeVersions": "latest, lts", } } ``` @@ -66,7 +67,20 @@ Installing .NET workloads. Multiple workloads can be specified as comma-separate ``` json "features": { "ghcr.io/devcontainers/features/dotnet:2": { - "workloads": "aspire, wasm-tools" + "workloads": "wasm-tools" + } +} +``` + +Installing prerelease builds. Supports `preview` and `daily` suffixes. + +``` json +"features": { + "ghcr.io/devcontainers/features/dotnet:2": { + "version": "10.0-preview", + "additionalVersions": "10.0.1xx-daily", + "dotnetRuntimeVersions": "10.0-daily", + "aspNetCoreRuntimeVersions": "10.0-daily" } } ``` @@ -76,3 +90,21 @@ Installing .NET workloads. Multiple workloads can be specified as comma-separate This Feature should work on recent versions of Debian/Ubuntu-based distributions with the `apt` package manager installed. `bash` is required to execute the `install.sh` script. + +## Tab completions + +When using .NET SDK 10 or newer, tab completions for the `dotnet` CLI are automatically installed for bash, zsh, and fish. The completion scripts are placed in the standard system-wide directories so they work for all users: + +- **Bash**: `/usr/share/bash-completion/completions/dotnet` +- **Zsh**: `/usr/share/zsh/site-functions/_dotnet` +- **Fish**: `/usr/share/fish/vendor_completions.d/dotnet.fish` + +To disable this, set `tabCompletions` to `false`: + +``` json +"features": { + "ghcr.io/devcontainers/features/dotnet:2": { + "tabCompletions": false + } +} +``` diff --git a/src/dotnet/README.md b/src/dotnet/README.md index fecaeb3f3..ceb9c544f 100644 --- a/src/dotnet/README.md +++ b/src/dotnet/README.md @@ -15,11 +15,12 @@ This Feature installs the latest .NET SDK, which includes the .NET CLI and the s | Options Id | Description | Type | Default Value | |-----|-----|-----|-----| -| version | Select or enter a .NET SDK version. Use 'latest' for the latest version, 'lts' for the latest LTS version, 'X.Y' or 'X.Y.Z' for a specific version. | string | latest | -| additionalVersions | Enter additional .NET SDK versions, separated by commas. Use 'latest' for the latest version, 'lts' for the latest LTS version, 'X.Y' or 'X.Y.Z' for a specific version. | string | - | -| dotnetRuntimeVersions | Enter additional .NET runtime versions, separated by commas. Use 'latest' for the latest version, 'lts' for the latest LTS version, 'X.Y' or 'X.Y.Z' for a specific version. | string | - | -| aspNetCoreRuntimeVersions | Enter additional ASP.NET Core runtime versions, separated by commas. Use 'latest' for the latest version, 'lts' for the latest LTS version, 'X.Y' or 'X.Y.Z' for a specific version. | string | - | +| version | Select or enter a .NET SDK version. Use 'latest' for the latest version, 'lts' for the latest LTS version, 'X.Y' or 'X.Y.Z' for a specific version, 'X.Y-preview' or 'X.Y-daily' for prereleases. | string | latest | +| additionalVersions | Enter additional .NET SDK versions, separated by commas. Use 'latest' for the latest version, 'lts' for the latest LTS version, 'X.Y' or 'X.Y.Z' for a specific version, 'X.Y-preview' or 'X.Y-daily' for prereleases. | string | - | +| dotnetRuntimeVersions | Enter additional .NET runtime versions, separated by commas. Use 'latest' for the latest version, 'lts' for the latest LTS version, 'X.Y' or 'X.Y.Z' for a specific version, 'X.Y-preview' or 'X.Y-daily' for prereleases. | string | - | +| aspNetCoreRuntimeVersions | Enter additional ASP.NET Core runtime versions, separated by commas. Use 'latest' for the latest version, 'lts' for the latest LTS version, 'X.Y' or 'X.Y.Z' for a specific version, 'X.Y-preview' or 'X.Y-daily' for prereleases. | string | - | | workloads | Enter additional .NET SDK workloads, separated by commas. Use 'dotnet workload search' to learn what workloads are available to install. | string | - | +| tabCompletions | Install shell tab completions for the dotnet CLI. Requires SDK 10 or newer. | boolean | true | ## Customizations @@ -85,7 +86,7 @@ Installing only the .NET Runtime or the ASP.NET Core Runtime. (The SDK includes "ghcr.io/devcontainers/features/dotnet:2": { "version": "none", "dotnetRuntimeVersions": "latest, lts", - "aspnetCoreRuntimeVersions": "latest, lts", + "aspNetCoreRuntimeVersions": "latest, lts", } } ``` @@ -95,7 +96,7 @@ Installing .NET workloads. Multiple workloads can be specified as comma-separate ``` json "features": { "ghcr.io/devcontainers/features/dotnet:2": { - "workloads": "aspire, wasm-tools" + "workloads": "wasm-tools" } } ``` diff --git a/src/dotnet/devcontainer-feature.json b/src/dotnet/devcontainer-feature.json index 397f9a191..4bd3168c7 100644 --- a/src/dotnet/devcontainer-feature.json +++ b/src/dotnet/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "dotnet", - "version": "2.3.0", + "version": "2.5.0", "name": "Dotnet CLI", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/dotnet", "description": "This Feature installs the latest .NET SDK, which includes the .NET CLI and the shared runtime. Options are provided to choose a different version or additional versions.", @@ -11,38 +11,44 @@ "latest", "lts", "none", - "10.0-preview", + "10.0", + "9.0", "8.0", "7.0", "6.0" ], "default": "latest", - "description": "Select or enter a .NET SDK version. Use 'latest' for the latest version, 'lts' for the latest LTS version, 'X.Y' or 'X.Y.Z' for a specific version." + "description": "Select or enter a .NET SDK version. Use 'latest' for the latest version, 'lts' for the latest LTS version, 'X.Y' or 'X.Y.Z' for a specific version, 'X.Y-preview' or 'X.Y-daily' for prereleases." }, "additionalVersions": { "type": "string", "default": "", - "description": "Enter additional .NET SDK versions, separated by commas. Use 'latest' for the latest version, 'lts' for the latest LTS version, 'X.Y' or 'X.Y.Z' for a specific version." + "description": "Enter additional .NET SDK versions, separated by commas. Use 'latest' for the latest version, 'lts' for the latest LTS version, 'X.Y' or 'X.Y.Z' for a specific version, 'X.Y-preview' or 'X.Y-daily' for prereleases." }, "dotnetRuntimeVersions": { "type": "string", "default": "", - "description": "Enter additional .NET runtime versions, separated by commas. Use 'latest' for the latest version, 'lts' for the latest LTS version, 'X.Y' or 'X.Y.Z' for a specific version." + "description": "Enter additional .NET runtime versions, separated by commas. Use 'latest' for the latest version, 'lts' for the latest LTS version, 'X.Y' or 'X.Y.Z' for a specific version, 'X.Y-preview' or 'X.Y-daily' for prereleases." }, "aspNetCoreRuntimeVersions": { "type": "string", "default": "", - "description": "Enter additional ASP.NET Core runtime versions, separated by commas. Use 'latest' for the latest version, 'lts' for the latest LTS version, 'X.Y' or 'X.Y.Z' for a specific version." + "description": "Enter additional ASP.NET Core runtime versions, separated by commas. Use 'latest' for the latest version, 'lts' for the latest LTS version, 'X.Y' or 'X.Y.Z' for a specific version, 'X.Y-preview' or 'X.Y-daily' for prereleases." }, "workloads": { "type": "string", "default": "", "description": "Enter additional .NET SDK workloads, separated by commas. Use 'dotnet workload search' to learn what workloads are available to install." + }, + "tabCompletions": { + "type": "boolean", + "default": true, + "description": "Install shell tab completions for the dotnet CLI. Requires SDK 10 or newer." } }, "containerEnv": { "DOTNET_ROOT": "/usr/share/dotnet", - "PATH": "$PATH:$DOTNET_ROOT:~/.dotnet/tools", + "PATH": "$PATH:$DOTNET_ROOT", "DOTNET_RUNNING_IN_CONTAINER": "true", "DOTNET_USE_POLLING_FILE_WATCHER": "true" }, @@ -63,4 +69,4 @@ "installsAfter": [ "ghcr.io/devcontainers/features/common-utils" ] -} +} \ No newline at end of file diff --git a/src/dotnet/install.sh b/src/dotnet/install.sh index 75f013d03..a8e8436e5 100644 --- a/src/dotnet/install.sh +++ b/src/dotnet/install.sh @@ -11,6 +11,7 @@ ADDITIONAL_VERSIONS="${ADDITIONALVERSIONS:-""}" DOTNET_RUNTIME_VERSIONS="${DOTNETRUNTIMEVERSIONS:-""}" ASPNETCORE_RUNTIME_VERSIONS="${ASPNETCORERUNTIMEVERSIONS:-""}" WORKLOADS="${WORKLOADS:-""}" +TAB_COMPLETIONS="${TABCOMPLETIONS:-"true"}" # Prevent "Welcome to .NET" message from dotnet export DOTNET_NOLOGO=true @@ -105,20 +106,30 @@ done # Install .NET versions and dependencies # icu-devtools includes dependencies for .NET -check_packages wget ca-certificates icu-devtools +check_packages wget ca-certificates icu-devtools jq for version in "${versions[@]}"; do - # Remove '-preview' from version if suffixed with the version label - clean_version="$(echo "$version" | sed 's/-preview$//')" - install_sdk "$clean_version" + read -r clean_version quality < <(parse_version_and_quality "$version") + if [ -n "$quality" ]; then + echo "Interpreting requested version '$version' as version '$clean_version' with quality '$quality'" + fi + install_sdk "$clean_version" "$quality" done for version in "${dotnetRuntimeVersions[@]}"; do - install_runtime "dotnet" "$version" + read -r clean_version quality < <(parse_version_and_quality "$version") + if [ -n "$quality" ]; then + echo "Interpreting requested runtime version '$version' as version '$clean_version' with quality '$quality'" + fi + install_runtime "dotnet" "$clean_version" "$quality" done for version in "${aspNetCoreRuntimeVersions[@]}"; do - install_runtime "aspnetcore" "$version" + read -r clean_version quality < <(parse_version_and_quality "$version") + if [ -n "$quality" ]; then + echo "Interpreting requested ASP.NET Core runtime version '$version' as version '$clean_version' with quality '$quality'" + fi + install_runtime "aspnetcore" "$clean_version" "$quality" done workloads=() @@ -136,6 +147,17 @@ if [ ! -e /usr/bin/dotnet ]; then ln --symbolic "$DOTNET_ROOT/dotnet" /usr/bin/dotnet fi +if [ "$TAB_COMPLETIONS" = "true" ]; then + install_completions +fi + +# Add .NET Core SDK tools to PATH for bash and zsh users +# This is where 'dotnet tool install --global ' installs tools to +# Use single-quoted EOF to defer $PATH expansion until sourcing the file +cat << 'EOF' >> /etc/profile.d/dotnet.sh +export PATH="$PATH:$HOME/.dotnet/tools" +EOF + # Clean up rm -rf /var/lib/apt/lists/* rm -rf scripts diff --git a/src/dotnet/scripts/dotnet-helpers.sh b/src/dotnet/scripts/dotnet-helpers.sh index 84a674917..e4c90819a 100644 --- a/src/dotnet/scripts/dotnet-helpers.sh +++ b/src/dotnet/scripts/dotnet-helpers.sh @@ -8,46 +8,58 @@ # Maintainer: The Dev Container spec maintainers DOTNET_SCRIPTS=$(dirname "${BASH_SOURCE[0]}") DOTNET_INSTALL_SCRIPT="$DOTNET_SCRIPTS/vendor/dotnet-install.sh" +DOTNET_RELEASES_INDEX_URL="https://builds.dotnet.microsoft.com/dotnet/release-metadata/releases-index.json" -# Prints the latest dotnet version in the specified channel -# Usage: fetch_latest_version_in_channel [] -# Example: fetch_latest_version_in_channel "LTS" -# Example: fetch_latest_version_in_channel "6.0" "dotnet" -# Example: fetch_latest_version_in_channel "6.0" "aspnetcore" -fetch_latest_version_in_channel() { - local channel="$1" - local runtime="$2" - if [ "$runtime" = "dotnet" ]; then - wget -qO- "https://builds.dotnet.microsoft.com/dotnet/Runtime/$channel/latest.version" - elif [ "$runtime" = "aspnetcore" ]; then - wget -qO- "https://builds.dotnet.microsoft.com/dotnet/aspnetcore/Runtime/$channel/latest.version" - else - wget -qO- "https://builds.dotnet.microsoft.com/dotnet/Sdk/$channel/latest.version" - fi -} - -# Prints the latest dotnet version -# Usage: fetch_latest_version [] +# Prints the latest active dotnet version from the releases index. +# Usage: fetch_latest_version [] +# With no target, resolves the latest SDK version. +# With "sdk", resolves the latest SDK version explicitly. +# With "dotnet" or "aspnetcore", resolves the latest runtime version. +# Note: the upstream releases index only distinguishes SDK vs runtime for +# latest resolution, so "dotnet" and "aspnetcore" currently resolve to the +# same version. # Example: fetch_latest_version +# Example: fetch_latest_version "sdk" # Example: fetch_latest_version "dotnet" # Example: fetch_latest_version "aspnetcore" fetch_latest_version() { - local runtime="$1" - local sts_version - local lts_version - sts_version=$(fetch_latest_version_in_channel "STS" "$runtime") - lts_version=$(fetch_latest_version_in_channel "LTS" "$runtime") - if [[ "$sts_version" > "$lts_version" ]]; then - echo "$sts_version" - else - echo "$lts_version" - fi + local target="$1" + local version_field="" + local releases_index="" + + case "$target" in + ""|sdk) + version_field="latest-sdk" + ;; + dotnet|aspnetcore) + version_field="latest-runtime" + ;; + *) + echo "Unsupported target '$target'. Expected 'sdk', 'dotnet', or 'aspnetcore'." >&2 + return 1 + ;; + esac + + releases_index="$(wget -qO- "$DOTNET_RELEASES_INDEX_URL")" || return $? + + printf '%s\n' "$releases_index" \ + | jq -er --arg version_field "$version_field" ' + .["releases-index"] + | map( + select(."support-phase" == "active") + | .[$version_field] + ) + | .[0] + ' } # Installs a version of the .NET SDK -# Usage: install_sdk +# Usage: install_sdk [] +# Example: install_sdk "9.0" +# Example: install_sdk "10.0" "preview" install_sdk() { - local inputVersion="$1" + local inputVersion="$1" # Could be 'latest', 'lts', 'X.Y', 'X.Y.Z', 'X.Y.4xx', or base channel when paired with quality + local quality="$2" # Optional quality: GA, preview, daily (empty implies GA) local version="" local channel="" if [[ "$inputVersion" == "latest" ]]; then @@ -73,19 +85,25 @@ install_sdk() { version="$inputVersion" fi - # Currently this script does not make it possible to qualify the version, 'GA' is always implied - echo "Executing $DOTNET_INSTALL_SCRIPT --version $version --channel $channel --install-dir $DOTNET_ROOT" - "$DOTNET_INSTALL_SCRIPT" \ - --version "$version" \ - --channel "$channel" \ - --install-dir "$DOTNET_ROOT" + local cmd=("$DOTNET_INSTALL_SCRIPT" "--version" "$version" "--install-dir" "$DOTNET_ROOT") + if [ -n "$channel" ]; then + cmd+=("--channel" "$channel") + fi + if [ -n "$quality" ]; then + cmd+=("--quality" "$quality") + fi + echo "Executing ${cmd[*]}" + "${cmd[@]}" } # Installs a version of the .NET Runtime -# Usage: install_runtime +# Usage: install_runtime [] +# Example: install_runtime "dotnet" "9.0" +# Example: install_runtime "aspnetcore" "10.0" "preview" install_runtime() { local runtime="$1" - local inputVersion="$2" + local inputVersion="$2" # Could be 'latest', 'lts', 'X.Y', 'X.Y.Z' + local quality="$3" # Optional quality: GA, preview, daily (empty implies GA) local version="" local channel="" if [[ "$inputVersion" == "latest" ]]; then @@ -105,14 +123,16 @@ install_runtime() { # Assume version is an exact version string like '6.0.21' or '8.0.0-preview.7.23375.6' version="$inputVersion" fi - - echo "Executing $DOTNET_INSTALL_SCRIPT --runtime $runtime --version $version --channel $channel --install-dir $DOTNET_ROOT --no-path" - "$DOTNET_INSTALL_SCRIPT" \ - --runtime "$runtime" \ - --version "$version" \ - --channel "$channel" \ - --install-dir "$DOTNET_ROOT" \ - --no-path + + local cmd=("$DOTNET_INSTALL_SCRIPT" "--runtime" "$runtime" "--version" "$version" "--install-dir" "$DOTNET_ROOT" "--no-path") + if [ -n "$channel" ]; then + cmd+=("--channel" "$channel") + fi + if [ -n "$quality" ]; then + cmd+=("--quality" "$quality") + fi + echo "Executing ${cmd[*]}" + "${cmd[@]}" } # Installs one or more .NET workloads @@ -127,3 +147,92 @@ install_workloads() { # Clean up rm -r /tmp/dotnet-workload-temp-dir } + +# Input: version spec possibly containing -preview or -daily +# Supports channels in the forms: +# A.B (e.g. 10.0) +# A.B.Cxx (feature band e.g. 6.0.4xx) +# A.B-preview (adds quality) +# A.B-daily +# A.B.Cxx-preview +# A.B.Cxx-daily +# Output (stdout): " " +# - For channel specs (A.B or A.B.Cxx) without suffix -> quality is GA +# - For channel specs with -preview/-daily suffix -> quality is preview/daily +# - For exact version specs (contain a third numeric segment or prerelease labels beyond channel patterns, e.g. 8.0.100-rc.2.23502.2) -> quality is empty +# Examples: +# parse_version_and_quality "10.0-preview" => "10.0 preview" +# parse_version_and_quality "10.0-daily" => "10.0 daily" +# parse_version_and_quality "10.0" => "10.0 GA" +# parse_version_and_quality "6.0.4xx" => "6.0.4xx GA" +# parse_version_and_quality "6.0.4xx-preview" => "6.0.4xx preview" +# parse_version_and_quality "6.0.4xx-daily" => "6.0.4xx daily" +parse_version_and_quality() { + local input="$1" + local quality="" + local clean_version="$input" + # Match feature band with quality + if [[ "$input" =~ ^([0-9]+\.[0-9]+\.[0-9]xx)-(preview|daily)$ ]]; then + clean_version="${BASH_REMATCH[1]}" + quality="${BASH_REMATCH[2]}" + # Match simple channel with quality + elif [[ "$input" =~ ^([0-9]+\.[0-9]+)-(preview|daily)$ ]]; then + clean_version="${BASH_REMATCH[1]}" + quality="${BASH_REMATCH[2]}" + # Match plain feature band channel (defaults to GA) + elif [[ "$input" =~ ^[0-9]+\.[0-9]+\.[0-9]xx$ ]]; then + clean_version="$input" + quality="GA" + # Match simple channel (defaults to GA) + elif [[ "$input" =~ ^[0-9]+\.[0-9]+$ ]]; then + clean_version="$input" + quality="GA" + else + # Exact version (leave quality empty) + clean_version="$input" + quality="" + fi + echo "$clean_version" "$quality" +} + +# Checks if the installed .NET SDK is at least the given major version. +# Returns 0 (true) if the SDK major version >= the specified version, 1 otherwise. +# Also returns 1 if no SDK is installed (e.g. runtime-only installs). +# Usage: is_at_least_sdk_version +# Example: is_at_least_sdk_version 10 +is_at_least_sdk_version() { + local required_major="$1" + local dotnet_version + dotnet_version=$("$DOTNET_ROOT/dotnet" --version 2>/dev/null || true) + local major_version="${dotnet_version%%.*}" + [[ "$major_version" =~ ^[0-9]+$ ]] && [ "$major_version" -ge "$required_major" ] +} + +# Sets up dotnet tab completions for bash, zsh, and fish. +# The 'dotnet completions script' command is only available in .NET SDK 10+. +# Older SDKs and runtime-only installs will naturally skip this since the +# command won't be available. +# Reference: https://learn.microsoft.com/en-us/dotnet/core/tools/enable-tab-autocomplete +# Completion scripts are generated at install time and placed in the standard +# system-wide completion directories, which are auto-discovered by +# bash-completion, zsh, and fish without modifying any rc files. +install_completions() { + if ! is_at_least_sdk_version 10; then + echo "Skipping dotnet tab completions (requires SDK 10+)." + return + fi + + echo "Setting up dotnet tab completions..." + + # Bash: drop into the standard bash-completion directory + mkdir -p /usr/share/bash-completion/completions + "$DOTNET_ROOT/dotnet" completions script bash > /usr/share/bash-completion/completions/dotnet + + # Zsh: drop into the standard site-functions directory + mkdir -p /usr/share/zsh/site-functions + "$DOTNET_ROOT/dotnet" completions script zsh > /usr/share/zsh/site-functions/_dotnet + + # Fish: drop into the standard vendor completions directory + mkdir -p /usr/share/fish/vendor_completions.d + "$DOTNET_ROOT/dotnet" completions script fish > /usr/share/fish/vendor_completions.d/dotnet.fish +} \ No newline at end of file diff --git a/src/dotnet/scripts/vendor/dotnet-install.sh b/src/dotnet/scripts/vendor/dotnet-install.sh index 122ee68ed..034d2dfb1 100755 --- a/src/dotnet/scripts/vendor/dotnet-install.sh +++ b/src/dotnet/scripts/vendor/dotnet-install.sh @@ -477,7 +477,7 @@ get_normalized_quality() { local quality="$(to_lowercase "$1")" if [ ! -z "$quality" ]; then case "$quality" in - daily | signed | validated | preview) + daily | preview) echo "$quality" return 0 ;; @@ -486,7 +486,7 @@ get_normalized_quality() { return 0 ;; *) - say_err "'$quality' is not a supported value for --quality option. Supported values are: daily, signed, validated, preview, ga. If you think this is a bug, report it at https://github.com/dotnet/install-scripts/issues." + say_err "'$quality' is not a supported value for --quality option. Supported values are: daily, preview, ga. If you think this is a bug, report it at https://github.com/dotnet/install-scripts/issues." return 1 ;; esac @@ -1198,13 +1198,19 @@ downloadcurl() { local curl_options="--retry 20 --retry-delay 2 --connect-timeout 15 -sSL -f --create-dirs " local curl_exit_code=0; if [ -z "$out_path" ]; then - curl $curl_options "$remote_path_with_credential" 2>&1 + curl_output=$(curl $curl_options "$remote_path_with_credential" 2>&1) curl_exit_code=$? + echo "$curl_output" else - curl $curl_options -o "$out_path" "$remote_path_with_credential" 2>&1 + curl_output=$(curl $curl_options -o "$out_path" "$remote_path_with_credential" 2>&1) curl_exit_code=$? fi - + + # Regression in curl causes curl with --retry to return a 0 exit code even when it fails to download a file - https://github.com/curl/curl/issues/17554 + if [ $curl_exit_code -eq 0 ] && echo "$curl_output" | grep -q "^curl: ([0-9]*) "; then + curl_exit_code=$(echo "$curl_output" | sed 's/curl: (\([0-9]*\)).*/\1/') + fi + if [ $curl_exit_code -gt 0 ]; then download_error_msg="Unable to download $remote_path." # Check for curl timeout codes @@ -1272,61 +1278,6 @@ downloadwget() { return 0 } -extract_stem() { - local url="$1" - # extract the protocol - proto="$(echo $1 | grep :// | sed -e's,^\(.*://\).*,\1,g')" - # remove the protocol - url="${1/$proto/}" - # extract the path (if any) - since we know all of our feeds have a first path segment, we can skip the first one. otherwise we'd use -f2- to get the full path - full_path="$(echo $url | grep / | cut -d/ -f2-)" - path="$(echo $full_path | cut -d/ -f2-)" - echo $path -} - -check_url_exists() { - eval $invocation - local url="$1" - - local code="" - if machine_has "curl" - then - code=$(curl --head -o /dev/null -w "%{http_code}" -s --fail "$url"); - elif machine_has "wget" - then - # get the http response, grab the status code - server_response=$(wget -qO- --method=HEAD --server-response "$url" 2>&1) - code=$(echo "$server_response" | grep "HTTP/" | awk '{print $2}') - fi - if [ $code = "200" ]; then - return 0 - else - return 1 - fi -} - -sanitize_redirect_url() { - eval $invocation - - local url_stem - url_stem=$(extract_stem "$1") - say_verbose "Checking configured feeds for the asset at ${yellow:-}$url_stem${normal:-}" - - for feed in "${feeds[@]}" - do - local trial_url="$feed/$url_stem" - say_verbose "Checking ${yellow:-}$trial_url${normal:-}" - if check_url_exists "$trial_url"; then - say_verbose "Found a match at ${yellow:-}$trial_url${normal:-}" - echo "$trial_url" - return 0 - else - say_verbose "No match at ${yellow:-}$trial_url${normal:-}" - fi - done - return 1 -} - get_download_link_from_aka_ms() { eval $invocation @@ -1379,11 +1330,6 @@ get_download_link_from_aka_ms() { return 1 fi - sanitized_redirect_url=$(sanitize_redirect_url "$aka_ms_download_link") - if [[ -n "$sanitized_redirect_url" ]]; then - aka_ms_download_link="$sanitized_redirect_url" - fi - say_verbose "The redirect location retrieved: '$aka_ms_download_link'." return 0 else @@ -1396,24 +1342,15 @@ get_feeds_to_use() { feeds=( "https://builds.dotnet.microsoft.com/dotnet" - "https://dotnetcli.azureedge.net/dotnet" "https://ci.dot.net/public" - "https://dotnetbuilds.azureedge.net/public" ) if [[ -n "$azure_feed" ]]; then feeds=("$azure_feed") fi - if [[ "$no_cdn" == "true" ]]; then - feeds=( - "https://dotnetcli.blob.core.windows.net/dotnet" - "https://dotnetbuilds.blob.core.windows.net/public" - ) - - if [[ -n "$uncached_feed" ]]; then - feeds=("$uncached_feed") - fi + if [[ -n "$uncached_feed" ]]; then + feeds=("$uncached_feed") fi } @@ -1545,7 +1482,7 @@ generate_regular_links() { link_types+=("legacy") else legacy_download_link="" - say_verbose "Cound not construct a legacy_download_link; omitting..." + say_verbose "Could not construct a legacy_download_link; omitting..." fi # Check if the SDK version is already installed. @@ -1648,7 +1585,7 @@ install_dotnet() { say "The resource at $link_type link '$download_link' is not available." ;; *) - say "Failed to download $link_type link '$download_link': $download_error_msg" + say "Failed to download $link_type link '$download_link': $http_code $download_error_msg" ;; esac rm -f "$zip_path" 2>&1 && say_verbose "Temporary archive file $zip_path was removed" @@ -1709,7 +1646,6 @@ install_dir="" architecture="" dry_run=false no_path=false -no_cdn=false azure_feed="" uncached_feed="" feed_credential="" @@ -1782,10 +1718,6 @@ do verbose=true non_dynamic_parameters+=" $name" ;; - --no-cdn|-[Nn]o[Cc]dn) - no_cdn=true - non_dynamic_parameters+=" $name" - ;; --azure-feed|-[Aa]zure[Ff]eed) shift azure_feed="$1" @@ -1862,7 +1794,7 @@ do echo " examples: 2.0.0-preview2-006120; 1.1.0" echo " -q,--quality Download the latest build of specified quality in the channel." echo " -Quality" - echo " The possible values are: daily, signed, validated, preview, GA." + echo " The possible values are: daily, preview, GA." echo " Works only in combination with channel. Not applicable for STS and LTS channels and will be ignored if those channels are used." echo " For SDK use channel in A.B.Cxx format. Using quality for SDK together with channel in A.B format is not supported." echo " Supported since 5.0 release." @@ -1890,13 +1822,10 @@ do echo " --verbose,-Verbose Display diagnostics information." echo " --azure-feed,-AzureFeed For internal use only." echo " Allows using a different storage to download SDK archives from." - echo " This parameter is only used if --no-cdn is false." echo " --uncached-feed,-UncachedFeed For internal use only." echo " Allows using a different storage to download SDK archives from." - echo " This parameter is only used if --no-cdn is true." echo " --skip-non-versioned-files Skips non-versioned files if they already exist, such as the dotnet executable." echo " -SkipNonVersionedFiles" - echo " --no-cdn,-NoCdn Disable downloading from the Azure CDN, and use the uncached feed directly." echo " --jsonfile Determines the SDK version from a user specified global.json file." echo " Note: global.json must have a value for 'SDK:Version'" echo " --keep-zip,-KeepZip If set, downloaded file is kept." @@ -1956,4 +1885,4 @@ fi say "Note that the script does not resolve dependencies during installation." say "To check the list of dependencies, go to https://learn.microsoft.com/dotnet/core/install, select your operating system and check the \"Dependencies\" section." -say "Installation finished successfully." \ No newline at end of file +say "Installation finished successfully." diff --git a/src/git/devcontainer-feature.json b/src/git/devcontainer-feature.json index 7531ad2ab..1aa7e237b 100644 --- a/src/git/devcontainer-feature.json +++ b/src/git/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "git", - "version": "1.3.4", + "version": "1.3.8", "name": "Git (from source)", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/git", "description": "Install an up-to-date version of Git, built from source as needed. Useful for when you want the latest and greatest features. Auto-detects latest stable version and installs needed dependencies.", diff --git a/src/git/install.sh b/src/git/install.sh index 4124fc80c..e289ce16b 100755 --- a/src/git/install.sh +++ b/src/git/install.sh @@ -110,12 +110,8 @@ get_gpg_key_servers() { # Import the specified key in a variable name passed in as receive_gpg_keys() { - local keys=${!1} - local keyring_args="" - if [ ! -z "$2" ]; then - mkdir -p "$(dirname \"$2\")" - keyring_args="--no-default-keyring --keyring $2" - fi + local -a keys="(${!1})" + mkdir -p "$(dirname "$2")" # Install curl if ! type curl > /dev/null 2>&1; then @@ -133,13 +129,17 @@ receive_gpg_keys() { set +e until [ "${gpg_ok}" = "true" ] || [ "${retry_count}" -eq "5" ]; do - echo "(*) Downloading GPG key..." - ( echo "${keys}" | xargs -n 1 gpg -q ${keyring_args} --recv-keys) 2>&1 && gpg_ok="true" - if [ "${gpg_ok}" != "true" ]; then - echo "(*) Failed getting key, retrying in 10s..." - (( retry_count++ )) - sleep 10s - fi + for key in "${keys[@]}"; do + echo "(*) Downloading GPG key '${key}'..." + gpg --recv-keys "${key}" \ + && gpg --export "${key}" | gpg --dearmor --yes -o "$2" \ + && gpg_ok="true" + if [ "${gpg_ok}" != "true" ]; then + echo "(*) Failed getting key, retrying in 10s..." + (( retry_count++ )) + sleep 10s + fi + done done set -e if [ "${gpg_ok}" = "false" ]; then @@ -263,10 +263,10 @@ elif [ "${ADJUSTED_ID}" = "alpine" ]; then ${INSTALL_CMD} add --no-cache --update curl grep make zlib-dev # ref. - check_packages asciidoc curl-dev expat-dev g++ gcc openssl-dev pcre2-dev perl-dev perl-error python3-dev tcl tk xmlto + check_packages asciidoc curl-dev expat-dev g++ gcc linux-headers openssl-dev pcre2-dev perl-dev perl-error python3-dev tcl tk xmlto elif [ "${ADJUSTED_ID}" = "rhel" ]; then - check_packages gcc libcurl-devel expat-devel gettext-devel openssl-devel perl-devel zlib-devel cmake pcre2-devel tar gzip ca-certificates + check_packages gcc make libcurl-devel expat-devel gettext-devel openssl-devel perl-devel zlib-devel cmake pcre2-devel tar gzip ca-certificates if ! type curl > /dev/null 2>&1; then check_packages curl fi @@ -275,7 +275,7 @@ elif [ "${ADJUSTED_ID}" = "rhel" ]; then fi if ! type awk > /dev/null 2>&1; then check_packages gawk - fi + fi if [ $ID = "mariner" ]; then check_packages glibc-devel kernel-headers binutils fi @@ -288,7 +288,16 @@ fi # Partial version matching if [ "$(echo "${GIT_VERSION}" | grep -o '\.' | wc -l)" != "2" ]; then requested_version="${GIT_VERSION}" - version_list="$(curl -sSL -H "Accept: application/vnd.github.v3+json" "https://api.github.com/repos/git/git/tags" | grep -oP '"name":\s*"v\K[0-9]+\.