Add support for Devcontainers in sandbox mode by blue42u · Pull Request #342 · flathub/dev.zed.Zed

blue42u · 2026-04-07T12:57:37Z

Fixes #336. This is #340 but also installs the docker and podman CLIs, which avoids the "docker CLI not found" errors that otherwise appear when Zed attempts to start a Devcontainer.

This works for me on Bluefin DX, based on Fedora 43. @Pioneer-1-1 @tomaswarynyca @acch can you give this a try?

flathubbot · 2026-04-07T12:57:47Z

🚧 Test build enqueued.

flathubbot · 2026-04-07T12:57:57Z

🚧 Started test build.

flathubbot · 2026-04-07T13:12:08Z

✅ Test build succeeded. To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/272402/dev.zed.Zed.flatpakref

Built for aarch64 and x86_64 architectures.

acch · 2026-04-07T14:44:00Z

Thank you very much @blue42u! I gave your version a try:
I can successfully interact with both, docker and podman from within Zed's Terminal. However, I'm still exposed to the leaked LD_LIBRARY_PATH issue (#330 / #334), which prevents Dev Containers from starting:

... ERROR [dev_container::devcontainer_api] Non-success status running devcontainer up for workspace: out: {"outcome":"error","message":"An error occurred setting up the container.","description":"An error occurred setting up the container.","containerId":"ddb7e9f240e4b5750613903d3894ccac85a87cea37f7d673b41813b3d5a5e4ac"}
, err: [...] @devcontainers/cli 0.81.0. Node.js v22.22.0. linux 6.19.10-100.fc42.x86_64 x64.
Shell server terminated (code: 255, signal: null)

podman: /home/.../.local/share/flatpak/app/dev.zed.Zed/x86_64/test/6dae153960bf8b4e08cbe26d34708ab409e2a5e0ae2b2b0a5e654570b8a5e75f/files/lib/libselinux.so.1: no version information available (required by /lib64/libsubid.so.5)
podman: /home/.../.local/share/flatpak/app/dev.zed.Zed/x86_64/test/6dae153960bf8b4e08cbe26d34708ab409e2a5e0ae2b2b0a5e654570b8a5e75f/files/lib/libselinux.so.1: no version information available (required by /lib64/libsemanage.so.2)
Error: cannot run conmon: exit status 127

Error: An error occurred setting up the container.
    at y6 (/home/.../.var/app/dev.zed.Zed/data/zed/devcontainer/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js:467:1277)
    at Cx (/home/.../.var/app/dev.zed.Zed/data/zed/devcontainer/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js:467:1021)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async P6 (/home/.../.var/app/dev.zed.Zed/data/zed/devcontainer/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js:485:3870)
    at async BC (/home/.../.var/app/dev.zed.Zed/data/zed/devcontainer/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js:485:4989)
    at async w7 (/home/.../.var/app/dev.zed.Zed/data/zed/devcontainer/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js:666:205)
    at async D7 (/home/.../.var/app/dev.zed.Zed/data/zed/devcontainer/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js:665:15118)
    at async /home/.../.var/app/dev.zed.Zed/data/zed/devcontainer/node_modules/@devcontainers/cli/dist/spec-node/devContainersSpecCLI.js:485:1188

... ERROR [recent_projects::remote_servers] Failed to start dev container: DevContainerUpFailed("Failed with nested error: DevContainer creation failed")
... ERROR [crates/fs/src/fs_watcher.rs:303] Error { kind: Io(Os { code: 22, kind: InvalidInput

Pioneer-1-1 · 2026-04-07T18:15:50Z

doesn't docker collect user data?

If I remember correctly podman doesn't collect user data (podman desktop does though it can be turned off) but I'm pretty sure there are a bunch of closed source bits which collect user data in docker cli.

Personally I wouldn't be a fan of adding a bunch of data collection into the flatpak.

blue42u · 2026-04-07T20:19:15Z

@acch Just to check, do you have ZED_FLATPAK_NO_ESCAPE=1 set (i.e. sandbox mode)? In sandbox mode I don't see this error, but if I re-enable the sandbox escape I get the same error you do.

FWIW this PR doesn't solve the underlying LD_LIBRARY_PATH leakage issue (#224 / #330 / #334), it just makes Devcontainers work with sandbox mode enabled. I presume sandbox mode was made the new default because it's the current "best" solution for the LD_LIBRARY_PATH problem (#330 (comment)).

