Build-time installs + root-entrypoint firewall#397
Merged
Conversation
…ia root entrypoint Collapse the highly-trusted setup window. Previously post-create.sh ran a lot of networked installs (pixi, npm, Playwright browsers, the Claude curl|bash installer, Codex) while it had full network, passwordless sudo, and the credentials mounted, before the firewall came up. This restructures setup so no phase is simultaneously networked, credentialed, privileged, and unfirewalled. - Dockerfile: install Node (build-only), the Claude and Codex CLIs, and the pinned Playwright browser (chromium, v1.56.1) at build time -- where no credentials are mounted, so a poisoned dependency can't exfiltrate tokens. Also install bubblewrap + socat. Bake "no sudo for vscode" into the image (rm /etc/sudoers.d/vscode). Add a root ENTRYPOINT + CMD. - entrypoint.sh (new): runs as root at container start, fixes the .pixi volume ownership if needed, brings up the egress firewall (fail-closed), signals readiness, then execs the long-running command. - post-create.sh: now runs as unprivileged vscode AFTER the firewall is up (waits on the readiness flag). Only pixi install --locked, dev-install, and UI-test JS deps remain -- all hitting allowlisted endpoints only. No sudo, no non-allowlisted CDN access. - devcontainer.json: overrideCommand=false so our ENTRYPOINT/CMD run; containerUser=root (entrypoint) with remoteUser=vscode (lifecycle/shells); PLAYWRIGHT_BROWSERS_PATH for the baked-in browser. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The container rootfs (~/.cache) is fuse-overlayfs under rootless Podman, which pixi flags as a network filesystem and redirects per-run to an ephemeral /tmp dir (emitting a warning and losing the cache across rebuilds). Point PIXI_CACHE_DIR at the local xfs .pixi volume via containerEnv so it applies to every container process (entrypoint, postCreate, and all exec sessions); the cache is now quiet and persistent. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
krokicki
changed the title
…-machine setup Rewrite docs/DevContainer.md to cover both the rootless-Podman support and the build-time/firewall hardening: - Runtime selection via FG_CONTAINER_RUNTIME and how dc.sh uses it. - Linux rootless Podman setup: podman + deps, subuid/subgid, the ~/.bashrc exports (FG_CONTAINER_RUNTIME=podman, PIXI_CACHE_DIR on local scratch), optional scratch-backed storage.conf, and ipset module persistence. - Security model: unprivileged agent (no sudo) with host root-shell for maintenance, credential-free build-time installs, root entrypoint that brings up the firewall first, the tamper-proof firewall (pinned DNS, no blanket port 22, no host subnet), and the keep-id credential mapping. - Container vs host pixi cache (PIXI_CACHE_DIR) and the baked-in Playwright browser. - Architecture of the .devcontainer/ files; updated GPU section for Podman CDI. Dropped the outdated standalone-CLI section. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Chained on top of #396 (base:
podman-devcontainer).Restructures container setup so that no phase is simultaneously networked, credentialed, privileged, and unfirewalled. Previously
post-create.shran many networked installs (pixi, npm, Playwright browsers, the Claudecurl | bashinstaller, Codex) while it had full network access, passwordless sudo, and the credentials mounted, all before the firewall came up.The work is split so the untrusted, CDN-fetching installs happen at image-build time (where no credentials are mounted), and the credentialed runtime phase is unprivileged and firewalled.
Changes
Dockerfile: install Node (build-time only), the Claude and Codex CLIs, and the pinned Playwright browser (chromium, matching the project's@playwright/test1.56.1) at build time; installbubblewrap+socat; bake "no sudo for vscode" into the image (rm /etc/sudoers.d/vscode); add a rootENTRYPOINT+CMD.entrypoint.sh(new): runs as root at container start, fixes the.pixivolume ownership if needed, brings up the egress firewall (fail-closed), signals readiness, then execs the long-running command.post-create.sh: now runs as the unprivilegedvscodeuser after the firewall is up (waits on a readiness flag). Onlypixi install --locked,dev-install, and the UI-test JS deps remain — all hitting allowlisted endpoints only. No sudo, no non-allowlisted CDN access.devcontainer.json:overrideCommand: falseso the imageENTRYPOINT/CMDrun;containerUser: root(for the entrypoint) withremoteUser: vscode(lifecycle commands and shells);PLAYWRIGHT_BROWSERS_PATHfor the baked-in browser.Resulting phases
Verification
Rebuilt under rootless Podman, confirmed on the running container:
/etc/sudoers.d/vscodeis gone;sudofails;vscodecannotiptables -F.bwrap, andsocatare all baked into the image.dc.sh exec, used bycontainer-claude/-codex/-shell) runs asvscode, not root, even though the container starts as root for the entrypoint.claude 2.1.187,codex-cli 0.142.0).Notes
@StephanPreibisch @JaneliaSciComp/fileglancer