[0-9]+\.[0-9]+"' | tr -d '"' | sort -rV )" + response_output_file=$(mktemp) + trap 'rm "$response_output_file"' EXIT + + http_code=$(curl --silent --output $response_output_file --write-out "%{http_code}" -sSL -H "Accept: application/vnd.github.v3+json" "https://api.github.com/repos/git/git/tags") + version_content=$(cat "$response_output_file") + if [[ ${http_code} -lt 200 || ${http_code} -gt 299 ]] ; then + echo "$version_content" >&2 + exit 1 + fi + version_list="$(echo "$version_content" | grep -oP '"name":\s*"v\K[0-9]+\.[0-9]+\.[0-9]+"' | tr -d '"' | sort -rV )" if [ "${requested_version}" = "latest" ] || [ "${requested_version}" = "lts" ] || [ "${requested_version}" = "current" ]; then GIT_VERSION="$(echo "${version_list}" | head -n 1)" else @@ -309,12 +318,18 @@ cd /tmp/git-${GIT_VERSION} git_options=("prefix=/usr/local") git_options+=("sysconfdir=/etc") git_options+=("USE_LIBPCRE=YesPlease") +git_options+=("NO_RUST=YesPlease") if [ "${ADJUSTED_ID}" = "alpine" ]; then # ref. git_options+=("NO_REGEX=YesPlease") git_options+=("NO_GETTEXT=YesPlease") fi make -s "${git_options[@]}" all && make -s "${git_options[@]}" install 2>&1 +build_result=$? rm -rf /tmp/git-${GIT_VERSION} clean_up +if [ "${build_result}" -ne 0 ]; then + echo "(!) Failed to build and install git ${GIT_VERSION}." >&2 + exit 1 +fi echo "Done!" diff --git a/src/github-cli/NOTES.md b/src/github-cli/NOTES.md index 19fe92f31..53c5322dd 100644 --- a/src/github-cli/NOTES.md +++ b/src/github-cli/NOTES.md @@ -1,7 +1,11 @@ - - ## OS Support This Feature should work on recent versions of Debian/Ubuntu-based distributions with the `apt` package manager installed. `bash` is required to execute the `install.sh` script. + +## Extensions + +If you set the `extensions` option, the feature will install each comma-separated entry. Extensions are installed for the most appropriate non-root user (based on `USERNAME` / `_REMOTE_USER`), with a fallback to `root`. + +Private extensions can be installed when `GH_TOKEN` or `GITHUB_TOKEN` is available during feature installation. The token is forwarded to the selected non-root user and used through the GitHub CLI Git credential helper. diff --git a/src/github-cli/README.md b/src/github-cli/README.md index 07945081a..0da722f69 100644 --- a/src/github-cli/README.md +++ b/src/github-cli/README.md @@ -1,4 +1,3 @@ - # GitHub CLI (github-cli) Installs the GitHub CLI. Auto-detects latest version and installs needed dependencies. @@ -13,12 +12,11 @@ Installs the GitHub CLI. Auto-detects latest version and installs needed depende ## Options -| Options Id | Description | Type | Default Value | -|-----|-----|-----|-----| -| version | Select version of the GitHub CLI, if not latest. | string | latest | -| installDirectlyFromGitHubRelease | - | boolean | true | - - +| Options Id | Description | Type | Default Value | +| -------------------------------- | --------------------------------------------------------------------------------------------------- | ------- | ------------- | +| version | Select version of the GitHub CLI, if not latest. | string | latest | +| installDirectlyFromGitHubRelease | - | boolean | true | +| extensions | Comma-separated list of GitHub CLI extensions to install (e.g. 'dlvhdr/gh-dash,github/gh-copilot'). | string | | ## OS Support @@ -26,7 +24,6 @@ This Feature should work on recent versions of Debian/Ubuntu-based distributions `bash` is required to execute the `install.sh` script. - --- -_Note: This file was auto-generated from the [devcontainer-feature.json](https://github.com/devcontainers/features/blob/main/src/github-cli/devcontainer-feature.json). Add additional notes to a `NOTES.md`._ +_Note: This file was auto-generated from the [devcontainer-feature.json](https://github.com/devcontainers/features/blob/main/src/github-cli/devcontainer-feature.json). Add additional notes to a `NOTES.md`._ diff --git a/src/github-cli/devcontainer-feature.json b/src/github-cli/devcontainer-feature.json index 04e373dfd..58b3e5b2f 100644 --- a/src/github-cli/devcontainer-feature.json +++ b/src/github-cli/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "github-cli", - "version": "1.0.14", + "version": "1.1.1", "name": "GitHub CLI", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/github-cli", "description": "Installs the GitHub CLI. Auto-detects latest version and installs needed dependencies.", @@ -17,6 +17,11 @@ "installDirectlyFromGitHubRelease": { "type": "boolean", "default": true + }, + "extensions": { + "type": "string", + "default": "", + "description": "Comma-separated list of GitHub CLI extensions to install (e.g. 'dlvhdr/gh-dash,github/gh-copilot')." } }, "customizations": { @@ -34,5 +39,4 @@ "ghcr.io/devcontainers/features/common-utils", "ghcr.io/devcontainers/features/git" ] -} - +} \ No newline at end of file diff --git a/src/github-cli/install.sh b/src/github-cli/install.sh index 18dae33ce..3638d9392 100755 --- a/src/github-cli/install.sh +++ b/src/github-cli/install.sh @@ -9,6 +9,7 @@ CLI_VERSION=${VERSION:-"latest"} INSTALL_DIRECTLY_FROM_GITHUB_RELEASE=${INSTALLDIRECTLYFROMGITHUBRELEASE:-"true"} +EXTENSIONS=${EXTENSIONS:-""} GITHUB_CLI_ARCHIVE_GPG_KEY=23F3D4EA75716059 @@ -195,14 +196,14 @@ install_deb_using_github() { mkdir -p /tmp/ghcli pushd /tmp/ghcli - wget https://github.com/cli/cli/releases/download/v${CLI_VERSION}/${cli_filename} + wget -q --show-progress --progress=dot:giga https://github.com/cli/cli/releases/download/v${CLI_VERSION}/${cli_filename} exit_code=$? set -e if [ "$exit_code" != "0" ]; then # Handle situation where git tags are ahead of what was is available to actually download echo "(!) github-cli version ${CLI_VERSION} failed to download. Attempting to fall back one version to retry..." find_prev_version_from_git_tags CLI_VERSION https://github.com/cli/cli - wget https://github.com/cli/cli/releases/download/v${CLI_VERSION}/${cli_filename} + wget -q --show-progress --progress=dot:giga https://github.com/cli/cli/releases/download/v${CLI_VERSION}/${cli_filename} fi dpkg -i /tmp/ghcli/${cli_filename} @@ -242,5 +243,42 @@ else echo "Done!" fi +# Install requested GitHub CLI extensions (if any) +if [ -n "${EXTENSIONS}" ]; then + SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" + EXTENSIONS_SCRIPT="${SCRIPT_DIR}/scripts/install-extensions.sh" + + # Determine the appropriate non-root user (mirrors other features' "automatic" behavior) + USERNAME="${USERNAME:-"${_REMOTE_USER:-"automatic"}"}" + if [ "${USERNAME}" = "auto" ] || [ "${USERNAME}" = "automatic" ]; then + USERNAME="" + POSSIBLE_USERS=("vscode" "node" "codespace" "$(awk -v val=1000 -F ":" '$3==val{print $1}' /etc/passwd)") + for CURRENT_USER in "${POSSIBLE_USERS[@]}"; do + if [ -n "${CURRENT_USER}" ] && id -u "${CURRENT_USER}" > /dev/null 2>&1; then + USERNAME="${CURRENT_USER}" + break + fi + done + if [ -z "${USERNAME}" ]; then + USERNAME=root + fi + elif [ "${USERNAME}" = "none" ] || ! id -u "${USERNAME}" > /dev/null 2>&1; then + USERNAME=root + fi + + if [ "${USERNAME}" = "root" ]; then + EXTENSIONS="${EXTENSIONS}" bash "${EXTENSIONS_SCRIPT}" + else + EXTENSIONS_ESCAPED="$(printf '%q' "${EXTENSIONS}")" + USERNAME_ESCAPED="$(printf '%q' "${USERNAME}")" + su \ + --login \ + --whitelist-environment=GH_TOKEN,GITHUB_TOKEN \ + --command "EXTENSIONS=${EXTENSIONS_ESCAPED} USERNAME=${USERNAME_ESCAPED} INSTALL_EXTENSIONS=true bash '${EXTENSIONS_SCRIPT}'" \ + "${USERNAME}" + INSTALL_EXTENSIONS=false bash "${EXTENSIONS_SCRIPT}" + fi +fi + # Clean up rm -rf /var/lib/apt/lists/* diff --git a/src/github-cli/scripts/install-extensions.sh b/src/github-cli/scripts/install-extensions.sh new file mode 100644 index 000000000..f8a893534 --- /dev/null +++ b/src/github-cli/scripts/install-extensions.sh @@ -0,0 +1,111 @@ +#!/usr/bin/env bash +#------------------------------------------------------------------------------------------------------------- +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information. +#------------------------------------------------------------------------------------------------------------- + +set -e + +EXTENSIONS=${EXTENSIONS:-""} +INSTALL_EXTENSIONS=${INSTALL_EXTENSIONS:-"true"} + +trim() { + local value="$1" + value="${value#${value%%[![:space:]]*}}" + value="${value%${value##*[![:space:]]}}" + echo "${value}" +} + +install_extension() { + local extension="$1" + local extensions_root + local repo_name + + extensions_root="${XDG_DATA_HOME:-"${HOME}/.local/share"}/gh/extensions" + repo_name="${extension##*/}" + + mkdir -p "${extensions_root}" + if [ ! -d "${extensions_root}/${repo_name}" ]; then + git \ + -c credential.helper= \ + -c credential.helper='!gh auth git-credential' \ + clone --depth 1 "https://github.com/${extension}.git" "${extensions_root}/${repo_name}" + fi +} + +ensure_gh_extension_list_wrapper() { + local gh_config_dir + + if [ "$(id -u)" -ne 0 ]; then + return + fi + + gh_config_dir="$(mktemp -d)" + if env \ + -u GH_TOKEN \ + -u GITHUB_TOKEN \ + -u GH_ENTERPRISE_TOKEN \ + -u GITHUB_ENTERPRISE_TOKEN \ + GH_CONFIG_DIR="${gh_config_dir}" \ + gh extension list >/dev/null 2>&1; then + rm -rf "${gh_config_dir}" + return + fi + rm -rf "${gh_config_dir}" + + cat > /usr/local/bin/gh <<'EOF' +#!/usr/bin/env bash +set -e + +REAL_GH=/usr/bin/gh + +if [ "$#" -ge 2 ]; then + cmd="$1" + sub="$2" + if { [ "$cmd" = "extension" ] || [ "$cmd" = "extensions" ] || [ "$cmd" = "ext" ]; } && { [ "$sub" = "list" ] || [ "$sub" = "ls" ]; }; then + extensions_root="${XDG_DATA_HOME:-"$HOME/.local/share"}/gh/extensions" + if [ -d "$extensions_root" ]; then + shopt -s nullglob + for d in "$extensions_root"/*; do + [ -d "$d" ] || continue + url="" + if command -v git >/dev/null 2>&1 && [ -d "$d/.git" ]; then + url="$(git -C "$d" config --get remote.origin.url 2>/dev/null || true)" + fi + if [ -n "$url" ]; then + url="${url%.git}" + url="${url#https://github.com/}" + url="${url#http://github.com/}" + url="${url#ssh://git@github.com/}" + url="${url#git@github.com:}" + echo "$url" + fi + done + fi + exit 0 + fi +fi + +exec "$REAL_GH" "$@" +EOF + chmod +x /usr/local/bin/gh +} + +if [ "${INSTALL_EXTENSIONS}" = "true" ]; then + if [ -z "${EXTENSIONS}" ]; then + exit 0 + fi + + echo "Installing GitHub CLI extensions: ${EXTENSIONS}" + IFS=',' read -r -a extension_list <<< "${EXTENSIONS}" + for extension in "${extension_list[@]}"; do + extension="$(trim "${extension}")" + if [ -z "${extension}" ]; then + continue + fi + + install_extension "${extension}" + done +fi + +ensure_gh_extension_list_wrapper diff --git a/src/go/devcontainer-feature.json b/src/go/devcontainer-feature.json index f98e65a7f..b61e93605 100644 --- a/src/go/devcontainer-feature.json +++ b/src/go/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "go", - "version": "1.3.2", + "version": "1.3.4", "name": "Go", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/go", "description": "Installs Go and common Go utilities. Auto-detects latest version and installs needed dependencies.", diff --git a/src/go/install.sh b/src/go/install.sh index 85fea5dc4..db0ac7977 100755 --- a/src/go/install.sh +++ b/src/go/install.sh @@ -301,10 +301,11 @@ GO_TOOLS="\ if [ "${INSTALL_GO_TOOLS}" = "true" ]; then echo "Installing common Go tools..." export PATH=${TARGET_GOROOT}/bin:${PATH} - mkdir -p /tmp/gotools /usr/local/etc/vscode-dev-containers ${TARGET_GOPATH}/bin - cd /tmp/gotools export GOPATH=/tmp/gotools - export GOCACHE=/tmp/gotools/cache + export GOCACHE="${GOPATH}/cache" + + mkdir -p "${GOPATH}" /usr/local/etc/vscode-dev-containers "${TARGET_GOPATH}/bin" + cd "${GOPATH}" # Use go get for versions of go under 1.16 go_install_command=install @@ -316,22 +317,24 @@ if [ "${INSTALL_GO_TOOLS}" = "true" ]; then (echo "${GO_TOOLS}" | xargs -n 1 go ${go_install_command} -v )2>&1 | tee -a /usr/local/etc/vscode-dev-containers/go.log - # Move Go tools into path and clean up - if [ -d /tmp/gotools/bin ]; then - mv /tmp/gotools/bin/* ${TARGET_GOPATH}/bin/ - rm -rf /tmp/gotools + # Move Go tools into path + if [ -d "${GOPATH}/bin" ]; then + mv "${GOPATH}/bin"/* "${TARGET_GOPATH}/bin/" fi # Install golangci-lint from precompiled binares if [ "$GOLANGCILINT_VERSION" = "latest" ] || [ "$GOLANGCILINT_VERSION" = "" ]; then echo "Installing golangci-lint latest..." - curl -fsSL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | \ + curl -fsSL https://golangci-lint.run/install.sh | \ sh -s -- -b "${TARGET_GOPATH}/bin" else echo "Installing golangci-lint ${GOLANGCILINT_VERSION}..." - curl -fsSL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | \ + curl -fsSL https://golangci-lint.run/install.sh | \ sh -s -- -b "${TARGET_GOPATH}/bin" "v${GOLANGCILINT_VERSION}" fi + + # Remove Go tools temp directory + rm -rf "${GOPATH}" fi diff --git a/src/java/devcontainer-feature.json b/src/java/devcontainer-feature.json index 4198af326..3a1170df7 100644 --- a/src/java/devcontainer-feature.json +++ b/src/java/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "java", - "version": "1.6.3", + "version": "1.8.1", "name": "Java (via SDKMAN!)", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/java", "description": "Installs Java, SDKMAN! (if not installed), and needed dependencies.", @@ -122,4 +122,4 @@ "installsAfter": [ "ghcr.io/devcontainers/features/common-utils" ] -} \ No newline at end of file +} diff --git a/src/java/install.sh b/src/java/install.sh index 62fd39462..a142ab9e3 100644 --- a/src/java/install.sh +++ b/src/java/install.sh @@ -195,6 +195,29 @@ updaterc() { fi } +run_with_retries() { + local max_attempts="$1" + local wait_seconds="$2" + local operation="$3" + local attempt=1 + shift 3 + + until "$@"; do + if [ "${attempt}" -ge "${max_attempts}" ]; then + echo "(!) ${operation} failed after ${max_attempts} attempts." + return 1 + fi + + echo "(*) ${operation} failed on attempt ${attempt}. Retrying in ${wait_seconds}s..." + attempt=$((attempt + 1)) + sleep "${wait_seconds}" + done +} + +install_sdkman_cli() { + bash -o pipefail -c 'curl -fsSL "https://get.sdkman.io?rcupdate=false" | bash' +} + find_version_list() { prefix="$1" suffix="$2" @@ -265,15 +288,27 @@ sdk_install() { set -e fi if [ -z "${requested_version}" ] || ! echo "${version_list}" | grep "^${requested_version//./\\.}$" > /dev/null 2>&1; then - echo -e "Version $2 not found. Available versions:\n${version_list}" >&2 - exit 1 + # Fallback to LTS if "latest" was requested and not found (java only) + if [ "$2" = "latest" ] && [ "${install_type}" = "java" ]; then + echo "Latest version not found in SDKMAN. Falling back to LTS..." + find_version_list "$prefix" "$suffix" "$install_type" "true" version_list "lts" + requested_version="$(echo "${version_list}" | head -n 1)" + if [ -z "${requested_version}" ] || ! echo "${version_list}" | grep "^${requested_version//./\\.}$" > /dev/null 2>&1; then + echo -e "Version $2 (and LTS fallback) not found. Available versions:\n${version_list}" >&2 + exit 1 + fi + else + echo -e "Version $2 not found. Available versions:\n${version_list}" >&2 + exit 1 + fi fi fi if [ "${set_as_default}" = "true" ]; then JAVA_VERSION=${requested_version} fi - su ${USERNAME} -c "umask 0002 && . ${SDKMAN_DIR}/bin/sdkman-init.sh && sdk install ${install_type} ${requested_version} && sdk flush archives && sdk flush temp" + run_with_retries 5 10 "Installing ${install_type} ${requested_version} via SDKMAN" \ + su ${USERNAME} -c "umask 0002 && . ${SDKMAN_DIR}/bin/sdkman-init.sh && sdk install ${install_type} ${requested_version} && sdk flush archives && sdk flush temp" } export DEBIAN_FRONTEND=noninteractive @@ -307,7 +342,28 @@ if [ ! -d "${SDKMAN_DIR}" ]; then usermod -a -G sdkman ${USERNAME} umask 0002 # Install SDKMAN - curl -sSL "https://get.sdkman.io?rcupdate=false" | bash + # For RHEL 8 systems (glibc 2.28), disable native version to avoid glibc compatibility issues + # SDKMAN native binaries require glibc 2.30+ which is not available in RHEL 8 / AlmaLinux 8 / Rocky 8 + if [ "${ADJUSTED_ID}" = "rhel" ] && [ "${MAJOR_VERSION_ID}" = "8" ]; then + export SDKMAN_NATIVE_VERSION="false" + fi + run_with_retries 5 10 "Installing SDKMAN" install_sdkman_cli + # For RHEL 8 systems, also disable native CLI in config file and remove native binaries + if [ "${ADJUSTED_ID}" = "rhel" ] && [ "${MAJOR_VERSION_ID}" = "8" ]; then + # Disable native CLI in config to prevent future usage + # The SDKMAN config key is sdkman_native_enable (checked in sdkman-main.sh) + if [ -f "${SDKMAN_DIR}/etc/config" ]; then + if grep -q "sdkman_native_enable" "${SDKMAN_DIR}/etc/config"; then + sed -i 's/sdkman_native_enable=.*/sdkman_native_enable=false/' "${SDKMAN_DIR}/etc/config" + else + echo "sdkman_native_enable=false" >> "${SDKMAN_DIR}/etc/config" + fi + fi + # Remove native binaries if they were installed + if [ -d "${SDKMAN_DIR}/libexec" ]; then + rm -rf "${SDKMAN_DIR}/libexec" + fi + fi chown -R "${USERNAME}:sdkman" ${SDKMAN_DIR} find ${SDKMAN_DIR} -type d -print0 | xargs -d '\n' -0 chmod g+s # Add sourcing of sdkman into bashrc/zshrc files (unless disabled) diff --git a/src/kubectl-helm-minikube/devcontainer-feature.json b/src/kubectl-helm-minikube/devcontainer-feature.json index 410a909e4..a88aebde6 100644 --- a/src/kubectl-helm-minikube/devcontainer-feature.json +++ b/src/kubectl-helm-minikube/devcontainer-feature.json @@ -1,61 +1,66 @@ { - "id": "kubectl-helm-minikube", - "version": "1.2.2", - "name": "Kubectl, Helm, and Minikube", - "documentationURL": "https://github.com/devcontainers/features/tree/main/src/kubectl-helm-minikube", - "description": "Installs latest version of kubectl, Helm, and optionally minikube. Auto-detects latest versions and installs needed dependencies.", - "options": { - "version": { - "type": "string", - "proposals": [ - "latest", - "none", - "1.23", - "1.22", - "1.21", - "none" - ], - "default": "latest", - "description": "Select or enter a Kubernetes version to install" - }, - "helm": { - "type": "string", - "proposals": [ - "latest", - "none" - ], - "default": "latest", - "description": "Select or enter a Helm version to install" - }, - "minikube": { - "type": "string", - "proposals": [ - "latest", - "none" - ], - "default": "latest", - "description": "Select or enter a Minikube version to install" - } + "id": "kubectl-helm-minikube", + "version": "1.3.1", + "name": "Kubectl, Helm, and Minikube", + "documentationURL": "https://github.com/devcontainers/features/tree/main/src/kubectl-helm-minikube", + "description": "Installs latest version of kubectl, Helm, and optionally minikube. Auto-detects latest versions and installs needed dependencies.", + "options": { + "version": { + "type": "string", + "proposals": [ + "latest", + "none", + "1.23", + "1.22", + "1.21", + "none" + ], + "default": "latest", + "description": "Select or enter a Kubernetes version to install" }, - "mounts": [ - { - "source": "minikube-config", - "target": "/home/vscode/.minikube", - "type": "volume" - } - ], - "customizations": { - "vscode": { - "settings": { - "github.copilot.chat.codeGeneration.instructions": [ - { - "text": "This dev container includes kubectl, Helm, optionally minikube, and needed dependencies pre-installed and available on the `PATH`. When configuring Ingress for your Kubernetes cluster, note that by default Kubernetes will bind to a specific interface's IP rather than localhost or all interfaces. This is why you need to use the Kubernetes Node's IP when connecting - even if there's only one Node as in the case of Minikube." - } - ] - } - } + "helm": { + "type": "string", + "proposals": [ + "latest", + "none" + ], + "default": "latest", + "description": "Select or enter a Helm version to install" }, - "installsAfter": [ - "ghcr.io/devcontainers/features/common-utils" - ] + "minikube": { + "type": "string", + "proposals": [ + "latest", + "none" + ], + "default": "latest", + "description": "Select or enter a Minikube version to install" + }, + "kubectlFallbackVersion": { + "type": "string", + "default": "v1.35.1", + "description": "Fallback kubectl version to use when the latest stable version cannot be fetched" + } + }, + "mounts": [ + { + "source": "minikube-config", + "target": "/home/vscode/.minikube", + "type": "volume" + } + ], + "customizations": { + "vscode": { + "settings": { + "github.copilot.chat.codeGeneration.instructions": [ + { + "text": "This dev container includes kubectl, Helm, optionally minikube, and needed dependencies pre-installed and available on the `PATH`. When configuring Ingress for your Kubernetes cluster, note that by default Kubernetes will bind to a specific interface's IP rather than localhost or all interfaces. This is why you need to use the Kubernetes Node's IP when connecting - even if there's only one Node as in the case of Minikube." + } + ] + } + } + }, + "installsAfter": [ + "ghcr.io/devcontainers/features/common-utils" + ] } diff --git a/src/kubectl-helm-minikube/install.sh b/src/kubectl-helm-minikube/install.sh index f0cf1c946..40901d3cb 100755 --- a/src/kubectl-helm-minikube/install.sh +++ b/src/kubectl-helm-minikube/install.sh @@ -12,6 +12,9 @@ set -e # Clean up rm -rf /var/lib/apt/lists/* +# Fallback version when stable.txt cannot be fetched +KUBECTL_FALLBACK_VERSION="${KUBECTLFALLBACKVERSION:-"v1.35.1"}" + KUBECTL_VERSION="${VERSION:-"latest"}" HELM_VERSION="${HELM:-"latest"}" MINIKUBE_VERSION="${MINIKUBE:-"latest"}" # latest is also valid @@ -164,7 +167,15 @@ if [ ${KUBECTL_VERSION} != "none" ]; then # Install the kubectl, verify checksum echo "Downloading kubectl..." if [ "${KUBECTL_VERSION}" = "latest" ] || [ "${KUBECTL_VERSION}" = "lts" ] || [ "${KUBECTL_VERSION}" = "current" ] || [ "${KUBECTL_VERSION}" = "stable" ]; then - KUBECTL_VERSION="$(curl -sSL https://dl.k8s.io/release/stable.txt)" + KUBECTL_VERSION="$(curl -fsSL --connect-timeout 10 --max-time 30 https://dl.k8s.io/release/stable.txt 2>/dev/null | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+' || echo "")" + if [ -z "${KUBECTL_VERSION}" ]; then + echo "(!) Failed to fetch kubectl stable version from dl.k8s.io, trying alternative URL..." + KUBECTL_VERSION="$(curl -fsSL --connect-timeout 10 --max-time 30 https://storage.googleapis.com/kubernetes-release/release/stable.txt 2>/dev/null | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+' || echo "")" + fi + if [ -z "${KUBECTL_VERSION}" ]; then + echo "(!) Failed to fetch kubectl stable version from both URLs. Using fallback version ${KUBECTL_FALLBACK_VERSION}" + KUBECTL_VERSION="${KUBECTL_FALLBACK_VERSION}" + fi else find_version_from_git_tags KUBECTL_VERSION https://github.com/kubernetes/kubernetes fi diff --git a/src/nix/install.sh b/src/nix/install.sh index 0030c2b18..ca19f658a 100755 --- a/src/nix/install.sh +++ b/src/nix/install.sh @@ -113,10 +113,8 @@ fi chmod +x,o+r ${FEATURE_DIR} ${FEATURE_DIR}/post-install-steps.sh if [ "${MULTIUSER}" = "true" ]; then /usr/local/share/nix-entrypoint.sh - su ${USERNAME} -c " - . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh - ${FEATURE_DIR}/post-install-steps.sh - " + . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh + NIX_FEATURE_INSTALL_PROFILE=/nix/var/nix/profiles/default ${FEATURE_DIR}/post-install-steps.sh else su ${USERNAME} -c " . \$HOME/.nix-profile/etc/profile.d/nix.sh diff --git a/src/nix/post-install-steps.sh b/src/nix/post-install-steps.sh index 68f93a391..94cfed8a3 100755 --- a/src/nix/post-install-steps.sh +++ b/src/nix/post-install-steps.sh @@ -2,6 +2,14 @@ set -e echo "(*) Executing post-installation steps..." +# In multi-user mode, install into the default profile that is on PATH. +NIX_ENV_PROFILE_ARGS=() +NIX_PROFILE_INSTALL_ARGS=() +if [ -n "${NIX_FEATURE_INSTALL_PROFILE}" ]; then + NIX_ENV_PROFILE_ARGS=(-p "${NIX_FEATURE_INSTALL_PROFILE}") + NIX_PROFILE_INSTALL_ARGS=(--profile "${NIX_FEATURE_INSTALL_PROFILE}") +fi + # if not starts with "nixpkgs." add it as prefix to package name add_nixpkgs_prefix() { local packages=$1 @@ -20,17 +28,17 @@ if [ ! -z "${PACKAGES}" ] && [ "${PACKAGES}" != "none" ]; then if [ "${USEATTRIBUTEPATH}" = "true" ]; then PACKAGES=$(add_nixpkgs_prefix "$PACKAGES") echo "Installing packages \"${PACKAGES}\" in profile..." - nix-env -iA ${PACKAGES} + nix-env "${NIX_ENV_PROFILE_ARGS[@]}" -iA ${PACKAGES} else echo "Installing packages \"${PACKAGES}\" in profile..." - nix-env --install ${PACKAGES} + nix-env "${NIX_ENV_PROFILE_ARGS[@]}" --install ${PACKAGES} fi fi # Install Nix flake in profile if specified if [ ! -z "${FLAKEURI}" ] && [ "${FLAKEURI}" != "none" ]; then echo "Installing flake ${FLAKEURI} in profile..." - nix profile install "${FLAKEURI}" + nix profile install "${NIX_PROFILE_INSTALL_ARGS[@]}" "${FLAKEURI}" fi nix-collect-garbage --delete-old diff --git a/src/node/NOTES.md b/src/node/NOTES.md index 506fa1b4e..9f1c1d3bc 100644 --- a/src/node/NOTES.md +++ b/src/node/NOTES.md @@ -25,3 +25,27 @@ Debian/Ubuntu, RedHat Enterprise Linux, Fedora, Alma, and Rocky Linux distributi **Note**: RedHat 7 Family (RedHat, CentOS, etc.) must use Node versions less than 18 due to its system libraries and long-term support (LTS) policies. `bash` is required to execute the `install.sh` script. + +## Pre-bundled items + +> [!NOTE] +> Beyond the core install, this feature also sets up a few items by default for convenience — recommended VS Code extensions (such as a linter) and supporting tools. This is intentional behavior shared across features in this repository. + +## Excluding pre-bundled items + +Exclude a bundled **VS Code extension** by prefixing its ID with `-`, or (when supported by a feature option) disable a bundled **tool** by setting its version option to `none` (for example, `pnpmVersion`: `none`): + +```json +{ + "features": { + "ghcr.io/devcontainers/features/node:2": { + "pnpmVersion": "none" + } + }, + "customizations": { + "vscode": { + "extensions": [ "-dbaeumer.vscode-eslint" ] + } + } +} +``` diff --git a/src/node/README.md b/src/node/README.md index 328af529f..028b47401 100644 --- a/src/node/README.md +++ b/src/node/README.md @@ -7,7 +7,16 @@ Installs Node.js, nvm, yarn, pnpm, and needed dependencies. ```json "features": { - "ghcr.io/devcontainers/features/node:1": {} + "ghcr.io/devcontainers/features/node:2": {} +} +``` + +```json +"features": { + "ghcr.io/devcontainers/features/node:2": { + "version": "20", + "npmVersion": "10.8.0" + } } ``` @@ -18,9 +27,10 @@ Installs Node.js, nvm, yarn, pnpm, and needed dependencies. | version | Select or enter a Node.js version to install | string | lts | | nodeGypDependencies | Install dependencies to compile native node modules (node-gyp)? | boolean | true | | nvmInstallPath | The path where NVM will be installed. | string | /usr/local/share/nvm | +| npmVersion | Select or enter a specific NPM version to install globally. Use 'latest' for the latest version, 'none' to skip npm version update, or specify a version like '10.9.0'. | string | none | | pnpmVersion | Select or enter the PNPM version to install | string | latest | | nvmVersion | Version of NVM to install. | string | latest | -| installYarnUsingApt | On Debian and Ubuntu systems, you have the option to install Yarn globally via APT. If you choose not to use this option, Yarn will be set up using Corepack instead. This choice is specific to Debian and Ubuntu; for other Linux distributions, Yarn is always installed using Corepack, with a fallback to installation via NPM if an error occurs. | boolean | true | +| installYarnUsingApt | On Debian and Ubuntu systems, you have the option to install Yarn globally via APT. If you choose not to use this option, Yarn will be set up using Corepack instead. This choice is specific to Debian and Ubuntu; for other Linux distributions, Yarn is always installed using Corepack, with a fallback to installation via NPM if an error occurs. | boolean | false | ## Customizations diff --git a/src/node/devcontainer-feature.json b/src/node/devcontainer-feature.json index 1828ba0d5..5e0970b2d 100644 --- a/src/node/devcontainer-feature.json +++ b/src/node/devcontainer-feature.json @@ -1,7 +1,7 @@ { "id": "node", - "version": "1.6.3", - "name": "Node.js (via nvm), yarn and pnpm", + "version": "2.1.0", + "name": "Node.js (via nvm), yarn and pnpm.", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/node", "description": "Installs Node.js, nvm, yarn, pnpm, and needed dependencies.", "options": { @@ -27,6 +27,21 @@ "default": "/usr/local/share/nvm", "description": "The path where NVM will be installed." }, + "npmVersion": { + "type": "string", + "proposals": [ + "lts", + "latest", + "10.9.0", + "10.8.0", + "10.7.0", + "9.9.3", + "8.19.4", + "none" + ], + "default": "none", + "description": "Select or enter a specific NPM version to install globally. Use 'latest' for the latest version, 'none' to skip npm version update, or specify a version like '10.9.0'." + }, "pnpmVersion": { "type": "string", "proposals": [ @@ -52,7 +67,7 @@ }, "installYarnUsingApt": { "type": "boolean", - "default": true, + "default": false, "description": "On Debian and Ubuntu systems, you have the option to install Yarn globally via APT. If you choose not to use this option, Yarn will be set up using Corepack instead. This choice is specific to Debian and Ubuntu; for other Linux distributions, Yarn is always installed using Corepack, with a fallback to installation via NPM if an error occurs." } }, @@ -78,4 +93,4 @@ "installsAfter": [ "ghcr.io/devcontainers/features/common-utils" ] -} \ No newline at end of file +} diff --git a/src/node/install.sh b/src/node/install.sh index 46d448440..0e277812e 100755 --- a/src/node/install.sh +++ b/src/node/install.sh @@ -8,11 +8,12 @@ # Maintainer: The Dev Container spec maintainers export NODE_VERSION="${VERSION:-"lts"}" +export NPM_VERSION="${NPMVERSION:-"lts"}" export PNPM_VERSION="${PNPMVERSION:-"latest"}" export NVM_VERSION="${NVMVERSION:-"latest"}" export NVM_DIR="${NVMINSTALLPATH:-"/usr/local/share/nvm"}" INSTALL_TOOLS_FOR_NODE_GYP="${NODEGYPDEPENDENCIES:-true}" -export INSTALL_YARN_USING_APT="${INSTALLYARNUSINGAPT:-true}" # only concerns Debian-based systems +export INSTALL_YARN_USING_APT="${INSTALLYARNUSINGAPT:-false}" # only concerns Debian-based systems # Comma-separated list of node versions to be installed (with nvm) # alongside NODE_VERSION, but not set as default. @@ -203,8 +204,9 @@ install_yarn() { # via apt-get on Debian systems if ! type yarn >/dev/null 2>&1; then # Import key safely (new method rather than deprecated apt-key approach) and install - curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor > /usr/share/keyrings/yarn-archive-keyring.gpg - echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/yarn-archive-keyring.gpg] https://dl.yarnpkg.com/debian/ stable main" > /etc/apt/sources.list.d/yarn.list + mkdir -p /etc/apt/keyrings + curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor --yes -o /etc/apt/keyrings/yarn-archive-keyring.gpg + echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/yarn-archive-keyring.gpg] https://dl.yarnpkg.com/debian/ stable main" > /etc/apt/sources.list.d/yarn.list apt-get update apt-get -y install --no-install-recommends yarn else @@ -355,7 +357,9 @@ else fi # Possibly install yarn (puts yarn in per-Node install on RHEL, uses system yarn on Debian) -install_yarn +if [ -n "${NODE_VERSION}" ] && [ "${NODE_VERSION}" != "none" ]; then + install_yarn +fi # Additional node versions to be installed but not be set as # default we can assume the nvm is the group owner of the nvm @@ -378,18 +382,107 @@ if [ ! -z "${ADDITIONAL_VERSIONS}" ]; then IFS=$OLDIFS fi -# Install pnpm -if [ ! -z "${PNPM_VERSION}" ] && [ "${PNPM_VERSION}" = "none" ]; then - echo "Ignoring installation of PNPM" -else - if bash -c ". '${NVM_DIR}/nvm.sh' && type npm >/dev/null 2>&1"; then +# Install or update npm to specific version +if [ -z "${NPM_VERSION}" ] || [ "${NPM_VERSION}" = "none" ]; then + echo "Ignoring NPM version update" +elif bash -c ". '${NVM_DIR}/nvm.sh' && type npm >/dev/null 2>&1"; then ( . "${NVM_DIR}/nvm.sh" [ ! -z "$http_proxy" ] && npm set proxy="$http_proxy" [ ! -z "$https_proxy" ] && npm set https-proxy="$https_proxy" [ ! -z "$no_proxy" ] && npm set noproxy="$no_proxy" - npm install -g pnpm@$PNPM_VERSION --force + echo "Installing npm version ${NPM_VERSION}..." + + CURRENT_NPM_VERSION=$(npm --version 2>/dev/null || echo 'unknown') + echo "Current npm version: $CURRENT_NPM_VERSION" + + # Clear npm cache and extract version numbers + npm cache clean --force 2>/dev/null || true + CURRENT_MAJOR=$(echo "$CURRENT_NPM_VERSION" | cut -d. -f1 || echo "0") + NODE_MAJOR=$(node --version 2>/dev/null | cut -d. -f1 | tr -d 'v' || echo "0") + + # Dynamically check npm's Node.js requirements and auto-fallback if incompatible + ORIGINAL_NPM_VERSION="$NPM_VERSION" + if [ "$NPM_VERSION" != "none" ]; then + echo "Checking npm compatibility requirements..." + NPM_NODE_REQUIREMENT=$(npm view npm@${NPM_VERSION} engines.node 2>/dev/null || echo "") + + if [ -n "$NPM_NODE_REQUIREMENT" ]; then + echo "npm $NPM_VERSION requires Node.js: $NPM_NODE_REQUIREMENT" + + # Extract minimum required Node version from requirement string + MIN_NODE=$(echo "$NPM_NODE_REQUIREMENT" | grep -oE '[0-9]+' | head -1 || echo "0") + + if [ "$MIN_NODE" -gt "0" ] && [ "$NODE_MAJOR" -lt "$MIN_NODE" ]; then + echo "⚠️ WARNING: npm $NPM_VERSION requires Node.js $MIN_NODE+, you have $NODE_MAJOR.x" + + # Find compatible npm version dynamically using same logic + echo "🔍 Finding compatible npm version for Node.js $NODE_MAJOR.x..." + + # Try npm major versions in descending order to find highest compatible version + for npm_major in 10 9 8 7 6; do + echo "Checking npm $npm_major compatibility..." + FALLBACK_NODE_REQUIREMENT=$(npm view "npm@${npm_major}" engines.node 2>/dev/null || echo "") + + if [ -n "$FALLBACK_NODE_REQUIREMENT" ]; then + MIN_NODE=$(echo "$FALLBACK_NODE_REQUIREMENT" | grep -oE '[0-9]+' | head -1 || echo "0") + + if [ "$MIN_NODE" -le "$NODE_MAJOR" ]; then + # Get latest patch version for this compatible major version + NPM_VERSION=$(npm view "npm@${npm_major}" version 2>/dev/null || echo "") + if [ -n "$NPM_VERSION" ]; then + echo "✓ Found compatible npm $NPM_VERSION (requires Node.js $MIN_NODE+)" + echo "🔄 Auto-fallback: Installing compatible npm $NPM_VERSION instead" + break + fi + fi + fi + done + + # If no compatible version found, skip npm installation + if [ "$NPM_VERSION" = "$ORIGINAL_NPM_VERSION" ]; then + echo "❌ Could not find compatible npm version, keeping current npm" + NPM_VERSION="none" + fi + elif [ "$MIN_NODE" -gt "0" ]; then + echo "✓ Node.js $NODE_MAJOR.x meets npm $NPM_VERSION requirement" + fi + else + echo "Could not determine Node.js requirements for npm $NPM_VERSION, proceeding anyway..." + fi + fi + + # Check if npm installation was cancelled due to compatibility issues + if [ "$NPM_VERSION" = "none" ]; then + echo "Skipping npm installation due to compatibility issues." + else + # Try npm installation with retries + for i in 1 2 3; do + echo "Attempt $i: Running npm install -g npm@$NPM_VERSION" + if npm install -g npm@$NPM_VERSION --force --no-audit --no-fund 2>&1; then + NEW_VERSION=$(npm --version 2>/dev/null || echo 'unknown') + echo "Successfully installed npm@${NPM_VERSION}, new version: $NEW_VERSION" + break + else + echo "Attempt $i failed, retrying..." + sleep 2 + if [ $i -eq 3 ]; then + echo "Failed to install npm@${NPM_VERSION} after 3 attempts. Keeping current npm version $(npm --version 2>/dev/null || echo 'unknown')." + fi + fi + done + fi ) + else + echo "Skip installing/updating npm because npm is not available" + fi + +# Install pnpm +if [ ! -z "${PNPM_VERSION}" ] && [ "${PNPM_VERSION}" = "none" ]; then + echo "Ignoring installation of PNPM" +else + if bash -c ". '${NVM_DIR}/nvm.sh' && type npm >/dev/null 2>&1"; then + su ${USERNAME} -c "umask 0002 && . '${NVM_DIR}/nvm.sh' && npm install -g pnpm@${PNPM_VERSION} --force" else echo "Skip installing pnpm because npm is missing" fi diff --git a/src/nvidia-cuda/devcontainer-feature.json b/src/nvidia-cuda/devcontainer-feature.json index 7dd46f7c0..477faf17a 100644 --- a/src/nvidia-cuda/devcontainer-feature.json +++ b/src/nvidia-cuda/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "nvidia-cuda", - "version": "2.0.0", + "version": "3.0.0", "name": "NVIDIA CUDA", "description": "Installs shared libraries for NVIDIA CUDA.", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/nvidia-cuda", @@ -42,7 +42,7 @@ "11.3", "11.2" ], - "default": "11.8", + "default": "12.5", "description": "Version of CUDA to install" }, "cudnnVersion": { diff --git a/src/nvidia-cuda/install.sh b/src/nvidia-cuda/install.sh index 6de935540..66e4a6834 100644 --- a/src/nvidia-cuda/install.sh +++ b/src/nvidia-cuda/install.sh @@ -62,13 +62,26 @@ esac # Add NVIDIA's package repository to apt so that we can download packages # Updating the repo to ubuntu2204 as ubuntu 20.04 is going out of support. NVIDIA_REPO_URL="https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/$NVIDIA_ARCH" -KEYRING_PACKAGE="cuda-keyring_1.0-1_all.deb" -KEYRING_PACKAGE_URL="$NVIDIA_REPO_URL/$KEYRING_PACKAGE" -KEYRING_PACKAGE_PATH="$(mktemp -d)" -KEYRING_PACKAGE_FILE="$KEYRING_PACKAGE_PATH/$KEYRING_PACKAGE" -wget -O "$KEYRING_PACKAGE_FILE" "$KEYRING_PACKAGE_URL" -apt-get install -yq "$KEYRING_PACKAGE_FILE" -apt-get update -yq + + +if [ "${ID}" = "debian" ] && [ "${VERSION_CODENAME}" = "trixie" ]; then + echo "(!) Temporary workaround on debian:trixie: bypassing NVIDIA repo signature checks" + cat > /etc/apt/sources.list.d/cuda.list < "${XDEBUG_INI}" diff --git a/src/powershell/README.md b/src/powershell/README.md index 31199a4e1..f09ac1f02 100644 --- a/src/powershell/README.md +++ b/src/powershell/README.md @@ -7,7 +7,7 @@ Installs PowerShell along with needed dependencies. Useful for base Dockerfiles ```json "features": { - "ghcr.io/devcontainers/features/powershell:1": {} + "ghcr.io/devcontainers/features/powershell:2": {} } ``` diff --git a/src/powershell/devcontainer-feature.json b/src/powershell/devcontainer-feature.json index f4867cc9e..009f4c238 100644 --- a/src/powershell/devcontainer-feature.json +++ b/src/powershell/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "powershell", - "version": "1.5.1", + "version": "2.0.2", "name": "PowerShell", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/powershell", "description": "Installs PowerShell along with needed dependencies. Useful for base Dockerfiles that often are missing required install dependencies like gpg.", @@ -9,10 +9,12 @@ "type": "string", "proposals": [ "latest", + "lts", + "preview", + "stable", "none", - "7.4", - "7.3", - "7.2" + "7.5", + "7.4" ], "default": "latest", "description": "Select or enter a version of PowerShell." @@ -20,7 +22,7 @@ "modules": { "type": "string", "default": "", - "description": "Optional comma separated list of PowerShell modules to install. If you need to install a specific version of a module, use '==' to specify the version (e.g. 'az.resources==2.5.0')" + "description": "Optional comma separated list of PowerShell modules to install. If you need to install a specific version of a module, use '==' to specify the version (e.g. 'az.resources==2.5.0')." }, "powershellProfileURL": { "type": "string", diff --git a/src/powershell/install.sh b/src/powershell/install.sh index 3da7a231b..cabd2cbb4 100755 --- a/src/powershell/install.sh +++ b/src/powershell/install.sh @@ -48,6 +48,26 @@ clean_cache() { rm -rf /var/cache/dnf/* fi } +# Function to resolve PowerShell version from Microsoft redirect URLs +resolve_powershell_version() { + local version_tag="$1" + local redirect_url="https://aka.ms/powershell-release?tag=${version_tag}" + + # Follow the redirect and extract the version from the final URL + local resolved_url + resolved_url=$(curl -sSL -o /dev/null -w '%{url_effective}' "${redirect_url}") + + # Extract version from URL (e.g., https://github.com/PowerShell/PowerShell/releases/tag/v7.4.7 -> 7.4.7) + local resolved_version + resolved_version=$(echo "${resolved_url}" | grep -oP 'v\K[0-9]+\.[0-9]+\.[0-9]+(-\w+\.\d+)?' || echo "") + + if [ -z "${resolved_version}" ]; then + echo "Failed to resolve version for tag: ${version_tag}" >&2 + return 1 + fi + + echo "${resolved_version}" +} # Install dependencies for RHEL/CentOS/AlmaLinux (DNF-based systems) install_using_dnf() { dnf remove -y curl-minimal @@ -100,6 +120,63 @@ detect_package_manager() { fi } +# Function to find the latest preview version from git tags +find_preview_version_from_git_tags() { + local variable_name=$1 + local requested_version=${!variable_name} + local repository_url=$2 + + if [ -z "${git_cmd_name}" ]; then + if type git > /dev/null 2>&1; then + git_cmd_name="git" + else + echo "Git not found. Cannot determine preview version." + return 1 + fi + fi + + # Fetch tags from remote repository (match both -preview.X and -rc.X tags) + local tags + tags=$(git ls-remote --tags "${repository_url}" 2>/dev/null | grep -oP 'refs/tags/v\K[0-9]+\.[0-9]+\.[0-9]+-(preview|rc)\.[0-9]+' | sort -V) + + if [ -z "${tags}" ]; then + echo "No preview/rc tags found in repository." + return 1 + fi + + local version="" + + if [ "${requested_version}" = "preview" ] || [ "${requested_version}" = "latest" ]; then + # Get the latest preview/rc version + version=$(echo "${tags}" | tail -n 1) + elif [[ "${requested_version}" =~ ^[0-9]+\.[0-9]+$ ]]; then + # Partial version provided (e.g., "7.6"), find latest preview/rc matching that major.minor + version=$(echo "${tags}" | grep "^${requested_version}\." | tail -n 1) + elif [[ "${requested_version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+-preview$ ]]; then + # Version like "7.6.0-preview" provided, find latest preview for that version + local base_version="${requested_version%-preview}" + version=$(echo "${tags}" | grep "^${base_version}-preview\." | tail -n 1) + elif [[ "${requested_version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+-preview\.[0-9]+$ ]]; then + # Exact preview version provided, verify it exists + if echo "${tags}" | grep -q "^${requested_version}$"; then + version="${requested_version}" + fi + elif [[ "${requested_version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$ ]]; then + # Exact RC version provided, verify it exists + if echo "${tags}" | grep -q "^${requested_version}$"; then + version="${requested_version}" + fi + fi + + if [ -z "${version}" ]; then + echo "Could not find matching preview version for: ${requested_version}" + return 1 + fi + + declare -g "${variable_name}=${version}" + echo "${variable_name}=${version}" +} + # Figure out correct version of a three part version number is not passed find_version_from_git_tags() { local variable_name=$1 @@ -159,7 +236,8 @@ apt_get_update() for package in "$@"; do if ! dnf list installed "$package" > /dev/null 2>&1; then echo "Package $package not installed. Installing using dnf..." - dnf install -y "$package" + # Use --allowerasing to handle conflicts like curl-minimal vs curl + dnf install -y --allowerasing "$package" else echo "Package $package is already installed (DNF)." fi @@ -292,26 +370,39 @@ install_pwsh() { install_using_github() { # Fall back on direct download if no apt package exists in microsoft pool - check_packages curl ca-certificates gnupg2 dirmngr libc6 libgcc1 libgssapi-krb5-2 libstdc++6 libunwind8 libuuid1 zlib1g libicu[0-9][0-9] + if command -v apt-get > /dev/null 2>&1; then + # Debian/Ubuntu dependencies + check_packages curl ca-certificates gnupg2 dirmngr libc6 libgcc1 libgssapi-krb5-2 libstdc++6 libunwind8 libuuid1 zlib1g libicu[0-9][0-9] wget + elif command -v dnf > /dev/null 2>&1; then + # AlmaLinux/RHEL dependencies + check_packages curl ca-certificates gnupg2 glibc libgcc krb5-libs libstdc++ libuuid zlib libicu wget tar + fi if ! type git > /dev/null 2>&1; then check_packages git fi - - if [ "${architecture}" = "amd64" ]; then + if [ "${architecture}" = "amd64" ] || [ "${architecture}" = "x86_64" ]; then architecture="x64" + elif [ "${architecture}" = "aarch64" ]; then + architecture="arm64" fi pwsh_url="https://github.com/PowerShell/PowerShell" - find_version_from_git_tags POWERSHELL_VERSION $pwsh_url + # Check if we need to find a preview version or stable version + if [[ "${POWERSHELL_VERSION}" == *"preview"* ]] || [ "${POWERSHELL_VERSION}" = "preview" ] || [[ "${POWERSHELL_VERSION}" == *"-rc."* ]]; then + echo "Finding preview version..." + find_preview_version_from_git_tags POWERSHELL_VERSION "${pwsh_url}" + else + find_version_from_git_tags POWERSHELL_VERSION "${pwsh_url}" + fi + install_pwsh "${POWERSHELL_VERSION}" if grep -q "Not Found" "${powershell_filename}"; then install_prev_pwsh $pwsh_url fi - # downlaod the latest version of powershell and extracting the file to powershell directory + # download the latest version of powershell and extracting the file to powershell directory wget https://github.com/PowerShell/PowerShell/releases/download/v${POWERSHELL_VERSION}/${powershell_filename} mkdir ~/powershell - tar -xvf powershell-${POWERSHELL_VERSION}-linux-x64.tar.gz -C ~/powershell - + tar -xvf ${powershell_filename} -C ~/powershell powershell_archive_sha256="$(cat release.html | tr '\n' ' ' | sed 's|<[^>]*>||g' | grep -oP "${powershell_filename}\s+\K[0-9a-fA-F]{64}" || echo '')" if [ -z "${powershell_archive_sha256}" ]; then @@ -323,13 +414,33 @@ install_using_github() { tar xf "${powershell_filename}" -C "${powershell_target_path}" chmod 755 "${powershell_target_path}/pwsh" ln -sf "${powershell_target_path}/pwsh" /usr/bin/pwsh - add-shell "/usr/bin/pwsh" + # Add pwsh to /etc/shells + if command -v add-shell > /dev/null 2>&1; then + # Debian/Ubuntu - use add-shell + add-shell "/usr/bin/pwsh" + else + # AlmaLinux/RHEL - manually add to /etc/shells - add-shell is not available in almalinux repos and manual approach is simpler than adding a dependency just for this + if ! grep -q "/usr/bin/pwsh" /etc/shells; then + echo "/usr/bin/pwsh" >> /etc/shells + fi + fi cd /tmp rm -rf /tmp/pwsh } if ! type pwsh >/dev/null 2>&1; then export DEBIAN_FRONTEND=noninteractive + if [ "${POWERSHELL_VERSION}" = "lts" ] || [ "${POWERSHELL_VERSION}" = "stable" ] || [ "${POWERSHELL_VERSION}" = "preview" ]; then + echo "Resolving PowerShell '${POWERSHELL_VERSION}' version from Microsoft..." + resolved_version=$(resolve_powershell_version "${POWERSHELL_VERSION}") + if [ -n "${resolved_version}" ]; then + echo "Resolved '${POWERSHELL_VERSION}' to version: ${resolved_version}" + POWERSHELL_VERSION="${resolved_version}" + else + echo "Warning: Could not resolve '${POWERSHELL_VERSION}' version. Falling back to 'latest'." + POWERSHELL_VERSION="latest" + fi + fi # Source /etc/os-release to get OS info . /etc/os-release @@ -340,11 +451,10 @@ if ! type pwsh >/dev/null 2>&1; then POWERSHELL_ARCHIVE_ARCHITECTURES="${POWERSHELL_ARCHIVE_ARCHITECTURES_ALMALINUX}" fi - if [[ "${POWERSHELL_ARCHIVE_ARCHITECTURES}" = *"${POWERSHELL_ARCHIVE_ARCHITECTURES_UBUNTU}"* ]] && [[ "${POWERSHELL_ARCHIVE_VERSION_CODENAMES}" = *"${VERSION_CODENAME}"* ]]; then + if [[ "${POWERSHELL_ARCHIVE_ARCHITECTURES}" = *"${POWERSHELL_ARCHIVE_ARCHITECTURES_UBUNTU}"* ]] && [[ "${POWERSHELL_ARCHIVE_VERSION_CODENAMES}" = *"${VERSION_CODENAME}"* ]] && [[ "${POWERSHELL_VERSION}" != *"preview"* ]] && [[ "${POWERSHELL_VERSION}" != *"-rc."* ]]; then install_using_apt || use_github="true" - elif [[ "${POWERSHELL_ARCHIVE_ARCHITECTURES}" = *"${POWERSHELL_ARCHIVE_ARCHITECTURES_ALMALINUX}"* ]]; then + elif [[ "${POWERSHELL_ARCHIVE_ARCHITECTURES}" = *"${POWERSHELL_ARCHIVE_ARCHITECTURES_ALMALINUX}"* ]] && [[ "${POWERSHELL_VERSION}" != *"preview"* ]] && [[ "${POWERSHELL_VERSION}" != *"-rc."