@Pioneer-1-1 AFAICT according to a quick web search: the Docker CLI is open-source (Apache license). Any telemetry is fully opt-in, and you get full customization on the endpoint (https://docs.docker.com/engine/cli/otel/). This PR also builds it from source so there's full source provenance available.

Some of Docker's other, proprietary products including Docker Desktop do collect data. You don't need any of them to use Zed's Devcontainer support + this PR.

egerlach · 2026-04-07T22:07:20Z

This version works for me on Aurora 43 (not hugely surprising as it is in the uBlue family).

Pioneer-1-1 · 2026-04-08T10:31:17Z

@Pioneer-1-1 AFAICT according to a quick web search: the Docker CLI is open-source (Apache license). Any telemetry is fully opt-in, and you get full customization on the endpoint (https://docs.docker.com/engine/cli/otel/). This PR also builds it from source so there's full source provenance available.

I checked again and while I can't find anything explicitly stating it it appears you are right and that docker's telemetry is only in the docker desktop application. In that case no objection from me and thanks for the fix.

Pioneer-1-1 · 2026-04-08T12:19:30Z

Works for me on PopOS 24.04LTS

Hizoul · 2026-04-09T14:35:28Z

Confirmed working on Fedora Silverblue 43.20260407.0 without escaping sandbox.

alexojegu · 2026-04-09T19:06:43Z

One option would be to add compatibility via an extension; this would allow users who need it to install it without increasing the file size for those who don't, something like:

https://github.com/flathub/com.visualstudio.code.tool.podman

Or better yet, join forces and create a plugin that works with multiple code editors, if possible.

Pioneer-1-1 · 2026-04-10T11:29:59Z

One option would be to add compatibility via an extension; this would allow users who need it to install it without increasing the file size for those who don't, something like:

https://github.com/flathub/com.visualstudio.code.tool.podman

Or better yet, join forces and create a plugin that works with multiple code editors, if possible.

I can see the rational, but considering how popular devcontainers are now and that their features are baked in to zed it would seem pretty strange to ship a zed flatpak which can't run them

flathubbot · 2026-04-10T12:34:22Z

🚧 Test build enqueued.

flathubbot · 2026-04-10T12:34:31Z

🚧 Started test build.

flathubbot · 2026-04-10T12:49:18Z

✅ Test build succeeded. To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/273389/dev.zed.Zed.flatpakref

Built for aarch64 and x86_64 architectures.

Pioneer-1-1 · 2026-04-10T15:18:21Z

✅ Test build succeeded. To test this build, install it from the testing repository:
flatpak install --user https://dl.flathub.org/build-repo/273389/dev.zed.Zed.flatpakref
Built for aarch64 and x86_64 architectures.

I tried the previous build (the first one in this PR which I believe was based on zed v0.230) and that worked fine. However, when I attempted to build a devcontainer with this build it failed.

I suspect the reason for this is that between 0.230 and 0.231 zed switched from the node reference implementation of devcontainers to a native implementation so presumably something about the change has broken dev containers again.

The error I received was:

2026-04-10T16:09:54+01:00 WARN  [fs] Failed to watch /etc/ssh/ssh_config and its parent directory /etc/ssh:
No path was found. about ["/etc/ssh/ssh_config"]
No path was found. about ["/etc/ssh"]
2026-04-10T16:09:54+01:00 WARN  [dev_container::devcontainer_manifest] No initialize command found
2026-04-10T16:10:36+01:00 ERROR [dev_container::command_json] Error running command Command("podman" "inspect" "--format={{json . }}" "fedora:latest"): Error deserializing from raw json: missing field `devcontainer.metadata` at line 1 column 1044
2026-04-10T16:10:36+01:00 ERROR [recent_projects::remote_servers] Failed to start dev container: DevContainerUpFailed("Failed with nested error: CommandFailed(\"podman\")")

blue42u · 2026-04-10T16:50:26Z

@Pioneer-1-1 I think you're hitting upstream issue zed-industries/zed#52924. I'm running into a similar issue but elsewhere in the deserialization:

... WARN  [fs] Failed to watch /etc/ssh/ssh_config and its parent directory /etc/ssh:
No path was found. about ["/etc/ssh/ssh_config"]
No path was found. about ["/etc/ssh"]
... WARN  [dev_container::devcontainer_manifest] No initialize command found
... ERROR [dev_container::docker] Error deserializing metadata: invalid type: map, expected a sequence at line 1 column 0
... ERROR [dev_container::command_json] Error running command Command("podman" "inspect" "--format={{json . }}" "registry.gitlab.com/hpctoolkit/rtt-images:2.0.0"): Error deserializing from raw json: invalid type: map, expected a sequence at line 1 column 0
... ERROR [recent_projects::remote_servers] Failed to start dev container: DevContainerUpFailed("Failed with nested error: CommandFailed(\"podman\")")

Both seem to be issues with the native devcontainers implementation itself, not the Flatpak sandbox...