* ]]; then install_using_dnf && install_powershell_dnf || use_github="true" - else use_github="true" fi diff --git a/src/python/devcontainer-feature.json b/src/python/devcontainer-feature.json index 635b233cf..6a4121415 100644 --- a/src/python/devcontainer-feature.json +++ b/src/python/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "python", - "version": "1.7.1", + "version": "1.8.0", "name": "Python", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/python", "description": "Installs the provided version of Python, as well as PIPX, and other common Python utilities. JupyterLab is conditionally installed with the python feature. Note: May require source code compilation.", diff --git a/src/python/install.sh b/src/python/install.sh index fec8937a0..be895927d 100755 --- a/src/python/install.sh +++ b/src/python/install.sh @@ -69,7 +69,7 @@ if [ "${ADJUSTED_ID}" = "rhel" ] && [ "${VERSION_CODENAME-}" = "centos7" ]; then fi # To find some devel packages, some rhel need to enable specific extra repos, but not on RedHat ubi images... -INSTALL_CMD_ADDL_REPO="" +INSTALL_CMD_ADDL_REPOS="" if [ ${ADJUSTED_ID} = "rhel" ] && [ ${ID} != "rhel" ]; then if [ ${MAJOR_VERSION_ID} = "8" ]; then INSTALL_CMD_ADDL_REPOS="--enablerepo powertools" @@ -93,6 +93,27 @@ else INSTALL_CMD="${PKG_MGR_CMD} ${INSTALL_CMD_ADDL_REPOS} -y install --noplugins --setopt=install_weak_deps=0" fi +# Install Time::Piece Perl module required by OpenSSL 3.0.18+ build system on CentOS 7/RHEL 7 +install_time_piece() { + echo "(*) Ensuring Time::Piece Perl module is available for OpenSSL 3.0.18+ build..." + + # Check if Time::Piece is already available (it's usually in Perl core) + if perl -MTime::Piece -e 'exit 0' 2>/dev/null; then + echo "(*) Time::Piece already available" + return 0 + fi + + echo "(*) Time::Piece not found, installing perl-Time-Piece package..." + + # Install perl-Time-Piece package for CentOS 7/RHEL 7 + if ${INSTALL_CMD} perl-Time-Piece; then + echo "(*) perl-Time-Piece installed for OpenSSL 3.0.18+ build" + else + echo "(!) Failed to install perl-Time-Piece package. This will cause OpenSSL 3.0.18+ build to fail" + return 1 + fi +} + # Clean up clean_up() { case ${ADJUSTED_ID} in @@ -478,6 +499,130 @@ install_cpython() { curl -sSL -o "/tmp/python-src/${cpython_tgz_filename}" "${cpython_tgz_url}" fi } +# Get system architecture for downloads +get_architecture() { + local architecture="" + case $(uname -m) in + x86_64) architecture="amd64" ;; + aarch64 | armv8*) architecture="arm64" ;; + aarch32 | armv7* | armvhf*) architecture="armhf" ;; + i?86) architecture="386" ;; + *) echo "(!) Architecture $(uname -m) unsupported"; exit 1 ;; + esac + echo ${architecture} +} + +# Install cosign with multi-distro support +install_cosign() { + + COSIGN_VERSION="latest" + local cosign_url='https://github.com/sigstore/cosign' + local architecture=$(get_architecture) + + find_version_from_git_tags COSIGN_VERSION "${cosign_url}" + + # Remove 'v' prefix if present for download URL + local version_for_url="${COSIGN_VERSION#v}" + + local cosign_filename="/tmp/cosign_${version_for_url}_${architecture}.deb" + local cosign_url="https://github.com/sigstore/cosign/releases/download/v${version_for_url}/cosign_${version_for_url}_${architecture}.deb" + + echo "Downloading cosign from: ${cosign_url}" + + if curl -L -f --fail-with-body "${cosign_url}" -o "$cosign_filename" 2>/dev/null; then + echo "(*) Successfully downloaded cosign v${COSIGN_VERSION}" + else + echo -e "\n(!) Failed to fetch cosign v${COSIGN_VERSION}..." + # Try previous version + find_prev_version_from_git_tags COSIGN_VERSION "https://github.com/sigstore/cosign" + echo -e "\nAttempting to install previous cosign ${COSIGN_VERSION} version as fallback mechanism" + + version_for_url="${COSIGN_VERSION#v}" + cosign_filename="/tmp/cosign_${version_for_url}_${architecture}.deb" + cosign_url="https://github.com/sigstore/cosign/releases/download/v${version_for_url}/cosign_${version_for_url}_${architecture}.deb" + + if ! curl -L -f --fail-with-body "${cosign_url}" -o "$cosign_filename" 2>/dev/null; then + echo "(!) Failed to download cosign v${COSIGN_VERSION} as fallback" + return 1 + fi + fi + + # Install the package + if [ -f "$cosign_filename" ]; then + dpkg -i "$cosign_filename" + rm "$cosign_filename" + echo "Installation of cosign succeeded with ${COSIGN_VERSION}." + else + echo "(!) Failed to install cosign package" + return 1 + fi + +} + +# COSIGN signature verification for python versions >= 3.14 +cosign_verification() { + local VERSION="$1" + + # Ensure cosign is installed + if ! type cosign > /dev/null 2>&1; then + echo "(*) cosign not found, installing..." + if ! install_cosign; then + echo "(!) Failed to install cosign" + return 1 + fi + else + echo "(*) cosign is already available on the system" + fi + + echo "(*) Attempting COSIGN verification for Python ${VERSION}..." + + # Check if COSIGN signature files exist (these don't exist yet for Python releases) + local cosign_sig_url="${cpython_tgz_url}.sig" + local cosign_cert_url="${cpython_tgz_url}.pem" + + # Download COSIGN signature and certificate files with proper error handling + echo "(*) Checking for cosign signature files..." + if ! curl -sSL -f --fail-with-body -o "/tmp/python-src/${cpython_tgz_filename}.sig" "${cosign_sig_url}" 2>/dev/null; then + echo "(!) COSIGN signature file not available for Python ${VERSION}" + echo " Signature URL: ${cosign_sig_url}" + return 1 + fi + + if ! curl -sSL -f --fail-with-body -o "/tmp/python-src/${cpython_tgz_filename}.pem" "${cosign_cert_url}" 2>/dev/null; then + echo "(!) COSIGN certificate file not available for Python ${VERSION}" + echo " Certificate URL: ${cosign_cert_url}" + return 1 + fi + + # Perform COSIGN verification + if cosign verify-blob \ + --certificate "/tmp/python-src/${cpython_tgz_filename}.pem" \ + --signature "/tmp/python-src/${cpython_tgz_filename}.sig" \ + --certificate-identity-regexp=".*" \ + --certificate-oidc-issuer-regexp=".*" \ + "/tmp/python-src/${cpython_tgz_filename}"; then + echo "(*) COSIGN signature verification successful" + return 0 + else + echo "(!) COSIGN signature verification failed" + return 1 + fi +} + +# GPG verification for python versions < 3.14 +gpg_verification() { + echo "(*) Using GPG signature verification..." + if [[ ${VERSION_CODENAME} = "centos7" ]] || [[ ${VERSION_CODENAME} = "rhel7" ]]; then + receive_gpg_keys_centos7 PYTHON_SOURCE_GPG_KEYS + else + receive_gpg_keys PYTHON_SOURCE_GPG_KEYS + fi + echo "Downloading ${cpython_tgz_filename}.asc..." + curl -sSL -o "/tmp/python-src/${cpython_tgz_filename}.asc" "${cpython_tgz_url}.asc" + gpg --verify "${cpython_tgz_filename}.asc" + echo "(*) GPG signature verification successful" +} + install_from_source() { VERSION=$1 @@ -496,6 +641,8 @@ install_from_source() { case ${VERSION_CODENAME} in centos7|rhel7) check_packages perl-IPC-Cmd + # Install Time::Piece Perl module required by OpenSSL 3.0.18+ build system + install_time_piece install_openssl3 ADDL_CONFIG_ARGS="--with-openssl=${SSL_INSTALL_PATH} --with-openssl-rpath=${SSL_INSTALL_PATH}/lib" ;; @@ -507,15 +654,27 @@ install_from_source() { install_prev_vers_cpython "${VERSION}" fi fi; - # Verify signature - if [[ ${VERSION_CODENAME} = "centos7" ]] || [[ ${VERSION_CODENAME} = "rhel7" ]]; then - receive_gpg_keys_centos7 PYTHON_SOURCE_GPG_KEYS + + # Discontinuation of PGP signatures for releases of Python 3.14 or future versions + # CPython release artifacts are additionally signed with Sigstore starting with the Python 3.11.0 + local major_version=$(echo "$VERSION" | cut -d. -f1) + local minor_version=$(echo "$VERSION" | cut -d. -f2) + echo "(*) Detected Python version: ${major_version}.${minor_version}" + if (( major_version > 3 )) || { (( major_version == 3 )) && (( minor_version >= 14 )); }; then + echo "(*) Python 3.14+ detected. Attempting cosign verification..." + if cosign_verification "$VERSION"; then + echo "(*) COSIGN verification successful." + else + echo "(*) COSIGN verification failed or not available for Python ${VERSION}" + echo "(*) WARNING: Installing Python ${VERSION} without signature verification" + echo "(*) This is expected for newly released versions where cosign signatures are not yet available" + echo "(*) Python 3.14+ discontinued PGP signatures in favor of cosign, but cosign signatures may take time to be published" + fi else - receive_gpg_keys PYTHON_SOURCE_GPG_KEYS + echo "(*) Python < 3.14 detected. Using GPG signature verification..." + gpg_verification + echo "(*) GPG verification successful." fi - echo "Downloading ${cpython_tgz_filename}.asc..." - curl -sSL -o "/tmp/python-src/${cpython_tgz_filename}.asc" "${cpython_tgz_url}.asc" - gpg --verify "${cpython_tgz_filename}.asc" # Update min protocol for testing only - https://bugs.python.org/issue41561 if [ -f /etc/pki/tls/openssl.cnf ]; then diff --git a/src/ruby/NOTES.md b/src/ruby/NOTES.md index 19fe92f31..53da243c1 100644 --- a/src/ruby/NOTES.md +++ b/src/ruby/NOTES.md @@ -2,6 +2,13 @@ ## OS Support -This Feature should work on recent versions of Debian/Ubuntu-based distributions with the `apt` package manager installed. +This Feature supports Linux images that ship one of the following package managers: `apt`, `dnf`/`yum`, `apk`, `zypper`, or `pacman`. The script detects the available package manager and installs the build dependencies that ruby-build needs. `bash` is required to execute the `install.sh` script. + +## Layout + +- Ruby is installed under `/usr/local/rubies/` by ruby-build. +- The default Ruby is exposed via the `/usr/local/rubies/current` symlink, which is placed on the `PATH` through `containerEnv`. +- `ruby-build` itself is cloned to `/usr/local/share/ruby-build` and symlinked into `/usr/local/bin/ruby-build` so additional versions can be installed later. +- A shared `ruby` group owns `/usr/local/rubies`; the configured non-root user is added to it so `gem install` can write into the active Ruby tree without `sudo`. diff --git a/src/ruby/README.md b/src/ruby/README.md index 7df6965c7..351ffe906 100644 --- a/src/ruby/README.md +++ b/src/ruby/README.md @@ -1,13 +1,13 @@ -# Ruby (via rvm) (ruby) +# Ruby (via ruby-build) (ruby) -Installs Ruby, rvm, rbenv, common Ruby utilities, and needed dependencies. +Installs Ruby using ruby-build, with optional rbenv or rvm for version management. ## Example Usage ```json "features": { - "ghcr.io/devcontainers/features/ruby:1": {} + "ghcr.io/devcontainers/features/ruby:2": {} } ``` @@ -16,6 +16,7 @@ Installs Ruby, rvm, rbenv, common Ruby utilities, and needed dependencies. | Options Id | Description | Type | Default Value | |-----|-----|-----|-----| | version | Select or enter a Ruby version to install | string | latest | +| versionManager | Version manager to install alongside Ruby: 'rbenv', 'rvm', or 'none' (ruby-build only) | string | none | ## Customizations @@ -27,7 +28,7 @@ Installs Ruby, rvm, rbenv, common Ruby utilities, and needed dependencies. ## OS Support -This Feature should work on recent versions of Debian/Ubuntu-based distributions with the `apt` package manager installed. +This Feature supports Linux images that ship one of the following package managers: `apt`, `dnf`/`yum`, `apk`, `zypper`, or `pacman`. The script detects the available package manager and installs the build dependencies that ruby-build needs. `bash` is required to execute the `install.sh` script. diff --git a/src/ruby/devcontainer-feature.json b/src/ruby/devcontainer-feature.json index 82ae50a10..841afbc3d 100644 --- a/src/ruby/devcontainer-feature.json +++ b/src/ruby/devcontainer-feature.json @@ -1,20 +1,26 @@ { "id": "ruby", - "version": "1.3.1", - "name": "Ruby (via rvm)", + "version": "2.0.0", + "name": "Ruby (via ruby-build)", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/ruby", - "description": "Installs Ruby, rvm, rbenv, common Ruby utilities, and needed dependencies.", + "description": "Installs Ruby using ruby-build, with optional rbenv or rvm for version management.", "options": { "version": { "type": "string", "proposals": [ "latest", "none", - "3.4", - "3.2" + "4.0", + "3.4" ], "default": "latest", "description": "Select or enter a Ruby version to install" + }, + "versionManager": { + "type": "string", + "enum": ["none", "rbenv", "rvm"], + "default": "none", + "description": "Version manager to install alongside Ruby: 'rbenv', 'rvm', or 'none' (ruby-build only)" } }, "customizations": { @@ -25,17 +31,15 @@ "settings": { "github.copilot.chat.codeGeneration.instructions": [ { - "text": "This dev container includes Ruby, rvm, rbenv, common Ruby utilities, and needed dependencies pre-installed and available on the `PATH`, along with the Ruby language extension for Ruby development." + "text": "This dev container installs Ruby via ruby-build. rbenv or rvm may also be available depending on the versionManager option. The default Ruby is on the PATH via /usr/local/rubies/current/bin (or rbenv shims if rbenv is the version manager)." } ] } } }, "containerEnv": { - "GEM_PATH": "/usr/local/rvm/gems/default:/usr/local/rvm/gems/default@global", - "GEM_HOME": "/usr/local/rvm/gems/default", - "MY_RUBY_HOME": "/usr/local/rvm/rubies/default", - "PATH": "/usr/local/rvm/gems/default/bin:/usr/local/rvm/gems/default@global/bin:/usr/local/rvm/rubies/default/bin:/usr/local/share/rbenv/bin:${PATH}" + "RBENV_ROOT": "/usr/local/share/rbenv", + "PATH": "/usr/local/share/rbenv/shims:/usr/local/share/rbenv/bin:/usr/local/rubies/current/bin:${PATH}" }, "installsAfter": [ "ghcr.io/devcontainers/features/common-utils" diff --git a/src/ruby/install.sh b/src/ruby/install.sh index befeee4af..2b990cda8 100755 --- a/src/ruby/install.sh +++ b/src/ruby/install.sh @@ -10,24 +10,27 @@ RUBY_VERSION="${VERSION:-"latest"}" USERNAME="${USERNAME:-"${_REMOTE_USER:-"automatic"}"}" -UPDATE_RC="${UPDATE_RC:-"true"}" INSTALL_RUBY_TOOLS="${INSTALL_RUBY_TOOLS:-"true"}" -# Comma-separated list of ruby versions to be installed (with rvm) -# alongside RUBY_VERSION, but not set as default. +# Comma-separated list of ruby versions to be installed alongside RUBY_VERSION, +# but not set as default. ADDITIONAL_VERSIONS="${ADDITIONALVERSIONS:-""}" -# Note: ruby-debug-ide will install the right version of debase if missing and -# installing debase directly fails on Ruby 3.1.0 as of 1/7/2022, so omitting. -# installing ruby-debug-ide on debian fails, so omitting. +VERSION_MANAGER="${VERSIONMANAGER:-"none"}" + DEFAULT_GEMS="rake" +RUBY_BUILD_DIR="/usr/local/share/ruby-build" +RUBIES_DIR="/usr/local/rubies" +RUBY_GROUP="ruby" +RBENV_ROOT="/usr/local/share/rbenv" +RVM_PATH="/usr/local/rvm" RVM_GPG_KEYS="409B6B1796C275462A1703113804BB82D39DC0E3 7D2BAF1CF37B13E2069D6956105BD0E739499BDB" set -e -# Clean up -rm -rf /var/lib/apt/lists/* +# Force apt to refresh its lists below by clearing them up front (no-op on non-apt systems). +rm -rf /var/lib/apt/lists/* 2>/dev/null || true if [ "$(id -u)" -ne 0 ]; then echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.' @@ -39,7 +42,6 @@ rm -f /etc/profile.d/00-restore-env.sh echo "export PATH=${PATH//$(sh -lc 'echo $PATH')/\$PATH}" > /etc/profile.d/00-restore-env.sh chmod +x /etc/profile.d/00-restore-env.sh -# Determine the appropriate non-root user if [ "${USERNAME}" = "auto" ] || [ "${USERNAME}" = "automatic" ]; then USERNAME="" POSSIBLE_USERS=("vscode" "node" "codespace" "$(awk -v val=1000 -F ":" '$3==val{print $1}' /etc/passwd)") @@ -56,19 +58,35 @@ elif [ "${USERNAME}" = "none" ] || ! id -u ${USERNAME} > /dev/null 2>&1; then USERNAME=root fi -updaterc() { - if [ "${UPDATE_RC}" = "true" ]; then - echo "Updating /etc/bash.bashrc and /etc/zsh/zshrc..." - if [[ "$(cat /etc/bash.bashrc)" != *"$1"* ]]; then - echo -e "$1" >> /etc/bash.bashrc - fi - if [ -f "/etc/zsh/zshrc" ] && [[ "$(cat /etc/zsh/zshrc)" != *"$1"* ]]; then - echo -e "$1" >> /etc/zsh/zshrc - fi +architecture="$(uname -m)" +if [ "${architecture}" != "amd64" ] && [ "${architecture}" != "x86_64" ] && [ "${architecture}" != "arm64" ] && [ "${architecture}" != "aarch64" ]; then + echo "(!) Architecture $architecture unsupported" + exit 1 +fi + +clone_or_update_repo() { + local repo=$1 dest=$2 + if [ ! -d "${dest}" ]; then + git clone --depth=1 \ + -c core.eol=lf \ + -c core.autocrlf=false \ + -c fsck.zeroPaddedFilemode=ignore \ + -c fetch.fsck.zeroPaddedFilemode=ignore \ + -c receive.fsck.zeroPaddedFilemode=ignore \ + "${repo}" "${dest}" + else + git -C "${dest}" fetch --depth=1 origin && \ + git -C "${dest}" reset --hard origin/HEAD || true fi } -# Get the list of GPG key servers that are reachable +apply_group_perms() { + local dir=$1 + chgrp -R "${RUBY_GROUP}" "${dir}" 2>/dev/null || true + chmod -R g+rw "${dir}" 2>/dev/null || true + find "${dir}" -type d -exec chmod g+s {} + 2>/dev/null || true +} + get_gpg_key_servers() { declare -A keyservers_curl_map=( ["hkp://keyserver.ubuntu.com"]="http://keyserver.ubuntu.com:11371" @@ -78,15 +96,15 @@ get_gpg_key_servers() { ) local curl_args="" - local keyserver_reachable=false # Flag to indicate if any keyserver is reachable + local keyserver_reachable=false - if [ ! -z "${KEYSERVER_PROXY}" ]; then + if [ -n "${KEYSERVER_PROXY:-}" ]; then curl_args="--proxy ${KEYSERVER_PROXY}" fi for keyserver in "${!keyservers_curl_map[@]}"; do local keyserver_curl_url="${keyservers_curl_map[${keyserver}]}" - if curl -s ${curl_args} --max-time 5 ${keyserver_curl_url} > /dev/null; then + if curl -s ${curl_args} --max-time 5 "${keyserver_curl_url}" > /dev/null; then echo "keyserver ${keyserver}" keyserver_reachable=true else @@ -100,31 +118,24 @@ get_gpg_key_servers() { fi } -# Import the specified key in a variable name passed in as receive_gpg_keys() { local keys=${!1} local keyring_args="" - if [ ! -z "$2" ]; then + if [ -n "${2:-}" ]; then keyring_args="--no-default-keyring --keyring \"$2\"" fi - # Install curl - if ! type curl > /dev/null 2>&1; then - check_packages curl - fi - - # Use a temporary location for gpg keys to avoid polluting image export GNUPGHOME="/tmp/tmp-gnupg" - mkdir -p ${GNUPGHOME} - chmod 700 ${GNUPGHOME} - echo -e "disable-ipv6\n$(get_gpg_key_servers)" > ${GNUPGHOME}/dirmngr.conf - # GPG key download sometimes fails for some reason and retrying fixes it. + mkdir -p "${GNUPGHOME}" + chmod 700 "${GNUPGHOME}" + echo -e "disable-ipv6\n$(get_gpg_key_servers)" > "${GNUPGHOME}/dirmngr.conf" + local retry_count=0 local gpg_ok="false" set +e - until [ "${gpg_ok}" = "true" ] || [ "${retry_count}" -eq "5" ]; - do + until [ "${gpg_ok}" = "true" ] || [ "${retry_count}" -eq "5" ]; do echo "(*) Downloading GPG key..." + # shellcheck disable=SC2086 ( echo "${keys}" | xargs -n 1 gpg -q ${keyring_args} --recv-keys) 2>&1 && gpg_ok="true" if [ "${gpg_ok}" != "true" ]; then echo "(*) Failed getting key, retrying in 10s..." @@ -139,290 +150,305 @@ receive_gpg_keys() { fi } -# Figure out correct version of a three part version number is not passed -find_version_from_git_tags() { - local variable_name=$1 - local requested_version=${!variable_name} - if [ "${requested_version}" = "none" ]; then return; fi - local repository=$2 - local prefix=${3:-"tags/v"} - local separator=${4:-"."} - local last_part_optional=${5:-"false"} - if [ "$(echo "${requested_version}" | grep -o "." | wc -l)" != "2" ]; then - local escaped_separator=${separator//./\\.} - local last_part - if [ "${last_part_optional}" = "true" ]; then - last_part="(${escaped_separator}[0-9]+)?" - else - last_part="${escaped_separator}[0-9]+" - fi - local regex="${prefix}\\K[0-9]+${escaped_separator}[0-9]+${last_part}$" - local version_list="$(git ls-remote --tags ${repository} | grep -oP "${regex}" | tr -d ' ' | tr "${separator}" "." | sort -rV)" - if [ "${requested_version}" = "latest" ] || [ "${requested_version}" = "current" ] || [ "${requested_version}" = "lts" ]; then - declare -g ${variable_name}="$(echo "${version_list}" | head -n 1)" - else - set +e - declare -g ${variable_name}="$(echo "${version_list}" | grep -E -m 1 "^${requested_version//./\\.}([\\.\\s]|$)")" - set -e - fi - fi - if [ -z "${!variable_name}" ] || ! echo "${version_list}" | grep "^${!variable_name//./\\.}$" > /dev/null 2>&1; then - echo -e "Invalid ${variable_name} value: ${requested_version}\nValid values:\n${version_list}" >&2 +default_ruby_version() { + [ -L "${RUBIES_DIR}/current" ] && basename "$(readlink "${RUBIES_DIR}/current")" +} + +install_build_deps() { + if command -v apt-get > /dev/null 2>&1; then + export DEBIAN_FRONTEND=noninteractive + apt-get update -y + # libgdbm-dev pulls the appropriate libgdbm runtime, so no version-specific package is needed. + apt-get -y install --no-install-recommends \ + curl ca-certificates git autoconf bison patch build-essential \ + libssl-dev libyaml-dev libreadline-dev zlib1g-dev libgmp-dev \ + libncurses-dev libffi-dev libgdbm-dev libdb-dev uuid-dev + elif command -v dnf > /dev/null 2>&1 || command -v yum > /dev/null 2>&1; then + local pm + pm="$(command -v dnf || command -v yum)" + "${pm}" install -y \ + curl ca-certificates git gcc make patch autoconf bison \ + openssl-devel libyaml-devel zlib-devel libffi-devel \ + readline-devel ncurses-devel gdbm-devel + elif command -v apk > /dev/null 2>&1; then + apk add --no-cache \ + bash curl ca-certificates git build-base linux-headers \ + autoconf bison patch openssl-dev yaml-dev zlib-dev \ + readline-dev ncurses-dev libffi-dev gdbm-dev + elif command -v zypper > /dev/null 2>&1; then + zypper --non-interactive install --no-recommends \ + curl ca-certificates git gcc-c++ make patch \ + autoconf automake libtool bison \ + libopenssl-devel libyaml-devel zlib-devel libffi-devel \ + readline-devel ncurses-devel gdbm-devel + elif command -v pacman > /dev/null 2>&1; then + pacman -Sy --noconfirm --needed \ + curl ca-certificates git base-devel autoconf bison \ + openssl libyaml zlib libffi readline ncurses gdbm + else + echo "(!) No supported package manager found. Install Ruby build dependencies manually." exit 1 fi - echo "${variable_name}=${!variable_name}" } -# Use semver logic to decrement a version number then look for the closest match -find_prev_version_from_git_tags() { - local variable_name=$1 - local current_version=${!variable_name} - local repository=$2 - # Normally a "v" is used before the version number, but support alternate cases - local prefix=${3:-"tags/v"} - # Some repositories use "_" instead of "." for version number part separation, support that - local separator=${4:-"."} - # Some tools release versions that omit the last digit (e.g. go) - local last_part_optional=${5:-"false"} - # Some repositories may have tags that include a suffix (e.g. actions/node-versions) - local version_suffix_regex=$6 - # Try one break fix version number less if we get a failure. Use "set +e" since "set -e" can cause failures in valid scenarios. - set +e - major="$(echo "${current_version}" | grep -oE '^[0-9]+' || echo '')" - minor="$(echo "${current_version}" | grep -oP '^[0-9]+\.\K[0-9]+' || echo '')" - breakfix="$(echo "${current_version}" | grep -oP '^[0-9]+\.[0-9]+\.\K[0-9]+' 2>/dev/null || echo '')" - - if [ "${minor}" = "0" ] && [ "${breakfix}" = "0" ]; then - ((major=major-1)) - declare -g ${variable_name}="${major}" - # Look for latest version from previous major release - find_version_from_git_tags "${variable_name}" "${repository}" "${prefix}" "${separator}" "${last_part_optional}" - # Handle situations like Go's odd version pattern where "0" releases omit the last part - elif [ "${breakfix}" = "" ] || [ "${breakfix}" = "0" ]; then - ((minor=minor-1)) - declare -g ${variable_name}="${major}.${minor}" - # Look for latest version from previous minor release - find_version_from_git_tags "${variable_name}" "${repository}" "${prefix}" "${separator}" "${last_part_optional}" - else - ((breakfix=breakfix-1)) - if [ "${breakfix}" = "0" ] && [ "${last_part_optional}" = "true" ]; then - declare -g ${variable_name}="${major}.${minor}" - else - declare -g ${variable_name}="${major}.${minor}.${breakfix}" +install_ruby_build() { + clone_or_update_repo "https://github.com/rbenv/ruby-build.git" "${RUBY_BUILD_DIR}" + ln -sf "${RUBY_BUILD_DIR}/bin/ruby-build" /usr/local/bin/ruby-build +} + +resolve_ruby_version() { + local requested=$1 + local definitions_dir="${RUBY_BUILD_DIR}/share/ruby-build" + local stable_versions + stable_versions="$(ls "${definitions_dir}" 2>/dev/null | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | sort -V)" + + if [ -z "${stable_versions}" ]; then + echo "(!) ruby-build has no version definitions at ${definitions_dir}." >&2 + exit 1 + fi + + case "${requested}" in + latest|current|lts) + echo "${stable_versions}" | tail -n 1 + ;; + *) + if echo "${stable_versions}" | grep -qx "${requested}"; then + echo "${requested}" + return fi - fi - set -e + # Resolve a partial X.Y to the highest matching X.Y.Z. + local match + match="$(echo "${stable_versions}" | grep -E "^${requested//./\\.}\\.[0-9]+$" | sort -V | tail -n 1)" + if [ -n "${match}" ]; then + echo "${match}" + return + fi + echo "(!) Ruby version '${requested}' is not known to ruby-build." >&2 + exit 1 + ;; + esac } -apt_get_update() -{ - if [ "$(find /var/lib/apt/lists/* | wc -l)" = "0" ]; then - echo "Running apt-get update..." - apt-get update -y +install_ruby_version() { + local requested=$1 + local set_default=$2 + local resolved + resolved="$(resolve_ruby_version "${requested}")" + local prefix="${RUBIES_DIR}/${resolved}" + + if [ -x "${prefix}/bin/ruby" ]; then + echo "(!) Ruby ${resolved} already installed at ${prefix}. Skipping..." + elif [ "${VERSION_MANAGER}" = "rbenv" ] && [ -x "${RBENV_ROOT}/bin/rbenv" ]; then + echo "Installing Ruby ${resolved} via rbenv..." + mkdir -p "${RUBIES_DIR}" + LANG="${LANG:-C.UTF-8}" RBENV_ROOT="${RBENV_ROOT}" \ + "${RBENV_ROOT}/bin/rbenv" install --skip-existing "${resolved}" + # Mirror into RUBIES_DIR so the rest of the script uses a consistent path. + ln -sfn "${RBENV_ROOT}/versions/${resolved}" "${prefix}" + elif [ "${VERSION_MANAGER}" = "rvm" ] && [ -s "${RVM_PATH}/scripts/rvm" ]; then + echo "Installing Ruby ${resolved} via rvm..." + mkdir -p "${RUBIES_DIR}" + # shellcheck disable=SC1091 + source "${RVM_PATH}/scripts/rvm" + LANG="${LANG:-C.UTF-8}" rvm install "${resolved}" + local rvm_ruby="${RVM_PATH}/rubies/ruby-${resolved}" + if [ -d "${rvm_ruby}" ]; then + ln -sfn "${rvm_ruby}" "${prefix}" + fi + else + mkdir -p "${RUBIES_DIR}" + echo "Installing Ruby ${resolved} via ruby-build..." + # Ensure a UTF-8 locale so that rdoc (and other tools bundled with Ruby) + # can process non-ASCII bytes during `make install`, even on minimal + # base images that ship with no LANG set (e.g. Debian 11 bullseye). + LANG="${LANG:-C.UTF-8}" ruby-build "${resolved}" "${prefix}" + fi + + if [ "${set_default}" = "true" ]; then + ln -sfn "${prefix}" "${RUBIES_DIR}/current" fi } -# Checks if packages are installed and installs them if not -check_packages() { - if ! dpkg -s "$@" > /dev/null 2>&1; then - apt_get_update - apt-get -y install --no-install-recommends "$@" +# Called before ruby versions are installed so that install_ruby_version() +# can delegate to 'rbenv install'. +install_rbenv() { + echo "Installing rbenv..." + clone_or_update_repo "https://github.com/rbenv/rbenv.git" "${RBENV_ROOT}" + + ln -sf "${RBENV_ROOT}/bin/rbenv" /usr/local/bin/rbenv + + # Wire the already-installed ruby-build as an rbenv plugin so that + # 'rbenv install' works out of the box. + mkdir -p "${RBENV_ROOT}/plugins" + if [ ! -e "${RBENV_ROOT}/plugins/ruby-build" ]; then + ln -sfn "${RUBY_BUILD_DIR}" "${RBENV_ROOT}/plugins/ruby-build" fi + mkdir -p "${RBENV_ROOT}/versions" + echo "rbenv ready at ${RBENV_ROOT}." } -# Ensure apt is in non-interactive to avoid prompts -export DEBIAN_FRONTEND=noninteractive +# Called after ruby versions are installed. +finalize_rbenv() { + # When rubies were installed via ruby-build (not 'rbenv install'), symlink them + # into rbenv's versions directory so 'rbenv versions' shows them. + # Skip entries that already point into RBENV_ROOT to avoid circular symlinks. + for ruby_dir in "${RUBIES_DIR}"/[0-9]*/; do + [ -d "${ruby_dir}" ] || continue + local ver + ver="$(basename "${ruby_dir%/}")" + local real_target + real_target="$(readlink -f "${ruby_dir%/}" 2>/dev/null || true)" + if [ "${real_target}" = "${RBENV_ROOT}/versions/${ver}" ]; then + continue + fi + ln -sfn "${ruby_dir%/}" "${RBENV_ROOT}/versions/${ver}" + done -architecture="$(uname -m)" -if [ "${architecture}" != "amd64" ] && [ "${architecture}" != "x86_64" ] && [ "${architecture}" != "arm64" ] && [ "${architecture}" != "aarch64" ]; then - echo "(!) Architecture $architecture unsupported" - exit 1 -fi + # Set the rbenv global version to match the ruby-build default. + local default_ver + default_ver="$(default_ruby_version)" + if [ -n "${default_ver}" ]; then + echo "${default_ver}" > "${RBENV_ROOT}/version" + fi -# Install dependencies -check_packages curl ca-certificates software-properties-common build-essential gnupg2 libreadline-dev \ - procps dirmngr gawk autoconf automake bison libffi-dev libgdbm-dev libncurses5-dev \ - libsqlite3-dev libtool libyaml-dev pkg-config sqlite3 zlib1g-dev libgmp-dev libssl-dev -if ! type git > /dev/null 2>&1; then - check_packages git -fi + apply_group_perms "${RBENV_ROOT}" -# Function to fetch the version released prior to the latest version -get_previous_version() { - local url=$1 - local repo_url=$2 - variable_name=$3 - prev_version=${!variable_name} - - output=$(curl -s "$repo_url"); - - #install jq - check_packages jq - - message=$(echo "$output" | jq -r '.message') - - if [[ $message == "API rate limit exceeded"* ]]; then - echo -e "\nAn attempt to find latest version using GitHub Api Failed... \nReason: ${message}" - echo -e "\nAttempting to find latest version using GitHub tags." - find_prev_version_from_git_tags prev_version "$url" "tags/v" "_" - declare -g ${variable_name}="${prev_version}" - else - echo -e "\nAttempting to find latest version using GitHub Api." - version=$(echo "$output" | jq -r '.tag_name' | tr '_' '.') - declare -g ${variable_name}="${version#v}" - fi - echo "${variable_name}=${!variable_name}" -} + # Profile script for login shells (non-login shells rely on containerEnv + # which already prepends RBENV_ROOT/shims and RBENV_ROOT/bin). + cat > /etc/profile.d/rbenv.sh << 'RBENV_PROFILE' +export RBENV_ROOT=/usr/local/share/rbenv +export PATH="${RBENV_ROOT}/bin:${RBENV_ROOT}/shims:${PATH}" +eval "$(rbenv init - --no-rehash)" 2>/dev/null || true +RBENV_PROFILE + chmod +x /etc/profile.d/rbenv.sh -get_github_api_repo_url() { - local url=$1 - echo "${url/https:\/\/github.com/https:\/\/api.github.com\/repos}/releases/latest" + RBENV_ROOT="${RBENV_ROOT}" "${RBENV_ROOT}/bin/rbenv" rehash 2>/dev/null || true + echo "rbenv configured." } +# Called before ruby versions are installed so that install_ruby_version() +# can delegate to 'rvm install'. +install_rvm() { + echo "Installing rvm..." -# Figure out correct version of a three part version number is not passed -RUBY_URL="https://github.com/ruby/ruby" -ORIGINAL_RUBY_VERSION=$RUBY_VERSION -find_version_from_git_tags RUBY_VERSION $RUBY_URL "tags/v" "_" + receive_gpg_keys RVM_GPG_KEYS -set_rvm_install_args() { - RUBY_VERSION=$1 - if [ "${RUBY_VERSION}" = "none" ]; then - RVM_INSTALL_ARGS="" - elif [[ "$(ruby -v)" = *"${RUBY_VERSION}"* ]]; then - echo "(!) Ruby is already installed with version ${RUBY_VERSION}. Skipping..." - RVM_INSTALL_ARGS="" - else - if [ "${RUBY_VERSION}" = "latest" ] || [ "${RUBY_VERSION}" = "current" ] || [ "${RUBY_VERSION}" = "lts" ]; then - RVM_INSTALL_ARGS="--ruby" - RUBY_VERSION="" - else - RVM_INSTALL_ARGS="--ruby=${RUBY_VERSION}" - fi - if [ "${INSTALL_RUBY_TOOLS}" = "true" ]; then - SKIP_GEM_INSTALL="true" - else - DEFAULT_GEMS="" - fi + curl -sSL https://get.rvm.io | bash -s stable --path "${RVM_PATH}" + + # rvm is a shell function, so we must source it before calling 'rvm' below. + # shellcheck disable=SC1091 + if [ -s "${RVM_PATH}/scripts/rvm" ]; then + source "${RVM_PATH}/scripts/rvm" fi + echo "rvm ready at ${RVM_PATH}." } -install_previous_version() { - if [[ $ORIGINAL_RUBY_VERSION == "latest" ]]; then - repo_url=$(get_github_api_repo_url "$RUBY_URL") - get_previous_version "${RUBY_URL}" "${repo_url}" RUBY_VERSION - set_rvm_install_args $RUBY_VERSION - curl -sSL https://get.rvm.io | bash -s stable --ignore-dotfiles ${RVM_INSTALL_ARGS} --with-default-gems="${DEFAULT_GEMS}" 2>&1 - else - echo "Failed to install Ruby version $ORIGINAL_RUBY_VERSION. Exiting..." +finalize_rvm() { + # shellcheck disable=SC1091 + [ -s "${RVM_PATH}/scripts/rvm" ] && source "${RVM_PATH}/scripts/rvm" || true + + # When rubies were installed via ruby-build (not 'rvm install'), mount them + # into rvm so 'rvm list' shows them. Skip entries that already live under + # RVM_PATH to avoid double-mounting. + if [ -d "${RUBIES_DIR}" ]; then + for ruby_dir in "${RUBIES_DIR}"/[0-9]*/; do + [ -d "${ruby_dir}" ] || continue + local ver + ver="$(basename "${ruby_dir%/}")" + local real_target + real_target="$(readlink -f "${ruby_dir%/}" 2>/dev/null || true)" + if [[ "${real_target}" == "${RVM_PATH}/rubies/"* ]]; then + continue + fi + rvm mount "${ruby_dir%/}" -n "${ver}" 2>/dev/null || true + done fi -} -# Just install Ruby if RVM already installed -if rvm --version > /dev/null; then - echo "Ruby Version Manager already exists." - if [[ "$(ruby -v)" = *"${RUBY_VERSION}"* ]]; then - echo "(!) Ruby is already installed with version ${RUBY_VERSION}. Skipping..." - elif [ "${RUBY_VERSION}" != "none" ]; then - echo "Installing specified Ruby version." - su ${USERNAME} -c "rvm install ruby ${RUBY_VERSION}" + # Set the rvm default to match the ruby-build default. + local default_ver + default_ver="$(default_ruby_version)" + if [ -n "${default_ver}" ]; then + local real_current + real_current="$(readlink -f "${RUBIES_DIR}/current" 2>/dev/null || true)" + if [[ "${real_current}" == "${RVM_PATH}/rubies/"* ]]; then + # Installed via 'rvm install': use the version name directly. + rvm use "${default_ver}" --default 2>/dev/null || true + else + # Installed via ruby-build and mounted: use the 'ext-' prefix. + rvm use "ext-${default_ver}" --default 2>/dev/null || true + fi fi - SKIP_GEM_INSTALL="false" - SKIP_RBENV_RBUILD="true" -else - # Install RVM - receive_gpg_keys RVM_GPG_KEYS - # Determine appropriate settings for rvm installer - set_rvm_install_args $RUBY_VERSION - # Create rvm group as a system group to reduce the odds of conflict with local user UIDs - if ! cat /etc/group | grep -e "^rvm:" > /dev/null 2>&1; then - groupadd -r rvm + + echo "source ${RVM_PATH}/scripts/rvm" > /etc/profile.d/rvm.sh + chmod +x /etc/profile.d/rvm.sh + + if [ "${USERNAME}" != "root" ] && id -u "${USERNAME}" > /dev/null 2>&1; then + usermod -aG rvm "${USERNAME}" 2>/dev/null || true fi - # Install rvm - curl -sSL https://get.rvm.io | bash -s stable --ignore-dotfiles ${RVM_INSTALL_ARGS} --with-default-gems="${DEFAULT_GEMS}" 2>&1 || install_previous_version - usermod -aG rvm ${USERNAME} - source /usr/local/rvm/scripts/rvm - rvm fix-permissions system - rm -rf ${GNUPGHOME} -fi + echo "rvm configured." +} + +install_build_deps +install_ruby_build -if [ "${INSTALL_RUBY_TOOLS}" = "true" ]; then - # Non-root user may not have "gem" in path when script is run and no ruby version - # is installed by rvm, so handle this by using root's default gem in this case - ROOT_GEM="$(which gem || echo "")" - ${ROOT_GEM} install ${DEFAULT_GEMS} +# Create a shared "ruby" group so the configured user can write under the rubies tree. +if ! getent group "${RUBY_GROUP}" > /dev/null 2>&1; then + groupadd -r "${RUBY_GROUP}" 2>/dev/null || addgroup -S "${RUBY_GROUP}" 2>/dev/null || true +fi +mkdir -p "${RUBIES_DIR}" +chgrp "${RUBY_GROUP}" "${RUBIES_DIR}" 2>/dev/null || true +chmod 2775 "${RUBIES_DIR}" 2>/dev/null || true + +# Set up the version manager BEFORE installing Ruby versions so that +# install_ruby_version() can delegate to it when requested. +if [ "${VERSION_MANAGER}" = "rbenv" ]; then + install_rbenv +elif [ "${VERSION_MANAGER}" = "rvm" ]; then + install_rvm fi -# VS Code server usually first in the path, so silence annoying rvm warning (that does not apply) and then source it -updaterc "if ! grep rvm_silence_path_mismatch_check_flag \$HOME/.rvmrc > /dev/null 2>&1; then echo 'rvm_silence_path_mismatch_check_flag=1' >> \$HOME/.rvmrc; fi\nsource /usr/local/rvm/scripts/rvm > /dev/null 2>&1" +if [ "${RUBY_VERSION}" != "none" ]; then + install_ruby_version "${RUBY_VERSION}" "true" +fi -# Additional ruby versions to be installed but not be set as default. if [ ! -z "${ADDITIONAL_VERSIONS}" ]; then OLDIFS=$IFS IFS="," read -a additional_versions <<< "$ADDITIONAL_VERSIONS" for version in "${additional_versions[@]}"; do - # Figure out correct version of a three part version number is not passed - find_version_from_git_tags version $RUBY_URL "tags/v" "_" - source /usr/local/rvm/scripts/rvm - rvm install ruby ${version} + install_ruby_version "${version}" "false" done IFS=$OLDIFS fi -# Install rbenv/ruby-build for good measure -if [ "${SKIP_RBENV_RBUILD}" != "true" ]; then +# Expose the default Ruby on the PATH for all login shells. +echo 'export PATH="/usr/local/rubies/current/bin:${PATH}"' > /etc/profile.d/ruby.sh +chmod +x /etc/profile.d/ruby.sh - if [[ ! -d "/usr/local/share/rbenv" ]]; then - git clone --depth=1 \ - -c core.eol=lf \ - -c core.autocrlf=false \ - -c fsck.zeroPaddedFilemode=ignore \ - -c fetch.fsck.zeroPaddedFilemode=ignore \ - -c receive.fsck.zeroPaddedFilemode=ignore \ - https://github.com/rbenv/rbenv.git /usr/local/share/rbenv - fi - - if [[ ! -d "/usr/local/share/ruby-build" ]]; then - git clone --depth=1 \ - -c core.eol=lf \ - -c core.autocrlf=false \ - -c fsck.zeroPaddedFilemode=ignore \ - -c fetch.fsck.zeroPaddedFilemode=ignore \ - -c receive.fsck.zeroPaddedFilemode=ignore \ - https://github.com/rbenv/ruby-build.git /usr/local/share/ruby-build - mkdir -p /root/.rbenv/plugins - - ln -s /usr/local/share/ruby-build /root/.rbenv/plugins/ruby-build - fi - - if [ "${USERNAME}" != "root" ]; then - mkdir -p /home/${USERNAME}/.rbenv/plugins - - if [[ ! -d "/home/${USERNAME}/.rbenv/plugins/ruby-build" ]]; then - ln -s /usr/local/share/ruby-build /home/${USERNAME}/.rbenv/plugins/ruby-build - fi - - # Oryx expects ruby to be installed in this specific path, else it breaks the oryx magic for ruby projects. - if [ ! -f /usr/local/rvm/gems/default/bin/ruby ]; then - ln -s /usr/local/rvm/rubies/default/bin/ruby /usr/local/rvm/gems/default/bin - fi +if [ "${RUBY_VERSION}" != "none" ] && [ "${INSTALL_RUBY_TOOLS}" = "true" ]; then + "${RUBIES_DIR}/current/bin/gem" install --no-document ${DEFAULT_GEMS} +fi - chown -R "${USERNAME}:rvm" "/home/${USERNAME}/.rbenv/" - chmod -R g+r+w "/home/${USERNAME}/.rbenv" - find "/home/${USERNAME}/.rbenv" -type d | xargs -n 1 chmod g+s +# Make sure the configured user can install gems against the shared rubies tree. +if [ "${USERNAME}" != "root" ] && id -u "${USERNAME}" > /dev/null 2>&1; then + if command -v usermod > /dev/null 2>&1; then + usermod -aG "${RUBY_GROUP}" "${USERNAME}" || true + elif command -v addgroup > /dev/null 2>&1; then + addgroup "${USERNAME}" "${RUBY_GROUP}" || true fi fi -chown -R "${USERNAME}:rvm" "/usr/local/rvm/" -chmod -R g+r+w "/usr/local/rvm/" -find "/usr/local/rvm/" -type d | xargs -n 1 chmod g+s +apply_group_perms "${RUBIES_DIR}" -# Clean up -rvm cleanup all -${ROOT_GEM} cleanup +if command -v apt-get > /dev/null 2>&1; then + rm -rf /var/lib/apt/lists/* +fi -# Clean up -rm -rf /var/lib/apt/lists/* +# Finalize the version manager now that all ruby versions are installed. +if [ "${VERSION_MANAGER}" = "rbenv" ]; then + finalize_rbenv +elif [ "${VERSION_MANAGER}" = "rvm" ]; then + finalize_rvm +fi echo "Done!" diff --git a/src/rust/NOTES.md b/src/rust/NOTES.md index 19fe92f31..68d170302 100644 --- a/src/rust/NOTES.md +++ b/src/rust/NOTES.md @@ -2,6 +2,11 @@ ## OS Support -This Feature should work on recent versions of Debian/Ubuntu-based distributions with the `apt` package manager installed. +This Feature should work on recent versions of Debian/Ubuntu, RedHat Enterprise Linux, Fedora, Alma, RockyLinux, +Mariner and Azure Linux distributions with the `apt`, `yum`, `dnf`, `microdnf` and `tdnf` package manager installed. + + +**Note:** Alpine is not supported because the rustup-init binary requires glibc to run, but Alpine Linux does not include `glibc` +by default. Instead, it uses musl libc, which is not binary-compatible with glibc. `bash` is required to execute the `install.sh` script. diff --git a/src/rust/README.md b/src/rust/README.md index 963588c2a..eca22932c 100644 --- a/src/rust/README.md +++ b/src/rust/README.md @@ -18,7 +18,7 @@ Installs Rust, common Rust utilities, and their required dependencies | version | Select or enter a version of Rust to install. | string | latest | | profile | Select a rustup install profile. | string | minimal | | targets | Optional comma separated list of additional Rust targets to install. | string | - | -| components | Optional comma separeated list of rust components to be installed based on input. | string | rust-analyzer,rust-src,rustfmt,clippy | +| components | Optional, comma separated list of Rust components to be installed | string | rust-analyzer,rust-src,rustfmt,clippy | ## Customizations @@ -32,8 +32,8 @@ Installs Rust, common Rust utilities, and their required dependencies ## OS Support -This Feature should work on recent versions of Debian/Ubuntu, RedHat Enterprise Linux, Fedora, Alma, RockyLinux -and Mariner distributions with the `apt`, `yum`, `dnf`, `microdnf` and `tdnf` package manager installed. +This Feature should work on recent versions of Debian/Ubuntu, RedHat Enterprise Linux, Fedora, Alma, RockyLinux, +Mariner and Azure Linux distributions with the `apt`, `yum`, `dnf`, `microdnf` and `tdnf` package manager installed. **Note:** Alpine is not supported because the rustup-init binary requires glibc to run, but Alpine Linux does not include `glibc` diff --git a/src/rust/devcontainer-feature.json b/src/rust/devcontainer-feature.json index 88b64daed..d8d399cde 100644 --- a/src/rust/devcontainer-feature.json +++ b/src/rust/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "rust", - "version": "1.5.0", + "version": "1.5.1", "name": "Rust", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/rust", "description": "Installs Rust, common Rust utilities, and their required dependencies", diff --git a/src/rust/install.sh b/src/rust/install.sh index 99a7ba8f5..56bb35ea8 100755 --- a/src/rust/install.sh +++ b/src/rust/install.sh @@ -30,7 +30,7 @@ if [ "${ID}" = "debian" ] || [ "${ID_LIKE}" = "debian" ]; then ADJUSTED_ID="debian" elif [ "${ID}" = "alpine" ]; then ADJUSTED_ID="alpine" -elif [[ "${ID}" = "rhel" || "${ID}" = "fedora" || "${ID}" = "mariner" || "${ID_LIKE}" = *"rhel"* || "${ID_LIKE}" = *"fedora"* || "${ID_LIKE}" = *"mariner"* ]]; then +elif [[ "${ID}" = "rhel" || "${ID}" = "fedora" || "${ID}" = "azurelinux" || "${ID}" = "mariner" || "${ID_LIKE}" = *"rhel"* || "${ID_LIKE}" = *"fedora"* || "${ID_LIKE}" = *"azurelinux"* || "${ID_LIKE}" = *"mariner"* ]]; then ADJUSTED_ID="rhel" VERSION_CODENAME="${ID}${VERSION_ID}" else @@ -264,6 +264,7 @@ check_packages() { "python3-minimal") packages[$i]="python3" ;; "libpython3.*") packages[$i]="python3-devel" ;; "gnupg2") packages[$i]="gnupg" ;; + "passwd") packages[$i]="shadow-utils" ;; esac ;; esac @@ -303,7 +304,7 @@ export DEBIAN_FRONTEND=noninteractive # Install curl, lldb, python3-minimal,libpython and rust dependencies if missing echo "Installing required dependencies..." -check_packages curl ca-certificates gcc libc6-dev gnupg2 git +check_packages curl ca-certificates gcc libc6-dev gnupg2 git passwd # Install optional dependencies (continue if they fail) case "$PKG_MANAGER" in @@ -315,7 +316,7 @@ case "$PKG_MANAGER" in ;; tdnf) check_packages python3 python3-devel || true - # LLDB might not be available in Photon/Mariner + # LLDB might not be available in Photon/Mariner/Azure Linux ;; esac diff --git a/src/sshd/README.md b/src/sshd/README.md index 7314e16af..f4215b391 100644 --- a/src/sshd/README.md +++ b/src/sshd/README.md @@ -15,6 +15,7 @@ Adds a SSH server into a container so that you can use an external terminal, sft | Options Id | Description | Type | Default Value | |-----|-----|-----|-----| +| gatewayPorts | Enable other hosts in the same network to connect to the forwarded ports | string | no | version | Currently unused. | string | latest | ## Usage diff --git a/src/sshd/devcontainer-feature.json b/src/sshd/devcontainer-feature.json index e400b0601..46c4ef302 100644 --- a/src/sshd/devcontainer-feature.json +++ b/src/sshd/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "sshd", - "version": "1.0.10", + "version": "1.1.0", "name": "SSH server", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/sshd", "description": "Adds a SSH server into a container so that you can use an external terminal, sftp, or SSHFS to interact with it.", @@ -12,6 +12,16 @@ ], "default": "latest", "description": "Currently unused." + }, + "gatewayPorts": { + "type": "string", + "enum": [ + "no", + "yes", + "clientspecified" + ], + "default": "no", + "description": "Enable other hosts in the same network to connect to the forwarded ports" } }, "entrypoint": "/usr/local/share/ssh-init.sh", diff --git a/src/sshd/install.sh b/src/sshd/install.sh index 146040896..9b9ddedf2 100755 --- a/src/sshd/install.sh +++ b/src/sshd/install.sh @@ -13,6 +13,7 @@ SSHD_PORT="${SSHD_PORT:-"2222"}" USERNAME="${USERNAME:-"${_REMOTE_USER:-"automatic"}"}" START_SSHD="${START_SSHD:-"false"}" NEW_PASSWORD="${NEW_PASSWORD:-"skip"}" +GATEWAY_PORTS="${GATEWAYPORTS:-"no"}" set -e @@ -89,6 +90,7 @@ mkdir -p /var/run/sshd sed -i 's/session\s*required\s*pam_loginuid\.so/session optional pam_loginuid.so/g' /etc/pam.d/sshd sed -i 's/#*PermitRootLogin prohibit-password/PermitRootLogin yes/g' /etc/ssh/sshd_config sed -i -E "s/#*\s*Port\s+.+/Port ${SSHD_PORT}/g" /etc/ssh/sshd_config +sed -i "s/#GatewayPorts no/GatewayPorts ${GATEWAY_PORTS}/g" /etc/ssh/sshd_config # Need to UsePAM so /etc/environment is processed sed -i -E "s/#?\s*UsePAM\s+.+/UsePAM yes/g" /etc/ssh/sshd_config diff --git a/src/terraform/README.md b/src/terraform/README.md index 4b37b4260..8cfb673dc 100644 --- a/src/terraform/README.md +++ b/src/terraform/README.md @@ -21,6 +21,7 @@ Installs the Terraform CLI and optionally TFLint and Terragrunt. Auto-detects la | installSentinel | Install sentinel, a language and framework for policy built to be embedded in existing software to enable fine-grained, logic-based policy decisions | boolean | false | | installTFsec | Install tfsec, a tool to spot potential misconfigurations for your terraform code | boolean | false | | installTerraformDocs | Install terraform-docs, a utility to generate documentation from Terraform modules | boolean | false | +| terraformDocsVersion | terraform-docs version to install (only used when installTerraformDocs is true) (https://github.com/terraform-docs/terraform-docs/releases) | string | latest | | httpProxy | Connect to a keyserver using a proxy by configuring this option | string | - | | customDownloadServer | Custom server URL for downloading Terraform and Sentinel packages, including protocol (e.g., https://releases.hashicorp.com). If not provided, the default HashiCorp download server (https://releases.hashicorp.com) will be used. | string | - | diff --git a/src/terraform/devcontainer-feature.json b/src/terraform/devcontainer-feature.json index db1bacc67..634d865ef 100644 --- a/src/terraform/devcontainer-feature.json +++ b/src/terraform/devcontainer-feature.json @@ -1,6 +1,6 @@ { "id": "terraform", - "version": "1.4.0", + "version": "1.5.0", "name": "Terraform, tflint, and TFGrunt", "documentationURL": "https://github.com/devcontainers/features/tree/main/src/terraform", "description": "Installs the Terraform CLI and optionally TFLint and Terragrunt. Auto-detects latest version and installs needed dependencies.", @@ -50,6 +50,16 @@ "default": false, "description": "Install terraform-docs, a utility to generate documentation from Terraform modules" }, + "terraformDocsVersion": { + "type": "string", + "proposals": [ + "latest", + "0.20.0", + "0.19.0" + ], + "default": "latest", + "description": "terraform-docs version to install (only used when installTerraformDocs is true) (https://github.com/terraform-docs/terraform-docs/releases)" + }, "httpProxy": { "type": "string", "default": "", @@ -79,6 +89,11 @@ } } }, + "dependsOn": { + "ghcr.io/devcontainers/features/github-cli:1": { + "version": "latest" + } + }, "installsAfter": [ "ghcr.io/devcontainers/features/common-utils" ] diff --git a/src/terraform/install.sh b/src/terraform/install.sh index fb7abc6ee..43779f825 100755 --- a/src/terraform/install.sh +++ b/src/terraform/install.sh @@ -18,7 +18,10 @@ TERRAGRUNT_VERSION="${TERRAGRUNT:-"latest"}" INSTALL_SENTINEL=${INSTALLSENTINEL:-false} INSTALL_TFSEC=${INSTALLTFSEC:-false} INSTALL_TERRAFORM_DOCS=${INSTALLTERRAFORMDOCS:-false} +TERRAFORM_DOCS_VERSION="${TERRAFORMDOCSVERSION:-"latest"}" CUSTOM_DOWNLOAD_SERVER="${CUSTOMDOWNLOADSERVER:-""}" +# This is because ubuntu noble, ubuntu resolute and debian trixie don't support the old format of GPG keys and validation +NEW_GPG_CODENAMES="trixie noble resolute" TERRAFORM_SHA256="${TERRAFORM_SHA256:-"automatic"}" TFLINT_SHA256="${TFLINT_SHA256:-"automatic"}" @@ -50,6 +53,13 @@ if [ "$(id -u)" -ne 0 ]; then exit 1 fi +# Detect Ubuntu Noble, Ubuntu Resolute or Debian Trixie and use new repo setup, else use legacy GPG logic +IS_GPG_NEW=0 +. /etc/os-release +if [[ "${NEW_GPG_CODENAMES}" == *"${VERSION_CODENAME}"* ]]; then + IS_GPG_NEW=1 +fi + # Get the list of GPG key servers that are reachable get_gpg_key_servers() { declare -A keyservers_curl_map=( @@ -89,7 +99,7 @@ receive_gpg_keys() { keyring_args="--no-default-keyring --keyring $2" fi if [ ! -z "${KEYSERVER_PROXY}" ]; then - keyring_args="${keyring_args} --keyserver-options http-proxy=${KEYSERVER_PROXY}" + keyring_args="${keyring_args} --keyserver-options http-proxy=${KEYSERVER_PROXY}" fi # Install curl @@ -101,6 +111,21 @@ receive_gpg_keys() { export GNUPGHOME="/tmp/tmp-gnupg" mkdir -p ${GNUPGHOME} chmod 700 ${GNUPGHOME} + + # Special handling for HashiCorp GPG key on Ubuntu Noble + if [ "$IS_GPG_NEW" -eq 1 ] && [ "$keys" = "$TERRAFORM_GPG_KEY" ]; then + echo "(*) Ubuntu Noble detected, using Keybase for HashiCorp GPG key import...." + curl -fsSL https://keybase.io/hashicorp/pgp_keys.asc | gpg --import + if ! gpg --list-keys "${TERRAFORM_GPG_KEY}" > /dev/null 2>&1; then + gpg --list-keys + echo "(*) Warning: HashiCorp GPG key not found in keyring after import." + echo " Continuing installation without GPG verification on Ubuntu Noble." + echo " This is expected behavior for Ubuntu Noble due to keyserver issues." + return 1 # Return failure to indicate GPG verification should be skipped + fi + return 0 + fi + echo -e "disable-ipv6\n$(get_gpg_key_servers)" > ${GNUPGHOME}/dirmngr.conf # GPG key download sometimes fails for some reason and retrying fixes it. local retry_count=0 @@ -225,7 +250,7 @@ find_sentinel_version_from_url() { if [ "$(echo "${requested_version}" | grep -o "." | wc -l)" != "2" ]; then local prefix='sentinel_' local regex="${prefix}\d.\d{2}.\d(?:-\w*)?" - local version_list="$(wget -q $2 -O - | grep -oP ${regex} | tr -d ${prefix} | sort -rV)" + local version_list="$(wget -q $2 -O - | grep -oP ${regex} | sed "s/^${prefix}//" | sort -rV)" if [ "${requested_version}" = "latest" ] || [ "${requested_version}" = "current" ] || [ "${requested_version}" = "lts" ]; then declare -g ${variable_name}="$(echo "${version_list}" | head -n 1)" else @@ -366,6 +391,32 @@ install_terraform() { curl -sSL -o ${terraform_filename} "${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/${terraform_filename}" } +verify_signature() { + local gpg_key=$1 + local sha256sums_url=$2 + local sig_url=$3 + local sha256sums_file=$4 + local sig_file=$5 + local verify_result=0 + + receive_gpg_keys "$gpg_key" + verify_result=$? + if [ $verify_result -ne 0 ] && [ "$IS_GPG_NEW" -eq 1 ]; then + echo "Skipping the gpg key validation for ubuntu noble as unable to import the key." + return 1 + fi + curl -sSL -o "$sha256sums_file" "$sha256sums_url" + curl -sSL -o "$sig_file" "$sig_url" + + # Try GPG verification, but don't fail on Noble + gpg --verify "$sig_file" "$sha256sums_file" + verify_result=$? + if [ $verify_result -ne 0 ]; then + echo "(!) GPG verification failed." + exit 1 + fi +} + mkdir -p /tmp/tf-downloads cd /tmp/tf-downloads # Install Terraform, tflint, Terragrunt @@ -378,10 +429,25 @@ if grep -q "The specified key does not exist." "${terraform_filename}"; then fi if [ "${TERRAFORM_SHA256}" != "dev-mode" ]; then if [ "${TERRAFORM_SHA256}" = "automatic" ]; then - receive_gpg_keys TERRAFORM_GPG_KEY - curl -sSL -o terraform_SHA256SUMS "${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS" - curl -sSL -o terraform_SHA256SUMS.sig "${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS.${TERRAFORM_GPG_KEY}.sig" - gpg --verify terraform_SHA256SUMS.sig terraform_SHA256SUMS + # For Ubuntu Noble, try GPG verification but continue if it fails + if [ "$IS_GPG_NEW" -eq 1 ]; then + echo "(*) Ubuntu Noble detected - attempting GPG verification with fallback..." + set +e + sha256sums_url="${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS" + sig_url="${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS.${TERRAFORM_GPG_KEY}.sig" + verify_signature TERRAFORM_GPG_KEY "$sha256sums_url" "$sig_url" "terraform_SHA256SUMS" "terraform_SHA256SUMS.sig" + verify_result=$? + set -e + if [ $verify_result -ne 0 ]; then + echo "(*) GPG verification failed on Ubuntu Noble, but continuing installation." + echo " Downloading checksums for basic integrity check..." + curl -sSL -o terraform_SHA256SUMS "${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS" + fi + else + sha256sums_url="${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS" + sig_url="${HASHICORP_RELEASES_URL}/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS.${TERRAFORM_GPG_KEY}.sig" + verify_signature TERRAFORM_GPG_KEY "$sha256sums_url" "$sig_url" "terraform_SHA256SUMS" "terraform_SHA256SUMS.sig" + fi else echo "${TERRAFORM_SHA256} *${terraform_filename}" > terraform_SHA256SUMS fi @@ -395,6 +461,23 @@ install_tflint() { curl -sSL -o /tmp/tf-downloads/${TFLINT_FILENAME} https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/${TFLINT_FILENAME} } +verify_tflint_attestations() { + local checksums=$1 + local checksums_sha256=$(sha256sum "$checksums" | cut -d " " -f 1) + + check_packages jq + + curl -L -f "https://api.github.com/repos/terraform-linters/tflint/attestations/sha256:${checksums_sha256}" > attestation.json + curl_exit_code=$? + if [ $curl_exit_code -ne 0 ]; then + echo "(*) Failed to fetch GitHub Attestations for tflint checksums" + return 1 + fi + + jq ".attestations[].bundle" attestation.json > bundle.jsonl + gh at verify "$checksums" -R terraform-linters/tflint -b bundle.jsonl +} + if [ "${TFLINT_VERSION}" != "none" ]; then echo "Downloading tflint..." TFLINT_FILENAME="tflint_linux_${architecture}.zip" @@ -410,31 +493,44 @@ if [ "${TFLINT_VERSION}" != "none" ]; then else curl -sSL -o tflint_checksums.txt https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt + # Attempt GitHub Attestation verification (0.51.1+) set +e - curl -sSL -o checksums.txt.keyless.sig https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt.keyless.sig + verify_tflint_attestations tflint_checksums.txt + verify_result=$? set -e - # Check that checksums.txt.keyless.sig exists and is not empty - if [ -s checksums.txt.keyless.sig ]; then - # Validate checksums with cosign - curl -sSL -o checksums.txt.pem https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt.pem - ensure_cosign - cosign verify-blob \ - --certificate=/tmp/tf-downloads/checksums.txt.pem \ - --signature=/tmp/tf-downloads/checksums.txt.keyless.sig \ - --certificate-identity-regexp="^https://github.com/terraform-linters/tflint" \ - --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ - /tmp/tf-downloads/tflint_checksums.txt - # Ensure that checksums.txt has $TFLINT_FILENAME - grep ${TFLINT_FILENAME} /tmp/tf-downloads/tflint_checksums.txt - # Validate downloaded file + if [ $verify_result -eq 0 ]; then sha256sum --ignore-missing -c tflint_checksums.txt + echo "(*) tflint_checksums.txt verified successfully using GitHub Attestation." else - # Fallback to older, GPG-based verification (pre-0.47.0 of tflint) - curl -sSL -o tflint_checksums.txt.sig https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt.sig - curl -sSL -o tflint_key "${TFLINT_GPG_KEY_URI}" - gpg -q --import tflint_key - gpg --verify tflint_checksums.txt.sig tflint_checksums.txt + # Fallback to cosign verification + echo "(*) GitHub Attestation verification failed or not supported for this version, falling back to Cosign verification..." + set +e + curl -sSL -o checksums.txt.keyless.sig https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt.keyless.sig + set -e + + # Check that checksums.txt.keyless.sig exists and is not empty + if [ -s checksums.txt.keyless.sig ]; then + # Validate checksums with cosign + curl -sSL -o checksums.txt.pem https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt.pem + ensure_cosign + cosign verify-blob \ + --certificate=/tmp/tf-downloads/checksums.txt.pem \ + --signature=/tmp/tf-downloads/checksums.txt.keyless.sig \ + --certificate-identity-regexp="^https://github.com/terraform-linters/tflint" \ + --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ + /tmp/tf-downloads/tflint_checksums.txt + # Ensure that checksums.txt has $TFLINT_FILENAME + grep ${TFLINT_FILENAME} /tmp/tf-downloads/tflint_checksums.txt + # Validate downloaded file + sha256sum --ignore-missing -c tflint_checksums.txt + else + # Fallback to older, GPG-based verification (pre-0.47.0 of tflint) + curl -sSL -o tflint_checksums.txt.sig https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/checksums.txt.sig + curl -sSL -o tflint_key "${TFLINT_GPG_KEY_URI}" + gpg -q --import tflint_key + gpg --verify tflint_checksums.txt.sig tflint_checksums.txt + fi fi fi fi @@ -477,12 +573,27 @@ if [ "${INSTALL_SENTINEL}" = "true" ]; then curl -sSL -o /tmp/tf-downloads/${sentinel_filename} ${sentinel_releases_url}/${SENTINEL_VERSION}/${sentinel_filename} if [ "${SENTINEL_SHA256}" != "dev-mode" ]; then if [ "${SENTINEL_SHA256}" = "automatic" ]; then - receive_gpg_keys TERRAFORM_GPG_KEY - curl -sSL -o sentinel_checksums.txt ${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS - curl -sSL -o sentinel_checksums.txt.sig ${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS.${TERRAFORM_GPG_KEY}.sig - gpg --verify sentinel_checksums.txt.sig sentinel_checksums.txt + # For Ubuntu Noble, try GPG verification but continue if it fails + if [ "$IS_GPG_NEW" -eq 1 ]; then + echo "(*) Ubuntu Noble detected - attempting Sentinel GPG verification with fallback..." + set +e + sha256sums_url="${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS" + sig_url="${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS.${TERRAFORM_GPG_KEY}.sig" + verify_signature TERRAFORM_GPG_KEY "$sha256sums_url" "$sig_url" "sentinel_checksums.txt" "sentinel_checksums.txt.sig" + verify_result=$? + set -e + if [ $verify_result -ne 0 ]; then + echo "(*) GPG verification failed on Ubuntu Noble, but continuing installation." + echo " Downloading checksums for basic integrity check..." + curl -sSL -o sentinel_checksums.txt "${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS" + fi + else + sha256sums_url="${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS" + sig_url="${sentinel_releases_url}/${SENTINEL_VERSION}/sentinel_${SENTINEL_VERSION}_SHA256SUMS.${TERRAFORM_GPG_KEY}.sig" + verify_signature TERRAFORM_GPG_KEY "$sha256sums_url" "$sig_url" "sentinel_checksums.txt" "sentinel_checksums.txt.sig" + fi # Verify the SHASUM matches the archive - shasum -a 256 --ignore-missing -c sentinel_checksums.txt + shasum -a 256 --ignore-missing -c sentinel_checksums.txt else echo "${SENTINEL_SHA256} *${SENTINEL_FILENAME}" >sentinel_checksums.txt fi @@ -531,7 +642,6 @@ install_terraform_docs() { } if [ "${INSTALL_TERRAFORM_DOCS}" = "true" ]; then - TERRAFORM_DOCS_VERSION="latest" terraform_docs_url='https://github.com/terraform-docs/terraform-docs' find_version_from_git_tags TERRAFORM_DOCS_VERSION $terraform_docs_url tfdocs_filename="terraform-docs-v${TERRAFORM_DOCS_VERSION}-linux-${architecture}.tar.gz" diff --git a/test/anaconda/install_anaconda_almalinux8.sh b/test/anaconda/install_anaconda_almalinux8.sh new file mode 100644 index 000000000..416d32a2b --- /dev/null +++ b/test/anaconda/install_anaconda_almalinux8.sh @@ -0,0 +1,31 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Definition specific tests +check "conda" conda --version +check "python" python --version +check "pylint" pylint --version +check "flake8" flake8 --version +check "autopep8" autopep8 --version +check "yapf" yapf --version +check "pydocstyle" pydocstyle --version +check "pycodestyle" pycodestyle --version +check "if conda-notice.txt exists" cat /usr/local/etc/vscode-dev-containers/conda-notice.txt + +check "certifi" pip show certifi | grep Version +check "cryptography" pip show cryptography | grep Version +check "setuptools" pip show setuptools | grep Version +check "tornado" pip show tornado | grep Version + +check "conda-update-conda" bash -c "conda update -y conda" +check "conda-install-tensorflow" bash -c "conda create --name test-env -c conda-forge --yes tensorflow" +check "conda-install-pytorch" bash -c "conda create --name test-env -c conda-forge --yes pytorch" + +# Report result +reportResults + + diff --git a/test/anaconda/install_anaconda_almalinux9.sh b/test/anaconda/install_anaconda_almalinux9.sh new file mode 100644 index 000000000..416d32a2b --- /dev/null +++ b/test/anaconda/install_anaconda_almalinux9.sh @@ -0,0 +1,31 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Definition specific tests +check "conda" conda --version +check "python" python --version +check "pylint" pylint --version +check "flake8" flake8 --version +check "autopep8" autopep8 --version +check "yapf" yapf --version +check "pydocstyle" pydocstyle --version +check "pycodestyle" pycodestyle --version +check "if conda-notice.txt exists" cat /usr/local/etc/vscode-dev-containers/conda-notice.txt + +check "certifi" pip show certifi | grep Version +check "cryptography" pip show cryptography | grep Version +check "setuptools" pip show setuptools | grep Version +check "tornado" pip show tornado | grep Version + +check "conda-update-conda" bash -c "conda update -y conda" +check "conda-install-tensorflow" bash -c "conda create --name test-env -c conda-forge --yes tensorflow" +check "conda-install-pytorch" bash -c "conda create --name test-env -c conda-forge --yes pytorch" + +# Report result +reportResults + + diff --git a/test/anaconda/install_anaconda_bookworm.sh b/test/anaconda/install_anaconda_bookworm.sh new file mode 100644 index 000000000..4a17f3dc1 --- /dev/null +++ b/test/anaconda/install_anaconda_bookworm.sh @@ -0,0 +1,30 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Definition specific tests +check "conda" conda --version +check "python" python --version +check "pylint" pylint --version +check "flake8" flake8 --version +check "autopep8" autopep8 --version +check "yapf" yapf --version +check "pydocstyle" pydocstyle --version +check "pycodestyle" pycodestyle --version +check "if conda-notice.txt exists" cat /usr/local/etc/vscode-dev-containers/conda-notice.txt + +check "certifi" pip show certifi | grep Version +check "cryptography" pip show cryptography | grep Version +check "setuptools" pip show setuptools | grep Version +check "tornado" pip show tornado | grep Version + +check "conda-update-conda" bash -c "conda update -y conda" +check "conda-install-tensorflow" bash -c "conda create --name test-env -c conda-forge --yes tensorflow" +check "conda-install-pytorch" bash -c "conda create --name test-env -c conda-forge --yes pytorch" + +# Report result +reportResults + diff --git a/test/anaconda/install_anaconda_bullseye.sh b/test/anaconda/install_anaconda_bullseye.sh new file mode 100644 index 000000000..4a17f3dc1 --- /dev/null +++ b/test/anaconda/install_anaconda_bullseye.sh @@ -0,0 +1,30 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Definition specific tests +check "conda" conda --version +check "python" python --version +check "pylint" pylint --version +check "flake8" flake8 --version +check "autopep8" autopep8 --version +check "yapf" yapf --version +check "pydocstyle" pydocstyle --version +check "pycodestyle" pycodestyle --version +check "if conda-notice.txt exists" cat /usr/local/etc/vscode-dev-containers/conda-notice.txt + +check "certifi" pip show certifi | grep Version +check "cryptography" pip show cryptography | grep Version +check "setuptools" pip show setuptools | grep Version +check "tornado" pip show tornado | grep Version + +check "conda-update-conda" bash -c "conda update -y conda" +check "conda-install-tensorflow" bash -c "conda create --name test-env -c conda-forge --yes tensorflow" +check "conda-install-pytorch" bash -c "conda create --name test-env -c conda-forge --yes pytorch" + +# Report result +reportResults + diff --git a/test/anaconda/install_anaconda_fedora.sh b/test/anaconda/install_anaconda_fedora.sh new file mode 100644 index 000000000..416d32a2b --- /dev/null +++ b/test/anaconda/install_anaconda_fedora.sh @@ -0,0 +1,31 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Definition specific tests +check "conda" conda --version +check "python" python --version +check "pylint" pylint --version +check "flake8" flake8 --version +check "autopep8" autopep8 --version +check "yapf" yapf --version +check "pydocstyle" pydocstyle --version +check "pycodestyle" pycodestyle --version +check "if conda-notice.txt exists" cat /usr/local/etc/vscode-dev-containers/conda-notice.txt + +check "certifi" pip show certifi | grep Version +check "cryptography" pip show cryptography | grep Version +check "setuptools" pip show setuptools | grep Version +check "tornado" pip show tornado | grep Version + +check "conda-update-conda" bash -c "conda update -y conda" +check "conda-install-tensorflow" bash -c "conda create --name test-env -c conda-forge --yes tensorflow" +check "conda-install-pytorch" bash -c "conda create --name test-env -c conda-forge --yes pytorch" + +# Report result +reportResults + + diff --git a/test/anaconda/install_anaconda_jammy.sh b/test/anaconda/install_anaconda_jammy.sh new file mode 100644 index 000000000..4a17f3dc1 --- /dev/null +++ b/test/anaconda/install_anaconda_jammy.sh @@ -0,0 +1,30 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Definition specific tests +check "conda" conda --version +check "python" python --version +check "pylint" pylint --version +check "flake8" flake8 --version +check "autopep8" autopep8 --version +check "yapf" yapf --version +check "pydocstyle" pydocstyle --version +check "pycodestyle" pycodestyle --version +check "if conda-notice.txt exists" cat /usr/local/etc/vscode-dev-containers/conda-notice.txt + +check "certifi" pip show certifi | grep Version +check "cryptography" pip show cryptography | grep Version +check "setuptools" pip show setuptools | grep Version +check "tornado" pip show tornado | grep Version + +check "conda-update-conda" bash -c "conda update -y conda" +check "conda-install-tensorflow" bash -c "conda create --name test-env -c conda-forge --yes tensorflow" +check "conda-install-pytorch" bash -c "conda create --name test-env -c conda-forge --yes pytorch" + +# Report result +reportResults + diff --git a/test/anaconda/install_anaconda_noble.sh b/test/anaconda/install_anaconda_noble.sh new file mode 100644 index 000000000..4a17f3dc1 --- /dev/null +++ b/test/anaconda/install_anaconda_noble.sh @@ -0,0 +1,30 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Definition specific tests +check "conda" conda --version +check "python" python --version +check "pylint" pylint --version +check "flake8" flake8 --version +check "autopep8" autopep8 --version +check "yapf" yapf --version +check "pydocstyle" pydocstyle --version +check "pycodestyle" pycodestyle --version +check "if conda-notice.txt exists" cat /usr/local/etc/vscode-dev-containers/conda-notice.txt + +check "certifi" pip show certifi | grep Version +check "cryptography" pip show cryptography | grep Version +check "setuptools" pip show setuptools | grep Version +check "tornado" pip show tornado | grep Version + +check "conda-update-conda" bash -c "conda update -y conda" +check "conda-install-tensorflow" bash -c "conda create --name test-env -c conda-forge --yes tensorflow" +check "conda-install-pytorch" bash -c "conda create --name test-env -c conda-forge --yes pytorch" + +# Report result +reportResults + diff --git a/test/anaconda/install_anaconda_noble_without_user.sh b/test/anaconda/install_anaconda_noble_without_user.sh new file mode 100644 index 000000000..4a17f3dc1 --- /dev/null +++ b/test/anaconda/install_anaconda_noble_without_user.sh @@ -0,0 +1,30 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Definition specific tests +check "conda" conda --version +check "python" python --version +check "pylint" pylint --version +check "flake8" flake8 --version +check "autopep8" autopep8 --version +check "yapf" yapf --version +check "pydocstyle" pydocstyle --version +check "pycodestyle" pycodestyle --version +check "if conda-notice.txt exists" cat /usr/local/etc/vscode-dev-containers/conda-notice.txt + +check "certifi" pip show certifi | grep Version +check "cryptography" pip show cryptography | grep Version +check "setuptools" pip show setuptools | grep Version +check "tornado" pip show tornado | grep Version + +check "conda-update-conda" bash -c "conda update -y conda" +check "conda-install-tensorflow" bash -c "conda create --name test-env -c conda-forge --yes tensorflow" +check "conda-install-pytorch" bash -c "conda create --name test-env -c conda-forge --yes pytorch" + +# Report result +reportResults + diff --git a/test/anaconda/install_anaconda_rockylinux8.sh b/test/anaconda/install_anaconda_rockylinux8.sh new file mode 100644 index 000000000..416d32a2b --- /dev/null +++ b/test/anaconda/install_anaconda_rockylinux8.sh @@ -0,0 +1,31 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Definition specific tests +check "conda" conda --version +check "python" python --version +check "pylint" pylint --version +check "flake8" flake8 --version +check "autopep8" autopep8 --version +check "yapf" yapf --version +check "pydocstyle" pydocstyle --version +check "pycodestyle" pycodestyle --version +check "if conda-notice.txt exists" cat /usr/local/etc/vscode-dev-containers/conda-notice.txt + +check "certifi" pip show certifi | grep Version +check "cryptography" pip show cryptography | grep Version +check "setuptools" pip show setuptools | grep Version +check "tornado" pip show tornado | grep Version + +check "conda-update-conda" bash -c "conda update -y conda" +check "conda-install-tensorflow" bash -c "conda create --name test-env -c conda-forge --yes tensorflow" +check "conda-install-pytorch" bash -c "conda create --name test-env -c conda-forge --yes pytorch" + +# Report result +reportResults + + diff --git a/test/anaconda/install_anaconda_rockylinux9.sh b/test/anaconda/install_anaconda_rockylinux9.sh new file mode 100644 index 000000000..d71085c4c --- /dev/null +++ b/test/anaconda/install_anaconda_rockylinux9.sh @@ -0,0 +1,32 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Definition specific tests +check "conda" conda --version +check "python" python --version +check "pylint" pylint --version +check "flake8" flake8 --version +check "autopep8" autopep8 --version +check "yapf" yapf --version +check "pydocstyle" pydocstyle --version +check "pycodestyle" pycodestyle --version +check "if conda-notice.txt exists" cat /usr/local/etc/vscode-dev-containers/conda-notice.txt + +check "certifi" pip show certifi | grep Version +check "cryptography" pip show cryptography | grep Version +check "setuptools" pip show setuptools | grep Version +check "tornado" pip show tornado | grep Version + +check "conda-update-conda" bash -c "conda update -y conda" +check "conda-install-tensorflow" bash -c "conda create --name test-env -c conda-forge --yes tensorflow" +check "conda-install-pytorch" bash -c "conda create --name test-env -c conda-forge --yes pytorch" + +# Report result +reportResults + + + diff --git a/test/anaconda/scenarios.json b/test/anaconda/scenarios.json new file mode 100644 index 000000000..65fba8458 --- /dev/null +++ b/test/anaconda/scenarios.json @@ -0,0 +1,86 @@ +{ + "install_anaconda_noble": { + "image": "mcr.microsoft.com/devcontainers/base:noble", + "user": "vscode", + "features": { + "anaconda": { + "version": "latest" + } + } + }, + "install_anaconda_jammy": { + "image": "mcr.microsoft.com/devcontainers/base:jammy", + "user": "vscode", + "features": { + "anaconda": { + "version": "latest" + } + } + }, + "install_anaconda_bookworm": { + "image": "mcr.microsoft.com/devcontainers/base:bookworm", + "user": "vscode", + "features": { + "anaconda": { + "version": "latest" + } + } + }, + "install_anaconda_bullseye": { + "image": "mcr.microsoft.com/devcontainers/base:bullseye", + "user": "vscode", + "features": { + "anaconda": { + "version": "latest" + } + } + }, + "install_anaconda_noble_without_user": { + "image": "mcr.microsoft.com/devcontainers/base:noble", + "features": { + "anaconda": { + "version": "latest" + } + } + }, + "install_anaconda_almalinux8": { + "image": "almalinux:8", + "features": { + "anaconda": { + "version": "latest" + } + } + }, + "install_anaconda_almalinux9": { + "image": "almalinux:9", + "features": { + "anaconda": { + "version": "latest" + } + } + }, + "install_anaconda_rockylinux8": { + "image": "rockylinux:8", + "features": { + "anaconda": { + "version": "latest" + } + } + }, + "install_anaconda_rockylinux9": { + "image": "rockylinux:9", + "features": { + "anaconda": { + "version": "latest" + } + } + }, + "install_anaconda_fedora": { + "image": "fedora", + "features": { + "anaconda": { + "version": "latest" + } + } + } +} diff --git a/test/aws-cli/scenarios.json b/test/aws-cli/scenarios.json index 9dd703c27..f2577c0ff 100644 --- a/test/aws-cli/scenarios.json +++ b/test/aws-cli/scenarios.json @@ -4,5 +4,14 @@ "features": { "aws-cli": {} } + }, + "zsh_completion": { + "image": "mcr.microsoft.com/devcontainers/base:ubuntu", + "features": { + "common-utils": { + "installZsh": true + }, + "aws-cli": {} + } } } \ No newline at end of file diff --git a/test/aws-cli/zsh_completion.sh b/test/aws-cli/zsh_completion.sh new file mode 100644 index 000000000..ca08e077d --- /dev/null +++ b/test/aws-cli/zsh_completion.sh @@ -0,0 +1,17 @@ +#!/bin/bash + +set -e + +# Import test library for `check` command +source dev-container-features-test-lib + +# Check that the zsh completion file exists in the correct location +check "zsh completion file installed" test -f /usr/local/share/zsh/site-functions/_aws + +# Check that the completion file has the proper zsh completion header +check "zsh completion file has compdef header" grep -q "^#compdef aws" /usr/local/share/zsh/site-functions/_aws + +# Actual ZSH completion testing is a pain, so just ignoring it for now. + +# Report result +reportResults diff --git a/test/azure-cli/install_azcli_dotnet_dockerindocker_trixie.sh b/test/azure-cli/install_azcli_dotnet_dockerindocker_trixie.sh new file mode 100644 index 000000000..3f5e6f540 --- /dev/null +++ b/test/azure-cli/install_azcli_dotnet_dockerindocker_trixie.sh @@ -0,0 +1,13 @@ +#!/bin/bash + +set -e + +# Import test library for `check` command +source dev-container-features-test-lib + +check "version" az --version + +check "docker installed" bash -c "type docker" + +# Report result +reportResults \ No newline at end of file diff --git a/test/azure-cli/install_bicep_trixie.sh b/test/azure-cli/install_bicep_trixie.sh new file mode 100644 index 000000000..28ff7e509 --- /dev/null +++ b/test/azure-cli/install_bicep_trixie.sh @@ -0,0 +1,19 @@ +#!/bin/bash + +set -e + +# Import test library for `check` command +source dev-container-features-test-lib + +# Check to make sure the user is vscode +check "user is vscode" whoami | grep vscode + +check "version" az --version + +# Bicep-specific tests +check "bicep" bicep --version +check "az bicep" az bicep version + +# Report result +reportResults + diff --git a/test/azure-cli/install_extensions_trixie.sh b/test/azure-cli/install_extensions_trixie.sh new file mode 100644 index 000000000..fa55c2f5d --- /dev/null +++ b/test/azure-cli/install_extensions_trixie.sh @@ -0,0 +1,9 @@ +#!/bin/bash + +set -e + +# Import test library for `check` command +source dev-container-features-test-lib + +./install_extensions.sh + diff --git a/test/azure-cli/install_fallback_pip_ubuntu_plucky.sh b/test/azure-cli/install_fallback_pip_ubuntu_plucky.sh new file mode 100644 index 000000000..f6fffd02b --- /dev/null +++ b/test/azure-cli/install_fallback_pip_ubuntu_plucky.sh @@ -0,0 +1,13 @@ +#!/bin/bash + +set -e + +# Import test library for `check` command +source dev-container-features-test-lib + +# Ubuntu plucky (25.04) is NOT in the apt archive codename allowlist, +# so this test validates the pip fallback path. +check "version" az --version + +# Report result +reportResults diff --git a/test/azure-cli/install_in_ubuntu_resolute.sh b/test/azure-cli/install_in_ubuntu_resolute.sh new file mode 100644 index 000000000..eff30a25c --- /dev/null +++ b/test/azure-cli/install_in_ubuntu_resolute.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +set -e + +# Import test library for `check` command +source dev-container-features-test-lib + +# Check to make sure the user is vscode +check "user is vscode" whoami | grep vscode + +check "version" az --version + +# Report result +reportResults diff --git a/test/azure-cli/install_with_python_3_13_trixie.sh b/test/azure-cli/install_with_python_3_13_trixie.sh new file mode 100644 index 000000000..aac4f3c2d --- /dev/null +++ b/test/azure-cli/install_with_python_3_13_trixie.sh @@ -0,0 +1,22 @@ +#!/bin/bash + +set -e + +# Import test library for `check` command +source dev-container-features-test-lib + + +echo -e "\n🔄 Testing 'O.S'" +if cat /etc/os-release | grep -q 'PRETTY_NAME="Debian GNU/Linux 13 (trixie)"'; then + echo -e "\n✅ Passed 'O.S is Linux 13 (trixie)'!\n" +else + echo -e "\n❌ Failed 'O.S is other than Linux 13 (trixie)'!\n" +fi + +# Check to make sure the user is vscode +check "user is vscode" whoami | grep vscode +check "version" az --version + +# Report result +reportResults + diff --git a/test/azure-cli/scenarios.json b/test/azure-cli/scenarios.json index 3ec910399..29fb4f935 100644 --- a/test/azure-cli/scenarios.json +++ b/test/azure-cli/scenarios.json @@ -1,4 +1,22 @@ { + "install_fallback_pip_ubuntu_plucky": { + "image": "ubuntu:plucky", + "features": { + "azure-cli": { + "version": "latest" + } + } + }, + "install_extensions_trixie": { + "image": "mcr.microsoft.com/devcontainers/base:trixie", + "user": "vscode", + "features": { + "azure-cli": { + "version": "latest", + "extensions": "aks-preview,amg,containerapp" + } + } + }, "install_extensions": { "image": "mcr.microsoft.com/devcontainers/base:jammy", "user": "vscode", @@ -29,6 +47,16 @@ } } }, + "install_bicep_trixie": { + "image": "mcr.microsoft.com/devcontainers/base:trixie", + "user": "vscode", + "features": { + "azure-cli": { + "version": "latest", + "installBicep": true + } + } + }, "install_with_python": { "image": "mcr.microsoft.com/devcontainers/base:jammy", "user": "vscode", @@ -39,6 +67,16 @@ } } }, + "install_with_python_3_13_trixie": { + "image": "mcr.microsoft.com/devcontainers/python:2-3.13-trixie", + "user": "vscode", + "features": { + "azure-cli": { + "version": "latest", + "installUsingPython": true + } + } + }, "install_with_python_3_12_bookworm": { "image": "mcr.microsoft.com/devcontainers/python:1-3.12-bookworm", "user": "vscode", @@ -57,5 +95,29 @@ "installUsingPython": "true" } } + }, + "install_azcli_dotnet_dockerindocker_trixie": { + "image": "mcr.microsoft.com/devcontainers/base:trixie", + "user": "vscode", + "features": { + "azure-cli": { + "version": "latest" + }, + "dotnet": { + "aspNetCoreRuntimeVersions": "8.0" + }, + "docker-in-docker": { + "moby": false + } + } + }, + "install_in_ubuntu_resolute": { + "image": "mcr.microsoft.com/devcontainers/base:ubuntu", + "user": "vscode", + "features": { + "azure-cli": { + "version": "latest" + } + } } } \ No newline at end of file diff --git a/test/common-utils/alma-9.sh b/test/common-utils/alma-9.sh index cb2b339e1..c0771df14 100755 --- a/test/common-utils/alma-9.sh +++ b/test/common-utils/alma-9.sh @@ -11,6 +11,8 @@ check "non-root user" test "$(whoami)" = "devcontainer" check "distro" test "${PLATFORM_ID}" = "platform:el9" check "curl" curl --version check "jq" jq --version +check "bubblewrap" bwrap --version +check "socat" socat -V # Report result reportResults \ No newline at end of file diff --git a/test/common-utils/alpine.sh b/test/common-utils/alpine.sh index c5ff86613..f60732527 100755 --- a/test/common-utils/alpine.sh +++ b/test/common-utils/alpine.sh @@ -9,6 +9,8 @@ source dev-container-features-test-lib . /etc/os-release check "non-root user" test "$(whoami)" = "devcontainer" check "distro" test "${ID}" = "alpine" +check "bubblewrap" bwrap --version +check "socat" socat -V # Report result reportResults \ No newline at end of file diff --git a/test/common-utils/fedora.sh b/test/common-utils/fedora.sh index 67706d49a..e52f99bff 100755 --- a/test/common-utils/fedora.sh +++ b/test/common-utils/fedora.sh @@ -10,6 +10,8 @@ source dev-container-features-test-lib check "non-root user" test "$(whoami)" = "devcontainer" check "distro" test "${ID}" = "fedora" check "jq" jq --version +check "bubblewrap" bwrap --version +check "socat" socat -V # Report result reportResults \ No newline at end of file diff --git a/test/common-utils/jammy.sh b/test/common-utils/jammy.sh index f11cac69e..e09765168 100755 --- a/test/common-utils/jammy.sh +++ b/test/common-utils/jammy.sh @@ -9,6 +9,8 @@ source dev-container-features-test-lib . /etc/os-release check "non-root user" test "$(whoami)" = "devcontainer" check "distro" test "${VERSION_CODENAME}" = "jammy" +check "bubblewrap" bwrap --version +check "socat" socat -V # Report result reportResults \ No newline at end of file diff --git a/test/common-utils/noble.sh b/test/common-utils/noble.sh index 78ad146e3..e1d578271 100644 --- a/test/common-utils/noble.sh +++ b/test/common-utils/noble.sh @@ -9,6 +9,8 @@ source dev-container-features-test-lib . /etc/os-release check "non-root user" test "$(whoami)" = "devcontainer" check "distro" test "${VERSION_CODENAME}" = "noble" +check "bubblewrap" bwrap --version +check "socat" socat -V # Report result reportResults diff --git a/test/common-utils/rocky-9.sh b/test/common-utils/rocky-9.sh index cb2b339e1..c0771df14 100755 --- a/test/common-utils/rocky-9.sh +++ b/test/common-utils/rocky-9.sh @@ -11,6 +11,8 @@ check "non-root user" test "$(whoami)" = "devcontainer" check "distro" test "${PLATFORM_ID}" = "platform:el9" check "curl" curl --version check "jq" jq --version +check "bubblewrap" bwrap --version +check "socat" socat -V # Report result reportResults \ No newline at end of file diff --git a/test/common-utils/scenarios.json b/test/common-utils/scenarios.json index 5a8ec87cd..c70c574a7 100644 --- a/test/common-utils/scenarios.json +++ b/test/common-utils/scenarios.json @@ -13,13 +13,6 @@ "common-utils": {} } }, - "buster": { - "image": "debian:buster", - "remoteUser": "devcontainer", - "features": { - "common-utils": {} - } - }, "bullseye": { "image": "debian:bullseye", "remoteUser": "devcontainer", @@ -291,5 +284,12 @@ "features": { "common-utils": {} } + }, + "ubi-8": { + "image": "registry.access.redhat.com/ubi8/ubi:8.10", + "remoteUser": "devcontainer", + "features": { + "common-utils": {} + } } } \ No newline at end of file diff --git a/test/common-utils/test.sh b/test/common-utils/test.sh index 5e16a33c7..46cb119be 100755 --- a/test/common-utils/test.sh +++ b/test/common-utils/test.sh @@ -10,6 +10,8 @@ check "jq" jq --version check "curl" curl --version check "git" git --version check "zsh" zsh --version +check "bubblewrap" bwrap --version +check "socat" socat -V check "ps" ps --version check "Oh My Zsh! theme" test -e $HOME/.oh-my-zsh/custom/themes/devcontainers.zsh-theme check "zsh theme symlink" test -e $HOME/.oh-my-zsh/custom/themes/codespaces.zsh-theme diff --git a/test/common-utils/buster.sh b/test/common-utils/ubi-8.sh old mode 100755 new mode 100644 similarity index 63% rename from test/common-utils/buster.sh rename to test/common-utils/ubi-8.sh index 9fd2f409f..d97e614a7 --- a/test/common-utils/buster.sh +++ b/test/common-utils/ubi-8.sh @@ -8,7 +8,9 @@ source dev-container-features-test-lib # Definition specific tests . /etc/os-release check "non-root user" test "$(whoami)" = "devcontainer" -check "distro" test "${VERSION_CODENAME}" = "buster" +check "distro" test "${PLATFORM_ID}" = "platform:el8" +check "curl" curl --version +check "jq" jq --version # Report result -reportResults \ No newline at end of file +reportResults diff --git a/test/conda/conda_channel_creation.sh b/test/conda/conda_channel_creation.sh new file mode 100644 index 000000000..d1af05d5d --- /dev/null +++ b/test/conda/conda_channel_creation.