Pioneer-1-1 · 2026-04-10T16:56:43Z

@Pioneer-1-1 I think you're hitting upstream issue zed-industries/zed#52924. I'm running into a similar issue but elsewhere in the deserialization:

... WARN  [fs] Failed to watch /etc/ssh/ssh_config and its parent directory /etc/ssh:
No path was found. about ["/etc/ssh/ssh_config"]
No path was found. about ["/etc/ssh"]
... WARN  [dev_container::devcontainer_manifest] No initialize command found
... ERROR [dev_container::docker] Error deserializing metadata: invalid type: map, expected a sequence at line 1 column 0
... ERROR [dev_container::command_json] Error running command Command("podman" "inspect" "--format={{json . }}" "registry.gitlab.com/hpctoolkit/rtt-images:2.0.0"): Error deserializing from raw json: invalid type: map, expected a sequence at line 1 column 0
... ERROR [recent_projects::remote_servers] Failed to start dev container: DevContainerUpFailed("Failed with nested error: CommandFailed(\"podman\")")

Both seem to be issues with the native devcontainers implementation itself, not the Flatpak sandbox...

It's possible it's an upstream error but I don't think it's the one you mentioned. I'm attempting to create a new dev container not launch an existing one.

The WARN [fs] Failed to watch /etc/ssh/ssh_config and its parent directory /etc/ssh issue is also one I've seen when trying to get dev containers to work with the flatpak in the past (i.e. before v0.231) and appears to be an issue related to filesystem access so I suspect this is related to the flatpak implementation rather than zed itself

Have you tried to run a devcontainer with this latest version on your own system?

Pioneer-1-1 · 2026-04-10T17:08:20Z

I had a bit more of a check through the issue you linked (zed-industries/zed#52924) and I'm not almost certain this is unrelated. The errorlog for that issue includes the line:

2026-04-02T00:30:45+05:00 INFO  [recent_projects::remote_servers] SSH: Watching User Config at: "/home/voedipus/.ssh/config"
2026-04-02T00:30:45+05:00 INFO  [recent_projects::remote_servers] SSH: Watching Global Config at: "/etc/ssh/ssh_config"

Whereas my issue appears to be due to:

... WARN  [fs] Failed to watch /etc/ssh/ssh_config and its parent directory /etc/ssh:
No path was found. about ["/etc/ssh/ssh_config"]
No path was found. about ["/etc/ssh"]

So SSH is succeeding in watching in that issue whereas it fails in mine

blue42u · 2026-04-11T03:55:33Z

All,

I've copied these changes over to a PR for dev.zed.Zed-Preview (flathub/dev.zed.Zed-Preview#203). The latest preview release (0.232.0-pre) includes a number of devcontainer-related fixes. If you're experiencing errors with this version, please try that version and see if they persist.

Pioneer-1-1 · 2026-04-11T19:42:18Z

All,

I've copied these changes over to a PR for dev.zed.Zed-Preview (flathub/dev.zed.Zed-Preview#203). The latest preview release (0.232.0-pre) includes a number of devcontainer-related fixes. If you're experiencing errors with this version, please try that version and see if they persist.

I replied to your comment over on the preview but TLDR I ran your PR for the preview version and encountered exactly the same issue.

flathubbot · 2026-04-12T15:59:36Z

🚧 Test build enqueued.

flathubbot · 2026-04-12T15:59:45Z

🚧 Started test build.

flathubbot · 2026-04-12T16:12:57Z

✅ Test build succeeded. To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/273980/dev.zed.Zed.flatpakref

Built for aarch64 and x86_64 architectures.

Pioneer-1-1 · 2026-04-12T16:27:30Z

@blue42u you're latest fix works a treat, I can now both create new dev containers and run existing ones thanks.

napkid · 2026-04-13T10:27:32Z

Thanks for working on this, I too use devcontainers heavily.
I tried the last build on Bluefin (lots of Universal Blue users here BTW !), and it works !

However, I usually use the secrets service integration for registry credentials, and it needs a helper binary (from https://github.com/docker/docker-credential-helpers) that is of course not found in the sandboxed environment.
What could be the best way to handle this kind of issues ?
Docker relies a lot on external binaries to extend it, like the compose CLI plugin, and integrating all of them inside the flatpak does not seem like the best approach IMHO. Should I open another issue for this ?

flathubbot · 2026-05-30T20:36:23Z

🚧 Test build enqueued.

flathubbot · 2026-05-30T20:36:33Z

🚧 Started test build.

flathubbot · 2026-05-30T20:48:21Z

✅ Test build succeeded. To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/289885/dev.zed.Zed.flatpakref

Built for aarch64 and x86_64 architectures.

wallzero · 2026-05-30T21:30:29Z

After a quick glance it works for me with ZED_FLATPAK_NO_ESCAPE=1 and "use_podman": true in the settings.json.

Without sandboxing it doesn't work. It is still able to pull the containers but can't seem to run them. Here's the errors on a fresh install of Fedora Kinoite:

2026-05-30T14:19:52-07:00 INFO  [dev_container::devcontainer_api] find_configs_in_snapshot: Found 1 configurations
2026-05-30T14:19:52-07:00 INFO  [recent_projects::remote_servers] SSH: Watching User Config at: "~/.ssh/config"
2026-05-30T14:19:52-07:00 INFO  [recent_projects::remote_servers] SSH: Watching Global Config at: "/etc/ssh/ssh_config"
2026-05-30T14:19:52-07:00 WARN  [dev_container::devcontainer_manifest] No initialize command found
2026-05-30T14:20:41-07:00 ERROR [dev_container::docker] Non-success result from docker pull: podman: ~/.local/share/flatpak/app/dev.zed.Zed/x86_64/test/aaad149d20296c70002848a4c8d6c6bcec6537d066e9d1db668561c33703c242/files/lib/libselinux.so.1: no version information available (required by /lib64/libsubid.so.5)
podman: ~/.local/share/flatpak/app/dev.zed.Zed/x86_64/test/aaad149d20296c70002848a4c8d6c6bcec6537d066e9d1db668561c33703c242/files/lib/libselinux.so.1: no version information available (required by /lib64/libsemanage.so.2)
Trying to pull localhost/node_j-a955688a66175f03-features:latest...
time="2026-05-30T14:20:37-07:00" level=warning msg="Failed, retrying in 1s ... (1/3). Error: initializing source docker://localhost/node_j-a955688a66175f03-features:latest: pinging container registry localhost: Get \"https://localhost/v2/\": dial tcp [::1]:443: connect: connection refused"
time="2026-05-30T14:20:38-07:00" level=warning msg="Failed, retrying in 1s ... (2/3). Error: initializing source docker://localhost/node_j-a955688a66175f03-features:latest: pinging container registry localhost: Get \"https://localhost/v2/\": dial tcp [::1]:443: connect: connection refused"
time="2026-05-30T14:20:39-07:00" level=warning msg="Failed, retrying in 1s ... (3/3). Error: initializing source docker://localhost/node_j-a955688a66175f03-features:latest: pinging container registry localhost: Get \"https://localhost/v2/\": dial tcp [::1]:443: connect: connection refused"
Error: unable to copy from source docker://localhost/node_j-a955688a66175f03-features:latest: initializing source docker://localhost/node_j-a955688a66175f03-features:latest: pinging container registry localhost: Get "https://localhost/v2/": dial tcp [::1]:443: connect: connection refused

2026-05-30T14:20:45-07:00 ERROR [dev_container::devcontainer_manifest] Non-success status from docker run. StdErr: podman: ~/.local/share/flatpak/app/dev.zed.Zed/x86_64/test/aaad149d20296c70002848a4c8d6c6bcec6537d066e9d1db668561c33703c242/files/lib/libselinux.so.1: no version information available (required by /lib64/libsubid.so.5)
podman: ~/.local/share/flatpak/app/dev.zed.Zed/x86_64/test/aaad149d20296c70002848a4c8d6c6bcec6537d066e9d1db668561c33703c242/files/lib/libselinux.so.1: no version information available (required by /lib64/libsemanage.so.2)
Error: creating container storage: creating an ID-mapped copy of layer "e88f396e182763ca447f810caafee0b7b8b699747116a526ddfc374bf86b8a4e": storage-chown-by-maps: ~/.local/share/flatpak/app/dev.zed.Zed/x86_64/test/aaad149d20296c70002848a4c8d6c6bcec6537d066e9d1db668561c33703c242/files/lib/libselinux.so.1: no version information available (required by /lib64/libsubid.so.5)
storage-chown-by-maps: ~/.local/share/flatpak/app/dev.zed.Zed/x86_64/test/aaad149d20296c70002848a4c8d6c6bcec6537d066e9d1db668561c33703c242/files/lib/libselinux.so.1: no version information available (required by /lib64/libsemanage.so.2)