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +## Test Conda +check "conda-update-conda" bash -c "conda update -c defaults -y conda" +check "conda-install-tensorflow" bash -c "conda create --name tensorflow-test-env -c conda-forge --yes tensorflow" +check "conda-install-pytorch" bash -c "conda create --name pytorch-test-env -c conda-forge --yes pytorch" + +# Report result +reportResults diff --git a/test/conda/conda_channel_creation_with_root.sh b/test/conda/conda_channel_creation_with_root.sh new file mode 120000 index 000000000..906864b93 --- /dev/null +++ b/test/conda/conda_channel_creation_with_root.sh @@ -0,0 +1 @@ +conda_channel_creation.sh \ No newline at end of file diff --git a/test/conda/install_conda.sh b/test/conda/install_conda.sh index efe7f5e89..c7c67dc51 100644 --- a/test/conda/install_conda.sh +++ b/test/conda/install_conda.sh @@ -5,7 +5,9 @@ set -e # Optional: Import test library source dev-container-features-test-lib -check "conda" conda --version | grep 4.12.0 +check "conda" conda --version +check "conda update" conda update -n base -c defaults -y conda +check "conda updated version" conda --version check "conda-forge" conda config --show channels | grep conda-forge check "if conda-notice.txt exists" cat /usr/local/etc/vscode-dev-containers/conda-notice.txt diff --git a/test/conda/install_conda_package_after_upgrade.sh b/test/conda/install_conda_package_after_upgrade.sh new file mode 100644 index 000000000..70715a959 --- /dev/null +++ b/test/conda/install_conda_package_after_upgrade.sh @@ -0,0 +1,21 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Test that conda can install packages without pluggy incompatibility errors +# This validates the fix for the pluggy/conda version mismatch issue where +# conda self-upgrades but the older pluggy lacks the 'wrapper' attribute +check "conda version" conda --version +check "conda update" conda update -n base -c defaults -y conda +check "conda updated version" conda --version +check "install pyopenssl" conda install -y -c defaults pyopenssl +check "install cryptography" conda install -y -c defaults cryptography +check "install scipy with bioconda" conda install -y -c bioconda scipy +check "conda-forge" conda config --show channels | grep conda-forge +check "if conda-notice.txt exists" cat /usr/local/etc/vscode-dev-containers/conda-notice.txt + +# Report result +reportResults diff --git a/test/conda/install_conda_package_after_upgrade_with_root.sh b/test/conda/install_conda_package_after_upgrade_with_root.sh new file mode 120000 index 000000000..c3d5608a0 --- /dev/null +++ b/test/conda/install_conda_package_after_upgrade_with_root.sh @@ -0,0 +1 @@ +install_conda_package_after_upgrade.sh \ No newline at end of file diff --git a/test/conda/scenarios.json b/test/conda/scenarios.json index ef930a17c..f7c2692cb 100644 --- a/test/conda/scenarios.json +++ b/test/conda/scenarios.json @@ -1,11 +1,35 @@ { "install_conda": { - "image": "ubuntu:noble", + "image": "mcr.microsoft.com/devcontainers/base:noble", "features": { "conda": { - "version": "4.12.0", + "version": "latest", "addCondaForge": "true" } } + }, + "install_conda_package_after_upgrade": { + "image": "mcr.microsoft.com/devcontainers/base:noble", + "features": { + "conda": {} + } + }, + "conda_channel_creation": { + "image": "mcr.microsoft.com/devcontainers/base:noble", + "features": { + "conda": {} + } + }, + "install_conda_package_after_upgrade_with_root": { + "image": "ubuntu:noble", + "features": { + "conda": {} + } + }, + "conda_channel_creation_with_root": { + "image": "ubuntu:noble", + "features": { + "conda": {} + } } } diff --git a/test/copilot-cli/install_prerelease.sh b/test/copilot-cli/install_prerelease.sh new file mode 100644 index 000000000..6ef707418 --- /dev/null +++ b/test/copilot-cli/install_prerelease.sh @@ -0,0 +1,19 @@ +#!/usr/bin/env bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# End-to-end check that the "prerelease" channel actually resolves a tag and +# installs the binary. Regression guard for the inline pipeline in +# src/copilot-cli/install.sh. + +check "copilot binary is on PATH" which copilot +check "copilot reports a version" bash -c "copilot -v" + +# Auto-update flag file must exist for prerelease channel. +check "auto-update flag created for prerelease" test -f /etc/devcontainer-copilot-cli/auto-update + +# Report result +reportResults diff --git a/test/copilot-cli/resolve_prerelease_version.sh b/test/copilot-cli/resolve_prerelease_version.sh new file mode 100644 index 000000000..aa4ff41fd --- /dev/null +++ b/test/copilot-cli/resolve_prerelease_version.sh @@ -0,0 +1,32 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +resolve_prerelease_version() { + local repo_versions="${1:?resolve_prerelease_version requires the copilot-cli repo tags as input}" + printf '%s\n' "${repo_versions}" \ + | awk '{print $2}' | sed 's|refs/tags/||' \ + | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9]+)?$' \ + | sort -V | tail -n1 +} + +# Tests the tag-resolution pipeline used by src/copilot-cli/install.sh for the +# "prerelease" channel. + +check "copilot binary is on PATH" which copilot +check "copilot reports a version" bash -c "copilot -v" + +result1="$(resolve_prerelease_version $'abc1234\trefs/tags/v1.0.1\ndef5678\trefs/tags/v1.0.9\nghi9012\trefs/tags/v1.0.10\njkl3456\trefs/tags/v1.0.45\nmno7890\trefs/tags/v1.0.2\n')" +check "picks highest version (v1.0.45)" bash -c "[ '${result1}' = 'v1.0.45' ]" + +result2="$(resolve_prerelease_version $'abc1234\trefs/tags/v1.0.44\ndef5678\trefs/tags/v1.0.45-1\nghi9012\trefs/tags/v1.0.45-10\njkl3456\trefs/tags/v1.0.45-2\nmno7890\trefs/tags/v1.0.45\n')" +check "picks highest prerelease (v1.0.45-10)" bash -c "[ '${result2}' = 'v1.0.45-10' ]" + +result3="$(resolve_prerelease_version $'abc1234\trefs/tags/latest\ndef5678\trefs/tags/v1.0.3\nghi9012\trefs/tags/nightly\njkl3456\trefs/tags/v1.0.20\n')" +check "picks highest version ignoring non-version tags (v1.0.20)" bash -c "[ '${result3}' = 'v1.0.20' ]" + +# Report result +reportResults diff --git a/test/copilot-cli/scenarios.json b/test/copilot-cli/scenarios.json new file mode 100644 index 000000000..3d8336bec --- /dev/null +++ b/test/copilot-cli/scenarios.json @@ -0,0 +1,18 @@ +{ + "resolve_prerelease_version": { + "image": "ubuntu:noble", + "features": { + "copilot-cli": { + "version": "latest" + } + } + }, + "install_prerelease": { + "image": "ubuntu:noble", + "features": { + "copilot-cli": { + "version": "prerelease" + } + } + } +} diff --git a/test/copilot-cli/test.sh b/test/copilot-cli/test.sh new file mode 100644 index 000000000..d1d624cda --- /dev/null +++ b/test/copilot-cli/test.sh @@ -0,0 +1,5 @@ +#!/usr/bin/env bash + +echo "Checking if GitHub Copilot is installed..." +which copilot +copilot -v \ No newline at end of file diff --git a/test/desktop-lite/check_asound_package.sh b/test/desktop-lite/check_asound_package.sh new file mode 100644 index 000000000..112dac197 --- /dev/null +++ b/test/desktop-lite/check_asound_package.sh @@ -0,0 +1,33 @@ +checkOSPackage() { + PACKAGE_NAME=$1 + # Check if the package exists and retrieve its exact version + if [ "$(dpkg-query -W -f='${Status}' "$PACKAGE_NAME" 2>/dev/null | grep -c "ok installed")" -eq 1 ]; then + echo "✅ Package '$PACKAGE_NAME' is installed." + return 0 + else + echo "❌ Package '$PACKAGE_NAME' is not installed." + return 1 + fi +} + +findAvailableOSPackage() { + local candidate + local package_name + for package_name in "$@"; do + candidate="$(apt-cache policy "${package_name}" | awk '/Candidate:/ {print $2}')" + if [ -n "${candidate}" ] && [ "${candidate}" != "(none)" ]; then + echo "${package_name}" + return 0 + fi + done + return 1 +} + +checkAsoundPackage() { + local alsa_package + if ! alsa_package="$(findAvailableOSPackage libasound2 libasound2t64 libasound2-dev)"; then + echo "No supported ALSA package found in apt indexes." >&2 + exit 1 + fi + check "alsa-package-installed-${alsa_package}" checkOSPackage "${alsa_package}" +} diff --git a/test/desktop-lite/scenarios.json b/test/desktop-lite/scenarios.json index 548fada6d..fcb804ff5 100644 --- a/test/desktop-lite/scenarios.json +++ b/test/desktop-lite/scenarios.json @@ -12,13 +12,12 @@ "noVncVersion": "1.2.0" } } - }, + }, "test_vnc_resolution_as_container_env_var": { "image": "ubuntu:noble", "features": { "desktop-lite": {} - } - , + }, "containerEnv": { "VNC_RESOLUTION": "1920x1080x32" }, @@ -39,5 +38,29 @@ 5901, 6080 ] + }, + "test_xtigervnc_novnc_started_trixie": { + "image": "debian:trixie", + "features": { + "desktop-lite": {} + } + }, + "test_asound_package_ubuntu_2204": { + "image": "ubuntu:22.04", + "features": { + "desktop-lite": {} + } + }, + "test_asound_package_ubuntu_2604": { + "image": "ubuntu:26.04", + "features": { + "desktop-lite": {} + } + }, + "test_desktop_init_exec_passthrough": { + "image": "ubuntu:noble", + "features": { + "desktop-lite": {} + } } } \ No newline at end of file diff --git a/test/desktop-lite/test.sh b/test/desktop-lite/test.sh index 5d11dd424..a22c49532 100755 --- a/test/desktop-lite/test.sh +++ b/test/desktop-lite/test.sh @@ -10,34 +10,14 @@ echoStderr() echo "$@" 1>&2 } -checkOSPackage() { - LABEL=$1 - PACKAGE_NAME=$2 - echo -e "\n🧪 Testing $LABEL" - # Check if the package exists and retrieve its exact version - if [ "$(dpkg-query -W -f='${Status}' "$PACKAGE_NAME" 2>/dev/null | grep -c "ok installed")" -eq 1 ]; then - echo "✅ Package '$PACKAGE_NAME' is installed." - exit 0 - else - echo "❌ Package '$PACKAGE_NAME' is not installed." - exit 1 - fi -} +script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +source "${script_dir}/check_asound_package.sh" check "desktop-init-exists" bash -c "ls /usr/local/share/desktop-init.sh" check "log-exists" bash -c "ls /tmp/container-init.log" check "fluxbox-exists" bash -c "ls -la ~/.fluxbox" -. /etc/os-release -if [ "${ID}" = "ubuntu" ]; then - if [ "${VERSION_CODENAME}" = "noble" ]; then - checkOSPackage "if libasound2-dev exists !" "libasound2-dev" - else - checkOSPackage "if libasound2 exists !" "libasound2" - fi -else - checkOSPackage "if libasound2 exists !" "libasound2" -fi +checkAsoundPackage # Report result reportResults \ No newline at end of file diff --git a/test/desktop-lite/test_asound_package_ubuntu_2204.sh b/test/desktop-lite/test_asound_package_ubuntu_2204.sh new file mode 120000 index 000000000..297c107db --- /dev/null +++ b/test/desktop-lite/test_asound_package_ubuntu_2204.sh @@ -0,0 +1 @@ +test_asound_package_ubuntu_2604.sh \ No newline at end of file diff --git a/test/desktop-lite/test_asound_package_ubuntu_2604.sh b/test/desktop-lite/test_asound_package_ubuntu_2604.sh new file mode 100755 index 000000000..150a806ed --- /dev/null +++ b/test/desktop-lite/test_asound_package_ubuntu_2604.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +source "${script_dir}/check_asound_package.sh" + +checkAsoundPackage + +# Report result +reportResults diff --git a/test/desktop-lite/test_desktop_init_exec_passthrough.sh b/test/desktop-lite/test_desktop_init_exec_passthrough.sh new file mode 100644 index 000000000..27d224ca3 --- /dev/null +++ b/test/desktop-lite/test_desktop_init_exec_passthrough.sh @@ -0,0 +1,16 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Verify that desktop-init.sh correctly passes through commands. +# Previously, the heredoc in install.sh did not escape $1 and $@, causing them to expand +# to empty strings at install time, so any command passed to desktop-init.sh was silently ignored. + +check "command is passed through and executed" \ + bash -c "result=\$(/usr/local/share/desktop-init.sh echo 'passthrough-test-token' 2>/dev/null) && echo \"\$result\" | grep -q 'passthrough-test-token'" + +# Report result +reportResults diff --git a/test/desktop-lite/test_xtigervnc_novnc_started_trixie.sh b/test/desktop-lite/test_xtigervnc_novnc_started_trixie.sh new file mode 100644 index 000000000..671032229 --- /dev/null +++ b/test/desktop-lite/test_xtigervnc_novnc_started_trixie.sh @@ -0,0 +1,31 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Check if xtigervnc & noVnc processes are running after successful installation and initialization +check_process_running() { + port=$1 + # Get process id of process running on specific port + PID=$(lsof -i :$port | awk 'NR==2 {print $2}') + if [ -n "$PID" ]; then + CMD=$(ps -p $PID -o cmd --no-headers) + GREEN='\033[0;32m'; NC='\033[0m'; RED='\033[0;31m'; YELLOW='\033[0;33m'; + echo -e "${GREEN}Command running on port $port: ${YELLOW}$CMD${NC}" + else + echo -e "${RED}No process found listening on port $port.${NC}" + fi +} + +check "Whether xtigervnc is Running" check_process_running 5901 +sleep 1 +check "Whether no_vnc is Running" check_process_running 6080 + +check "desktop-init-exists" bash -c "ls /usr/local/share/desktop-init.sh" +check "log-exists" bash -c "ls /tmp/container-init.log" +check "log file contents" bash -c "cat /tmp/container-init.log" + +# Report result +reportResults \ No newline at end of file diff --git a/test/docker-in-docker/Dockerfile b/test/docker-in-docker/Dockerfile index 9cc9f1a39..f2ca69d1d 100644 --- a/test/docker-in-docker/Dockerfile +++ b/test/docker-in-docker/Dockerfile @@ -1 +1 @@ -FROM ubuntu:focal +FROM ubuntu:noble diff --git a/test/docker-in-docker/azure_linux.sh b/test/docker-in-docker/azure_linux.sh new file mode 100644 index 000000000..ca5f51997 --- /dev/null +++ b/test/docker-in-docker/azure_linux.sh @@ -0,0 +1,24 @@ +#!/bin/bash +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# OS identification (optional, can fail gracefully) +check "azure os detection" bash -c "cat /etc/os-release | grep -i azure || echo 'Not Azure Linux, but test can continue'" + +# Core Docker functionality +check "docker version" docker --version +check "docker daemon running" docker info + +# Docker init script (if using docker-in-docker feature) +check "docker init script exists" test -f "/usr/local/share/docker-init.sh" + +# Basic functionality test +check "docker container test" docker run --rm alpine echo "test successful" + +# The main Azure Linux specific test - DNS flag should NOT be present +check "dns flag should not be present" test ! "$(ps -ax | grep -v grep | grep -E 'dockerd.+\-\-dns')" + +# Report result +reportResults \ No newline at end of file diff --git a/test/docker-in-docker/azure_linux_docker_ce.sh b/test/docker-in-docker/azure_linux_docker_ce.sh new file mode 100644 index 000000000..fd1b72c4c --- /dev/null +++ b/test/docker-in-docker/azure_linux_docker_ce.sh @@ -0,0 +1,113 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +echo "=== Azure Linux Docker CE Test ===" + +echo "1. Verifying OS identification..." +cat /etc/os-release | grep -i azure + +echo "2. Checking Docker installation..." +docker --version || { + echo "ERROR: Docker is not installed" + exit 1 +} + +echo "3. Checking if Docker binaries exist..." +which dockerd || echo "dockerd not in PATH" +ls -la /usr/bin/docker* || echo "No docker binaries in /usr/bin" +ls -la /usr/local/bin/docker* || echo "No docker binaries in /usr/local/bin" + +echo "4. Checking Docker service files..." +ls -la /etc/systemd/system/docker* || echo "No systemd docker files" +ls -la /usr/lib/systemd/system/docker* || echo "No system docker service files" + +echo "6. Checking Docker daemon status..." +if ! docker info >/dev/null 2>&1; then + echo "Docker daemon not running, starting it..." + + # Check if docker-init script exists + if [ -f "/usr/local/share/docker-init.sh" ]; then + echo "Starting Docker using docker-init.sh..." + + # Clear any existing log + rm -f /tmp/dockerd.log + + # Start docker-init in background + nohup /usr/local/share/docker-init.sh > /tmp/docker-init.log 2>&1 & + + # Wait for Docker to start with better debugging + echo "Waiting for Docker daemon to start..." + for i in {1..30}; do + if docker info >/dev/null 2>&1; then + echo "Docker daemon started successfully" + break + fi + echo "Waiting... ($i/30)" + + # Show dockerd logs if available + if [ -f "/tmp/dockerd.log" ]; then + echo "--- Recent dockerd.log entries ---" + tail -5 /tmp/dockerd.log || echo "Could not read dockerd.log" + echo "--- End of dockerd.log ---" + fi + + sleep 2 + done + + # Final check with detailed error reporting + if ! docker info >/dev/null 2>&1; then + echo "ERROR: Docker daemon failed to start after 60 seconds" + echo "" + echo "=== DEBUGGING INFORMATION ===" + echo "" + echo "1. Docker init log:" + cat /tmp/docker-init.log 2>/dev/null || echo "No docker-init.log found" + echo "" + echo "2. Docker daemon log:" + cat /tmp/dockerd.log 2>/dev/null || echo "No dockerd.log found" + echo "" + echo "3. Process list:" + ps aux | grep -E "(docker|containerd)" | grep -v grep || echo "No docker/containerd processes found" + echo "" + echo "4. Network interfaces:" + ip addr show || ifconfig || echo "Could not get network info" + echo "" + echo "5. Mount points:" + mount | grep -E "(docker|container)" || echo "No docker-related mounts" + echo "" + echo "6. SELinux status:" + if command -v getenforce >/dev/null 2>&1; then + getenforce || echo "SELinux command failed" + else + echo "SELinux tools not available" + fi + echo "" + echo "7. Available storage:" + df -h /var/lib/docker 2>/dev/null || df -h / || echo "Could not check storage" + echo "" + echo "8. System resources:" + free -h || echo "Could not check memory" + echo "" + echo "=== END DEBUGGING ===" + exit 1 + fi + else + echo "ERROR: docker-init.sh not found at /usr/local/share/docker-init.sh" + ls -la /usr/local/share/ || echo "Could not list /usr/local/share/" + exit 1 + fi +else + echo "Docker daemon is already running" +fi + +echo "7. Testing basic Docker functionality..." +docker info | head -10 + +echo "8. Testing container execution..." +docker run --rm alpine echo "Basic container test successful" + +echo "=== Docker CE test completed successfully ===" \ No newline at end of file diff --git a/test/docker-in-docker/cbl_mariner.sh b/test/docker-in-docker/cbl_mariner.sh new file mode 100644 index 000000000..44a8ee38e --- /dev/null +++ b/test/docker-in-docker/cbl_mariner.sh @@ -0,0 +1,35 @@ +#!/bin/bash +# Simple test script for cbl_mariner scenario (Moby = true) +# Run with: sudo bash script_cbl_mariner.sh + +set -e + +echo "=== Testing cbl_mariner scenario (Moby) ===" + +# Set environment variables for the scenario +export VERSION="latest" +export MOBY="true" +export AZUREDNSAUTODETECTION="false" + +# Source OS info +. /etc/os-release +echo "OS: $ID $VERSION_ID" + +# Check package manager +if type tdnf > /dev/null 2>&1; then + echo "Using tdnf" +else + echo "ERROR: tdnf not found" + exit 1 +fi + +# Validate +if command -v docker > /dev/null 2>&1; then + docker --version + echo "SUCCESS: Docker installed" +else + echo "ERROR: Docker not installed" + exit 1 +fi + +echo "=== cbl_mariner test passed ===" \ No newline at end of file diff --git a/test/docker-in-docker/cbl_mariner_docker_ce.sh b/test/docker-in-docker/cbl_mariner_docker_ce.sh new file mode 100644 index 000000000..24788377b --- /dev/null +++ b/test/docker-in-docker/cbl_mariner_docker_ce.sh @@ -0,0 +1,34 @@ +#!/bin/bash +# test script for cbl_mariner_docker_ce scenario (Moby = false) + +set -e + +echo "=== Testing cbl_mariner_docker_ce scenario (Docker CE) ===" + +# Set environment variables for the scenario +export VERSION="latest" +export MOBY="false" +export AZUREDNSAUTODETECTION="false" + +# Source OS info +. /etc/os-release +echo "OS: $ID $VERSION_ID" + +# Check package manager +if type tdnf > /dev/null 2>&1; then + echo "Using tdnf" +else + echo "ERROR: tdnf not found" + exit 1 +fi + +# Validate +if command -v docker > /dev/null 2>&1; then + docker --version + echo "SUCCESS: Docker installed" +else + echo "ERROR: Docker not installed" + exit 1 +fi + +echo "=== cbl_mariner_docker_ce test passed ===" \ No newline at end of file diff --git a/test/docker-in-docker/dockerIp6tablesDisabledTest.sh b/test/docker-in-docker/dockerIp6tablesDisabledTest.sh index 977054ffc..5fe8c2a3b 100644 --- a/test/docker-in-docker/dockerIp6tablesDisabledTest.sh +++ b/test/docker-in-docker/dockerIp6tablesDisabledTest.sh @@ -16,7 +16,7 @@ ip6tablesCheck() { echo "❕ip6tables command not found. ❕" fi } - +check "docker ps" bash -c "docker ps" check "ip6tables" ip6tablesCheck check "ip6tables check" bash -c "docker network inspect bridge" check "docker-build" docker build ./ diff --git a/test/docker-in-docker/docker_build.sh b/test/docker-in-docker/docker_build.sh index 322a819fc..da5d31a3b 100755 --- a/test/docker-in-docker/docker_build.sh +++ b/test/docker-in-docker/docker_build.sh @@ -9,12 +9,13 @@ source dev-container-features-test-lib check "docker-buildx" docker buildx version check "docker-build" docker build ./ -check "installs compose-switch" bash -c "[[ -f /usr/local/bin/compose-switch ]]" check "docker compose" bash -c "docker compose version | grep -E '2.[0-9]+.[0-9]+'" check "docker-compose" bash -c "docker-compose --version | grep -E '2.[0-9]+.[0-9]+'" check "docker-buildx" bash -c "docker buildx version" check "docker-buildx-path" bash -c "ls -la /usr/libexec/docker/cli-plugins/docker-buildx" +check "Not installing compose-switch by default" bash -c "[[ ! -f /usr/local/bin/compose-switch ]]" + # Report result reportResults diff --git a/test/docker-in-docker/docker_build_older.sh b/test/docker-in-docker/docker_build_older.sh index d60cd937a..ed9932a84 100644 --- a/test/docker-in-docker/docker_build_older.sh +++ b/test/docker-in-docker/docker_build_older.sh @@ -10,6 +10,6 @@ check "docker-buildx" docker buildx version check "docker-build" docker build ./ check "docker-buildx" bash -c "docker buildx version" check "docker-buildx-path" bash -c "ls -la /usr/libexec/docker/cli-plugins/docker-buildx" - +check "docker ps" bash -c "docker ps" # Report result reportResults diff --git a/test/docker-in-docker/docker_build_ubuntu_resolute.sh b/test/docker-in-docker/docker_build_ubuntu_resolute.sh new file mode 100644 index 000000000..c9fd7affc --- /dev/null +++ b/test/docker-in-docker/docker_build_ubuntu_resolute.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Definition specific tests +check "docker-buildx" docker buildx version +check "docker-build" docker build ./ +check "docker-buildx-path" bash -c "ls -la /usr/libexec/docker/cli-plugins/docker-buildx" + +# Report result +reportResults diff --git a/test/docker-in-docker/docker_build_with_compose_switch.sh b/test/docker-in-docker/docker_build_with_compose_switch.sh new file mode 100644 index 000000000..ff4f7b58f --- /dev/null +++ b/test/docker-in-docker/docker_build_with_compose_switch.sh @@ -0,0 +1,22 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Definition specific tests +check "docker-buildx" docker buildx version +check "docker-build" docker build ./ + +check "docker compose" bash -c "docker compose version | grep -E '2.[0-9]+.[0-9]+'" +check "docker-compose" bash -c "docker-compose --version | grep -E '2.[0-9]+.[0-9]+'" + +check "docker-buildx" bash -c "docker buildx version" +check "docker-buildx-path" bash -c "ls -la /usr/libexec/docker/cli-plugins/docker-buildx" + +check "installs compose-switch as the flag is on" bash -c "[[ -f /usr/local/bin/compose-switch ]]" + +# Report result +reportResults + diff --git a/test/docker-in-docker/docker_buildx.sh b/test/docker-in-docker/docker_buildx.sh index c571596fc..b66f7c57f 100755 --- a/test/docker-in-docker/docker_buildx.sh +++ b/test/docker-in-docker/docker_buildx.sh @@ -13,7 +13,8 @@ check "docker-buildx" docker buildx version check "docker-build" docker build ./ check "installs docker-compose v1 install" bash -c "type docker-compose" -check "installs compose-switch" bash -c "[[ -f /usr/local/bin/compose-switch ]]" + +check "Not installing compose-switch by default" bash -c "[[ ! -f /usr/local/bin/compose-switch ]]" # Report result reportResults diff --git a/test/docker-in-docker/docker_compose_latest_moby.sh b/test/docker-in-docker/docker_compose_latest_moby.sh new file mode 100755 index 000000000..bd5a9d23f --- /dev/null +++ b/test/docker-in-docker/docker_compose_latest_moby.sh @@ -0,0 +1,16 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Definition specific tests +check "docker compose" bash -c "docker compose version | grep -E '[0-9]+\.