2026-05-30T14:20:45-07:00 ERROR [recent_projects::remote_servers] Failed to start dev container: DevContainerUpFailed("Failed with nested error: CommandFailed(\"podman\")")

Thanks for getting this working! I'm excited to use dev containers!

Pioneer-1-1 · 2026-05-30T23:12:53Z

After a quick glance it works for me with ZED_FLATPAK_NO_ESCAPE=1 and "use_podman": true in the settings.json.

Without sandboxing it doesn't work. It is still able to pull the containers but can't seem to run them. Here's the errors on a fresh install of Fedora Kinoite:

2026-05-30T14:19:52-07:00 INFO  [dev_container::devcontainer_api] find_configs_in_snapshot: Found 1 configurations
2026-05-30T14:19:52-07:00 INFO  [recent_projects::remote_servers] SSH: Watching User Config at: "~/.ssh/config"
2026-05-30T14:19:52-07:00 INFO  [recent_projects::remote_servers] SSH: Watching Global Config at: "/etc/ssh/ssh_config"
2026-05-30T14:19:52-07:00 WARN  [dev_container::devcontainer_manifest] No initialize command found
2026-05-30T14:20:41-07:00 ERROR [dev_container::docker] Non-success result from docker pull: podman: ~/.local/share/flatpak/app/dev.zed.Zed/x86_64/test/aaad149d20296c70002848a4c8d6c6bcec6537d066e9d1db668561c33703c242/files/lib/libselinux.so.1: no version information available (required by /lib64/libsubid.so.5)
podman: ~/.local/share/flatpak/app/dev.zed.Zed/x86_64/test/aaad149d20296c70002848a4c8d6c6bcec6537d066e9d1db668561c33703c242/files/lib/libselinux.so.1: no version information available (required by /lib64/libsemanage.so.2)
Trying to pull localhost/node_j-a955688a66175f03-features:latest...
time="2026-05-30T14:20:37-07:00" level=warning msg="Failed, retrying in 1s ... (1/3). Error: initializing source docker://localhost/node_j-a955688a66175f03-features:latest: pinging container registry localhost: Get \"https://localhost/v2/\": dial tcp [::1]:443: connect: connection refused"
time="2026-05-30T14:20:38-07:00" level=warning msg="Failed, retrying in 1s ... (2/3). Error: initializing source docker://localhost/node_j-a955688a66175f03-features:latest: pinging container registry localhost: Get \"https://localhost/v2/\": dial tcp [::1]:443: connect: connection refused"
time="2026-05-30T14:20:39-07:00" level=warning msg="Failed, retrying in 1s ... (3/3). Error: initializing source docker://localhost/node_j-a955688a66175f03-features:latest: pinging container registry localhost: Get \"https://localhost/v2/\": dial tcp [::1]:443: connect: connection refused"
Error: unable to copy from source docker://localhost/node_j-a955688a66175f03-features:latest: initializing source docker://localhost/node_j-a955688a66175f03-features:latest: pinging container registry localhost: Get "https://localhost/v2/": dial tcp [::1]:443: connect: connection refused

2026-05-30T14:20:45-07:00 ERROR [dev_container::devcontainer_manifest] Non-success status from docker run. StdErr: podman: ~/.local/share/flatpak/app/dev.zed.Zed/x86_64/test/aaad149d20296c70002848a4c8d6c6bcec6537d066e9d1db668561c33703c242/files/lib/libselinux.so.1: no version information available (required by /lib64/libsubid.so.5)
podman: ~/.local/share/flatpak/app/dev.zed.Zed/x86_64/test/aaad149d20296c70002848a4c8d6c6bcec6537d066e9d1db668561c33703c242/files/lib/libselinux.so.1: no version information available (required by /lib64/libsemanage.so.2)
Error: creating container storage: creating an ID-mapped copy of layer "e88f396e182763ca447f810caafee0b7b8b699747116a526ddfc374bf86b8a4e": storage-chown-by-maps: ~/.local/share/flatpak/app/dev.zed.Zed/x86_64/test/aaad149d20296c70002848a4c8d6c6bcec6537d066e9d1db668561c33703c242/files/lib/libselinux.so.1: no version information available (required by /lib64/libsubid.so.5)
storage-chown-by-maps: ~/.local/share/flatpak/app/dev.zed.Zed/x86_64/test/aaad149d20296c70002848a4c8d6c6bcec6537d066e9d1db668561c33703c242/files/lib/libselinux.so.1: no version information available (required by /lib64/libsemanage.so.2)