[0-9]+\.[0-9]+'" +check "docker-compose" bash -c "docker-compose --version | grep -E '[0-9]+\.[0-9]+\.[0-9]+'" +check "installs compose as docker-compose" bash -c "[[ -f /usr/local/bin/docker-compose ]]" +check "moby-engine" bash -c "dpkg-query -W moby-engine" +check "moby-cli" bash -c "dpkg-query -W moby-cli" + +# Report result +reportResults diff --git a/test/docker-in-docker/docker_compose_latest_no_moby.sh b/test/docker-in-docker/docker_compose_latest_no_moby.sh new file mode 100644 index 000000000..5eeb34b45 --- /dev/null +++ b/test/docker-in-docker/docker_compose_latest_no_moby.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Definition specific tests +check "docker compose" bash -c "docker compose version | grep -E '[0-9]+\.[0-9]+\.[0-9]+'" +check "docker-compose" bash -c "docker-compose --version | grep -E '[0-9]+\.[0-9]+\.[0-9]+'" +check "installs compose as docker-compose" bash -c "[[ -f /usr/local/bin/docker-compose ]]" + +# Report result +reportResults diff --git a/test/docker-in-docker/docker_compose_v2.sh b/test/docker-in-docker/docker_compose_v2.sh index 5a512d2c5..854206cd1 100755 --- a/test/docker-in-docker/docker_compose_v2.sh +++ b/test/docker-in-docker/docker_compose_v2.sh @@ -10,7 +10,8 @@ source dev-container-features-test-lib check "docker compose" bash -c "docker compose version | grep -E '2.[0-9]+.[0-9]+'" check "docker-compose" bash -c "docker-compose --version | grep -E '2.[0-9]+.[0-9]+'" check "installs compose-switch as docker-compose" bash -c "[[ -f /usr/local/bin/docker-compose ]]" -check "installs compose-switch" bash -c "[[ -f /usr/local/bin/compose-switch ]]" + +check "Not installing compose-switch by default" bash -c "[[ ! -f /usr/local/bin/compose-switch ]]" # Report result reportResults diff --git a/test/docker-in-docker/docker_iptables_switch_at_install.sh b/test/docker-in-docker/docker_iptables_switch_at_install.sh new file mode 100644 index 000000000..c87650a4c --- /dev/null +++ b/test/docker-in-docker/docker_iptables_switch_at_install.sh @@ -0,0 +1,22 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Default behavior (iptablesSwitchAtRuntime omitted -> false): switching happens +# at image build time, so docker-init.sh should NOT contain the runtime block. +check "init-script-exists" bash -c "test -f /usr/local/share/docker-init.sh" +check "no-runtime-iptables-block" bash -c "! grep -q 'update-alternatives --set iptables' /usr/local/share/docker-init.sh" + +# The build-time switch should have set /etc/alternatives/iptables to one of the +# known backends. With the ip_tables module loaded on the host, legacy is preferred. +check "iptables-alternative-set" bash -c "readlink /etc/alternatives/iptables | grep -E 'iptables-(legacy|nft)$'" +check "iptables works" sudo iptables -L + +check "version" docker --version +check "docker-ps" bash -c "docker ps" + +# Report result +reportResults diff --git a/test/docker-in-docker/docker_iptables_switch_at_runtime.sh b/test/docker-in-docker/docker_iptables_switch_at_runtime.sh new file mode 100644 index 000000000..152a4ec98 --- /dev/null +++ b/test/docker-in-docker/docker_iptables_switch_at_runtime.sh @@ -0,0 +1,24 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# iptablesSwitchAtRuntime=true: switching is deferred to container start, so the +# runtime block MUST have been written into docker-init.sh by install.sh. +check "init-script-exists" bash -c "test -f /usr/local/share/docker-init.sh" +check "runtime-iptables-block-present" bash -c "grep -q 'update-alternatives --set iptables' /usr/local/share/docker-init.sh" +check "runtime-iptables-block-has-legacy-branch" bash -c "grep -q '/usr/sbin/iptables-legacy' /usr/local/share/docker-init.sh" +check "runtime-iptables-block-has-nft-branch" bash -c "grep -q '/usr/sbin/iptables-nft' /usr/local/share/docker-init.sh" + +# The runtime block runs as part of docker-init.sh (the feature's entrypoint), +# so by the time these tests execute the alternative must already be set. +check "iptables-alternative-set" bash -c "readlink /etc/alternatives/iptables | grep -E 'iptables-(legacy|nft)$'" +check "iptables works" sudo iptables -L + +check "version" docker --version +check "docker-ps" bash -c "docker ps" + +# Report result +reportResults diff --git a/test/docker-in-docker/docker_specific_moby_buildx.sh b/test/docker-in-docker/docker_specific_moby_buildx.sh index b2d4610a1..a6a7062d6 100755 --- a/test/docker-in-docker/docker_specific_moby_buildx.sh +++ b/test/docker-in-docker/docker_specific_moby_buildx.sh @@ -14,7 +14,8 @@ check "docker-buildx" docker buildx version check "docker-build" docker build ./ check "installs docker-compose v1 install" bash -c "type docker-compose" -check "installs compose-switch" bash -c "[[ -f /usr/local/bin/compose-switch ]]" + +check "Not installing compose-switch by default" bash -c "[[ ! -f /usr/local/bin/compose-switch ]]" # Report result reportResults diff --git a/test/docker-in-docker/docker_with_default_iptables.sh b/test/docker-in-docker/docker_with_default_iptables.sh new file mode 100644 index 000000000..8336cda4c --- /dev/null +++ b/test/docker-in-docker/docker_with_default_iptables.sh @@ -0,0 +1,33 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Feature specific tests +check "docker-ps" bash -c "docker ps" +# Fail loudly if dockerd never finished initializing, printing the real error +check "dockerd-started-successfully" bash -c ' + if ! grep -q "Daemon has completed initialization" /tmp/dockerd.log; then + echo "❌ Docker daemon failed to start. Last errors from /tmp/dockerd.log:" + echo "----- dockerd.log (tail) -----" + tail -n 100 /tmp/dockerd.log + echo "----- error/fatal lines -----" + grep -iE "error|fatal|failed|panic" /tmp/dockerd.log || true + exit 1 + fi +' + +check "iptables works" sudo iptables -L +check "iptables uses nf_tables" bash -c "iptables --version | grep nf_tables" + +check "version" docker --version +check "docker-ps" bash -c "docker ps" +check "log-exists" bash -c "ls /tmp/dockerd.log" +check "log-for-completion" bash -c "cat /tmp/dockerd.log | grep 'Daemon has completed initialization'" +check "log-contents" bash -c "cat /tmp/dockerd.log | grep 'API listen on /var/run/docker.sock'" + +# Report result +reportResults + diff --git a/test/docker-in-docker/docker_with_default_iptables_ubuntu.sh b/test/docker-in-docker/docker_with_default_iptables_ubuntu.sh new file mode 120000 index 000000000..7eb9de2c6 --- /dev/null +++ b/test/docker-in-docker/docker_with_default_iptables_ubuntu.sh @@ -0,0 +1 @@ +docker_with_default_iptables.sh \ No newline at end of file diff --git a/test/docker-in-docker/docker_with_legacy_iptables.sh b/test/docker-in-docker/docker_with_legacy_iptables.sh new file mode 100644 index 000000000..e29e10146 --- /dev/null +++ b/test/docker-in-docker/docker_with_legacy_iptables.sh @@ -0,0 +1,20 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Feature specific tests +check "iptables works" sudo iptables -L +check "iptables uses legacy" bash -c "iptables --version | grep legacy" + +check "version" docker --version +check "docker-ps" bash -c "docker ps" +check "log-exists" bash -c "ls /tmp/dockerd.log" +check "log-for-completion" bash -c "cat /tmp/dockerd.log | grep 'Daemon has completed initialization'" +check "log-contents" bash -c "cat /tmp/dockerd.log | grep 'API listen on /var/run/docker.sock'" + +# Report result +reportResults + diff --git a/test/docker-in-docker/docker_with_legacy_iptables_ubuntu.sh b/test/docker-in-docker/docker_with_legacy_iptables_ubuntu.sh new file mode 120000 index 000000000..5b62242e3 --- /dev/null +++ b/test/docker-in-docker/docker_with_legacy_iptables_ubuntu.sh @@ -0,0 +1 @@ +docker_with_legacy_iptables.sh \ No newline at end of file diff --git a/test/docker-in-docker/install_moby_on_debian_trixie.sh b/test/docker-in-docker/install_moby_on_debian_trixie.sh new file mode 120000 index 000000000..6c5c2a157 --- /dev/null +++ b/test/docker-in-docker/install_moby_on_debian_trixie.sh @@ -0,0 +1 @@ +install_on_debian_trixie.sh \ No newline at end of file diff --git a/test/docker-in-docker/install_on_debian_trixie.sh b/test/docker-in-docker/install_on_debian_trixie.sh new file mode 100644 index 000000000..c6c679684 --- /dev/null +++ b/test/docker-in-docker/install_on_debian_trixie.sh @@ -0,0 +1,12 @@ +#!/bin/bash + +set -e + +# Import test library +source dev-container-features-test-lib + +# Definition specific tests +check "docker installed" bash -c "type docker" + +# Report results +reportResults diff --git a/test/docker-in-docker/overlayfs_containerd_root.sh b/test/docker-in-docker/overlayfs_containerd_root.sh new file mode 100644 index 000000000..f1099c91e --- /dev/null +++ b/test/docker-in-docker/overlayfs_containerd_root.sh @@ -0,0 +1,42 @@ +#!/bin/bash +# +# Regression test for devcontainers/features#1639 / PR #1645 follow-up: +# verifies that when the dev container's root filesystem is overlayfs +# (the default under Docker / containerd-backed hosts), the standalone +# containerd started by the docker-in-docker Feature does NOT place its +# overlayfs snapshotter data on an overlay rootfs (which would fail with +# `invalid argument` when pulling images). +# +set -e + +source dev-container-features-test-lib + +# 1. Confirm we're really reproducing the affected condition: +# the dev container's / must be overlay. +check "rootfs is overlay (precondition)" \ + bash -c '[ "$(findmnt -no FSTYPE /)" = "overlay" ]' + +# 2. The Feature's volume mount must shadow /var/lib/containerd with a +# non-overlay filesystem. Without the mount, containerd's overlayfs +# snapshotter would be writing onto the overlay rootfs and fail at +# pull time. +check "/var/lib/containerd is not overlay" \ + bash -c '[ "$(findmnt -no FSTYPE /var/lib/containerd)" != "overlay" ]' + +check "/var/lib/docker is not overlay" \ + bash -c '[ "$(findmnt -no FSTYPE /var/lib/docker)" != "overlay" ]' + +# 3. The actual symptom: pulling and running an image must succeed. +# Pre-PR-#1645 this fails with: +# failed to mount /tmp/containerd-mountXXXXX ... err: invalid argument +check "docker run hello-world" \ + docker run --rm hello-world + +# 4. Belt-and-braces: confirm dockerd is actually using the +# containerd-snapshotter path so we know this test exercises the +# affected code path, not the legacy overlay2 driver. +check "containerd-snapshotter active" \ + bash -c "docker info 2>/dev/null | grep -qiE 'driver-type: io.containerd.snapshotter.v1|Storage Driver: overlayfs'" + +reportResults + diff --git a/test/docker-in-docker/pin_docker-ce_version_moby_false.sh b/test/docker-in-docker/pin_docker-ce_version_moby_false.sh index ec33d1504..4f1eedb84 100644 --- a/test/docker-in-docker/pin_docker-ce_version_moby_false.sh +++ b/test/docker-in-docker/pin_docker-ce_version_moby_false.sh @@ -5,6 +5,7 @@ source dev-container-features-test-lib check "docker-ce" bash -c "docker --version" check "docker-ce-cli" bash -c "docker version" +check "docker ps" bash -c "docker ps" #report result reportResults \ No newline at end of file diff --git a/test/docker-in-docker/scenarios.json b/test/docker-in-docker/scenarios.json index 1587bda56..a4ee2a3b0 100644 --- a/test/docker-in-docker/scenarios.json +++ b/test/docker-in-docker/scenarios.json @@ -1,4 +1,70 @@ { + "docker_iptables_switch_at_install": { + "image": "mcr.microsoft.com/devcontainers/base:debian", + "features": { + "docker-in-docker": { + "moby": "false", + "iptablesSwitchAtRuntime": false + } + }, + "initializeCommand": "sudo modprobe ip_tables" + }, + // DO NOT REMOVE: This scenario is used by the docker-in-docker-daemon-startup-bulk-test workflow + "docker_iptables_switch_at_runtime": { + "image": "mcr.microsoft.com/devcontainers/base:debian", + "features": { + "docker-in-docker": { + "moby": "false", + "iptablesSwitchAtRuntime": true + } + }, + "initializeCommand": "sudo modprobe ip_tables" + }, + "docker_with_default_iptables": { + "image": "mcr.microsoft.com/devcontainers/base:debian", + "features": { + "docker-in-docker": { + "moby": "false" + } + }, + "initializeCommand": "sudo modprobe --remove --remove-holders --wait 1000 ip_tables" + }, + "docker_with_legacy_iptables": { + "image": "mcr.microsoft.com/devcontainers/base:debian", + "features": { + "docker-in-docker": { + "moby": "false" + } + }, + "initializeCommand": "sudo modprobe ip_tables" + }, + "docker_with_default_iptables_ubuntu": { + "image": "mcr.microsoft.com/devcontainers/base:ubuntu", + "features": { + "docker-in-docker": { + "moby": "false" + } + }, + "initializeCommand": "sudo modprobe --remove --remove-holders --wait 1000 ip_tables" + }, + "docker_with_legacy_iptables_ubuntu": { + "image": "mcr.microsoft.com/devcontainers/base:ubuntu", + "features": { + "docker-in-docker": { + "moby": "false" + } + }, + "initializeCommand": "sudo modprobe ip_tables" + }, + "overlayfs_containerd_root": { + "image": "mcr.microsoft.com/devcontainers/base:noble", + "features": { + "docker-in-docker": { + "version": "latest", + "moby": true + } + } + }, "docker_build_fallback_compose": { "image": "ubuntu:noble", "features": { @@ -55,6 +121,18 @@ }, "remoteUser": "node" }, + "docker_build_with_compose_switch": { + "image": "mcr.microsoft.com/devcontainers/javascript-node:0-18", + "features": { + "docker-in-docker": { + "version": "latest", + "moby": "false", + "dockerDashComposeVersion": "v2", + "installDockerComposeSwitch": true + } + }, + "remoteUser": "node" + }, "docker_build_2": { "image": "ubuntu:noble", "features": { @@ -96,7 +174,7 @@ } }, "docker_python_bookworm": { - "image": "mcr.microsoft.com/devcontainers/base:bookworm", + "image": "mcr.microsoft.com/devcontainers/base:2.1.8-bookworm", "features": { "docker-in-docker": { "moby": true, @@ -125,6 +203,26 @@ } } }, + "docker_compose_latest_moby": { + "image": "mcr.microsoft.com/devcontainers/base:noble", + "features": { + "docker-in-docker": { + "moby": true, + "installDockerBuildx": true, + "dockerDashComposeVersion": "latest" + } + } + }, + "docker_compose_latest_no_moby": { + "image": "mcr.microsoft.com/devcontainers/base:noble", + "features": { + "docker-in-docker": { + "moby": false, + "installDockerBuildx": true, + "dockerDashComposeVersion": "latest" + } + } + }, "docker_build_fallback_buildx": { "image": "ubuntu:noble", "features": { @@ -134,6 +232,22 @@ } } }, + "install_on_debian_trixie": { + "image": "debian:trixie", + "features": { + "docker-in-docker": { + "moby": false + } + } + }, + "docker_build_ubuntu_resolute": { + "image": "ubuntu:resolute", + "features": { + "docker-in-docker": { + "moby": false + } + } + }, "docker_specific_moby_buildx": { "image": "ubuntu:noble", "features": { @@ -146,7 +260,7 @@ "image": "mcr.microsoft.com/devcontainers/base:debian", "features": { "docker-in-docker": { - "version": "26.1.4", + "version": "28.4.0", "moby": "false", "mobyBuildxVersion": "latest", "dockerDashComposeVersion": "none", @@ -158,13 +272,56 @@ } } }, - // DO NOT REMOVE: This scenario is used by the docker-in-docker-stress-test workflow + // DO NOT REMOVE: This scenario is used by the docker-in-docker-daemon-startup-bulk-test workflow "docker_with_on_create_command": { "image": "mcr.microsoft.com/devcontainers/base:debian", "features": { - "docker-in-docker": {} + "docker-in-docker": { + "version": "latest", + "moby": "false" + } }, "remoteUser": "vscode", "onCreateCommand": "docker ps && sleep 5s && docker ps" + }, + "azure_linux": { + "image": "mcr.microsoft.com/azurelinux/base/core:3.0", + "features": { + "docker-in-docker": { + "version": "latest", + "moby": "true", + "azureDnsAutoDetection": false + } + } + }, + "azure_linux_docker_ce": { + "image": "mcr.microsoft.com/azurelinux/base/core:3.0", + "features": { + "docker-in-docker": { + "version": "latest", + "moby": "false", + "azureDnsAutoDetection": false + } + } + }, + "cbl_mariner": { + "image": "mcr.microsoft.com/cbl-mariner/base/core:2.0", + "features": { + "docker-in-docker": { + "version": "latest", + "moby": "true", + "azureDnsAutoDetection": false + } + } + }, + "cbl_mariner_docker_ce": { + "image": "mcr.microsoft.com/cbl-mariner/base/core:2.0", + "features": { + "docker-in-docker": { + "version": "latest", + "moby": "false", + "azureDnsAutoDetection": false + } + } } } diff --git a/test/docker-outside-of-docker/docker_dash_compose_latest_moby.sh b/test/docker-outside-of-docker/docker_dash_compose_latest_moby.sh new file mode 120000 index 000000000..d7e6cc99e --- /dev/null +++ b/test/docker-outside-of-docker/docker_dash_compose_latest_moby.sh @@ -0,0 +1 @@ +docker_dash_compose_latest_no_moby.sh \ No newline at end of file diff --git a/test/docker-outside-of-docker/docker_dash_compose_latest_no_moby.sh b/test/docker-outside-of-docker/docker_dash_compose_latest_no_moby.sh new file mode 100644 index 000000000..d032da9e4 --- /dev/null +++ b/test/docker-outside-of-docker/docker_dash_compose_latest_no_moby.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +set -e + +# Optional: Import test library +source dev-container-features-test-lib + +# Definition specific tests +check "docker compose" bash -c "docker compose version | grep -E '5.[0-9]+.[0-9]+'" +check "docker-compose" bash -c "docker-compose --version | grep -E '5.[0-9]+.[0-9]+'" +check "installs compose-switch as docker-compose" bash -c "[[ -f /usr/local/bin/docker-compose ]]" + +# Report result +reportResults diff --git a/test/docker-outside-of-docker/docker_dash_compose_v1.sh b/test/docker-outside-of-docker/docker_dash_compose_v1.sh index d95f3cf73..33ae319f4 100755 --- a/test/docker-outside-of-docker/docker_dash_compose_v1.sh +++ b/test/docker-outside-of-docker/docker_dash_compose_v1.sh @@ -6,8 +6,8 @@ set -e source dev-container-features-test-lib # Definition specific tests -check "docker compose" bash -c "docker compose version | grep -E '2.[0-9]+.[0-9]+'" check "docker-compose" bash -c "docker-compose --version | grep -E '1.[0-9]+.[0-9]+'" +check "no docker compose plugin" bash -c "if command -v docker >/dev/null 2>&1; then ! docker compose version >/dev/null 2>&1; else true; fi" # Report result reportResults diff --git a/test/docker-outside-of-docker/install_moby_on_debian_trixie.sh b/test/docker-outside-of-docker/install_moby_on_debian_trixie.sh new file mode 120000 index 000000000..6c5c2a157 --- /dev/null +++ b/test/docker-outside-of-docker/install_moby_on_debian_trixie.sh @@ -0,0 +1 @@ +install_on_debian_trixie.sh \ No newline at end of file diff --git a/test/docker-outside-of-docker/install_on_debian_trixie.sh b/test/docker-outside-of-docker/install_on_debian_trixie.sh new file mode 100644 index 000000000..c6c679684 --- /dev/null +++ b/test/docker-outside-of-docker/install_on_debian_trixie.sh @@ -0,0 +1,12 @@ +#!/bin/bash + +set -e + +# Import test library +source dev-container-features-test-lib + +# Definition specific tests +check "docker installed" bash -c "type docker" + +# Report results +reportResults diff --git a/test/docker-outside-of-docker/install_on_ubuntu_resolute.sh b/test/docker-outside-of-docker/install_on_ubuntu_resolute.sh new file mode 100644 index 000000000..c6c679684 --- /dev/null +++ b/test/docker-outside-of-docker/install_on_ubuntu_resolute.sh @@ -0,0 +1,12 @@ +#!/bin/bash + +set -e + +# Import test library +source dev-container-features-test-lib + +# Definition specific tests +check "docker installed" bash -c "type docker" + +# Report results +reportResults diff --git a/test/docker-outside-of-docker/root_docker_socket.sh b/test/docker-outside-of-docker/root_docker_socket.sh new file mode 100644 index 000000000..c40d8a0ce --- /dev/null +++ b/test/docker-outside-of-docker/root_docker_socket.sh @@ -0,0 +1,11 @@ +#!/bin/bash +# Test script to assert root Docker socket usage + +if [ ! -S "/var/run/docker-host.sock" ]; then + echo "ERROR: Root Docker socket not found" + exit 1 +fi + +echo "Root Docker detected" +export DOCKER_HOST="unix:///var/run/docker-host.sock" +docker --version \ No newline at end of file diff --git a/test/docker-outside-of-docker/rootless_docker_socket.sh b/test/docker-outside-of-docker/rootless_docker_socket.sh new file mode 100644 index 000000000..004554e9a --- /dev/null +++ b/test/docker-outside-of-docker/rootless_docker_socket.sh @@ -0,0 +1,27 @@ +#!/bin/bash +set -e + +source dev-container-features-test-lib + +echo "=== Rootless Docker Socket Configuration Test ===" + +# Test the custom rootless socket path +EXPECTED_SOCKET="/var/run/docker-rootless.sock" + +# Check if the configured rootless socket exists and is accessible +check "rootless-socket-exists" test -S "$EXPECTED_SOCKET" +check "rootless-socket-readable" test -r "$EXPECTED_SOCKET" + +# Verify Docker functionality using the rootless socket +export DOCKER_HOST="unix://$EXPECTED_SOCKET" +check "docker-functional-rootless" docker ps >/dev/null + +# Test basic Docker operations with rootless configuration +check "docker-version-rootless" docker version --format '{{.Client.Version}}' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+' >/dev/null +check "docker-info-rootless" docker info >/dev/null + +# Demonstrate that customers can configure custom socket paths +echo "Configured rootless socket path: $EXPECTED_SOCKET" +echo "Docker host: $DOCKER_HOST" + +reportResults \ No newline at end of file diff --git a/test/docker-outside-of-docker/scenarios.json b/test/docker-outside-of-docker/scenarios.json index 7125b4715..2df748169 100644 --- a/test/docker-outside-of-docker/scenarios.json +++ b/test/docker-outside-of-docker/scenarios.json @@ -172,5 +172,69 @@ } }, "containerUser": "vscode" + }, + "install_on_debian_trixie": { + "image": "debian:trixie", + "features": { + "docker-outside-of-docker": { + "moby": false + } + } + }, + "install_on_ubuntu_resolute": { + "image": "ubuntu:resolute", + "features": { + "docker-outside-of-docker": { + "moby": false + } + } + }, + "rootless_docker_socket": { + "image": "mcr.microsoft.com/devcontainers/base:ubuntu-24.04", + "features": { + "docker-outside-of-docker": { + "moby": false, + "socketPath": "/var/run/docker-rootless.sock" + } + }, + "mounts": [ + { + "source": "/var/run/docker.sock", + "target": "/var/run/docker-rootless.sock", + "type": "bind" + } + ], + "containerUser": "vscode" + }, + "root_docker_socket": { + "image": "mcr.microsoft.com/devcontainers/base:ubuntu-24.04", + "features": { + "docker-outside-of-docker": { + "moby": false + } + }, + "containerUser": "vscode" + }, + "docker_dash_compose_latest_moby": { + "image": "mcr.microsoft.com/devcontainers/base:ubuntu-24.04", + "features": { + "docker-outside-of-docker": { + "moby": true, + "dockerDashComposeVersion": "latest" + } + }, + "containerUser": "vscode" + }, + "docker_dash_compose_latest_no_moby": { + "image": "mcr.microsoft.com/devcontainers/base:ubuntu-24.04", + "features": { + "docker-outside-of-docker": { + "moby": false, + "dockerDashComposeVersion": "latest" + } + }, + "containerUser": "vscode" } } + + \ No newline at end of file diff --git a/test/dotnet/dotnet_helpers.sh b/test/dotnet/dotnet_helpers.sh index 01e554f66..20671f84b 100644 --- a/test/dotnet/dotnet_helpers.sh +++ b/test/dotnet/dotnet_helpers.sh @@ -1,39 +1,7 @@ #!/bin/bash -# Prints the latest dotnet version in the specified channel -# Usage: fetch_latest_version_in_channel [] -# Example: fetch_latest_version_in_channel "LTS" -# Example: fetch_latest_version_in_channel "6.0" "dotnet" -# Example: fetch_latest_version_in_channel "6.0" "aspnetcore" -fetch_latest_version_in_channel() { - local channel="$1" - local runtime="$2" - if [ "$runtime" = "dotnet" ]; then - wget -qO- "https://builds.dotnet.microsoft.com/dotnet/Runtime/$channel/latest.version" - elif [ "$runtime" = "aspnetcore" ]; then - wget -qO- "https://builds.dotnet.microsoft.com/dotnet/aspnetcore/Runtime/$channel/latest.version" - else - wget -qO- "https://builds.dotnet.microsoft.com/dotnet/Sdk/$channel/latest.version" - fi -} - -# Prints the latest dotnet version -# Usage: fetch_latest_version [] -# Example: fetch_latest_version -# Example: fetch_latest_version "dotnet" -# Example: fetch_latest_version "aspnetcore" -fetch_latest_version() { - local runtime="$1" - local sts_version - local lts_version - sts_version=$(fetch_latest_version_in_channel "STS" "$runtime") - lts_version=$(fetch_latest_version_in_channel "LTS" "$runtime") - if [[ "$sts_version" > "$lts_version" ]]; then - echo "$sts_version" - else - echo "$lts_version" - fi -} +# Include the same helper functions used by the install script +source ".devcontainer/dotnet/scripts/dotnet-helpers.sh" # Asserts that the specified .NET SDK version is installed # Returns a non-zero exit code if the check fails diff --git a/test/dotnet/install_dotnet_daily.sh b/test/dotnet/install_dotnet_daily.sh new file mode 100644 index 000000000..52f4f8d1b --- /dev/null +++ b/test/dotnet/install_dotnet_daily.sh @@ -0,0 +1,22 @@ +#!/bin/bash + +set -e + +source dev-container-features-test-lib +source dotnet_env.sh +source dotnet_helpers.sh + +# Verify 10.0 SDK (any prerelease containing '10.0') is installed +check ".NET SDK 10.0 installed" \ +is_dotnet_sdk_version_installed "10.0" + +check ".NET Runtime 10.0 installed" \ +is_dotnet_runtime_version_installed "10.0" + +check "ASP.NET Core Runtime 10.0 installed" \ +is_aspnetcore_runtime_version_installed "10.0" + +check "Build and run .NET 10.0 project" \ +dotnet run --project projects/net10.0 + +reportResults diff --git a/test/dotnet/install_dotnet_lts.sh b/test/dotnet/install_dotnet_lts.sh index da9175c15..a62c5937b 100644 --- a/test/dotnet/install_dotnet_lts.sh +++ b/test/dotnet/install_dotnet_lts.sh @@ -13,7 +13,7 @@ source dev-container-features-test-lib source dotnet_env.sh source dotnet_helpers.sh -expected=$(fetch_latest_version_in_channel "LTS") +expected=$(wget -qO- "https://builds.dotnet.microsoft.com/dotnet/Sdk/LTS/latest.version") check "Latest LTS version installed" \ is_dotnet_sdk_version_installed "$expected" diff --git a/test/dotnet/install_dotnet_multiple_versions_preview.sh b/test/dotnet/install_dotnet_multiple_versions_preview.sh deleted file mode 100644 index 76bfd1ae3..000000000 --- a/test/dotnet/install_dotnet_multiple_versions_preview.sh +++ /dev/null @@ -1,47 +0,0 @@ -#!/bin/bash - -set -e - -# Optional: Import test library bundled with the devcontainer CLI -# See https://github.com/devcontainers/cli/blob/HEAD/docs/features/test.md#dev-container-features-test-lib -# Provides the 'check' and 'reportResults' commands. -source dev-container-features-test-lib - -# Feature-specific tests -# The 'check' command comes from the dev-container-features-test-lib. Syntax is... -# check