2026-05-30T14:20:45-07:00 ERROR [recent_projects::remote_servers] Failed to start dev container: DevContainerUpFailed("Failed with nested error: CommandFailed(\"podman\")")

Thanks for getting this working! I'm excited to use dev containers!

I ran into the same issue on popOS 24.04LTS from what I understand blue42u isn't too keen on getting into the sandbox on vs sandbox off debate but personally I'm not a fan of the current setup as to my mind having dev containers fail out of the box eliminates the ease of use argument of sandbox off while also providing worse security defaults.

Currently flatpak is a rather bodgey system so it's very impressive that @blue42u has been able to get this to work nicely at all. There is currently a project to create a new version of flatpak with improved functionality, security and rationalise the codebase. Which sounds great, though it will rely on systemd so I'm sure the whole linux community will be fine with that and there will be no controversy whatsoever.

wallzero · 2026-06-04T18:25:25Z

Are Podman/Docker compose supported for compose devcontainers? I just tried using podman and received the error:

StdErr: Error: looking up compose provider failed

I also can't get devcontainer features to work. I enabled write access to /tmp and see the directories created but I still receive an error:

ERROR [dev_container::devcontainer_manifest] docker buildx build failed: Error: building at STEP "RUN --mount=type=bind,from=dev_containers_feature_content_source,source=./node_0,target=/tmp/build-features-src/node_0 cp -ar /tmp/build-features-src/node_0 /tmp/dev-container-features && chmod -R 0755 /tmp/dev-container-features/node_0 && cd /tmp/dev-container-features/node_0 && chmod +x ./devcontainer-features-install.sh && ./devcontainer-features-install.sh && rm -rf /tmp/dev-container-features/node_0": while running runtime: exit status 1

Seems to be an issue with VSCode flatpak as well.

But I tried Zed without flatpak and was running into the same issue. Then I found this issue in the main repo and the very recent PR to fix it.

Then I tried non-flatpak Zed with podman compose. Turns out Fedora atomic desktops still require podman-compose for podman compose to work: sudo rpm-ostree install docker-compose. After that I still have an error:

Error: executing /usr/bin/podman-compose --project-name devcontainerproject -f ~/project/.devcontainer/docker-compose.yml -f /tmp/devcontainer-zed/docker_compose_runtime.json up -d: exit status 1

It may be related to the /tmp fix PR. Once that is merged I can test podman compose and devcontainer features.

blue42u · 2026-06-05T16:01:25Z

Are Podman/Docker compose supported for compose devcontainers?

Short version is no, not really. docker-compose should be provided as part of the Flatpak, but the search path is hardcoded to /usr which is part of the org.freedesktop.* runtime(s) and can't be modified here.

Because the Zed Flatpak uses --filesystem=home it might be possible to install docker-compose to ~/.docker/cli-plugins/ as described in https://docs.docker.com/compose/install/linux/#install-the-plugin-manually. If that works for you I'll add a note to the README about it.

I enabled write access to /tmp and see the directories created but I still receive an error:

Assuming this is the same SELinux labeling issue I reported, I worked around it by setting:

# ~/.config/containers/containers.conf
[containers]
label = false

I ran into the same issue on popOS 24.04LTS from what I understand blue42u isn't too keen on getting into the sandbox on vs sandbox off debate but personally I'm not a fan of the current setup as to my mind having dev containers fail out of the box eliminates the ease of use argument of sandbox off while also providing worse security defaults.

I feel the pain, but instead of disabling the sandbox unilaterally and dealing with the resulting backlash, I personally feel the way forward is to get upstream to support running sandboxed. See zed-industries/zed#56435 for one plausible feature that IMHO would help the situation.

wallzero · 2026-06-05T18:57:16Z

Thanks for the info on docker-compose. I'm having trouble with compose working on the non-flatpak Zed. I'm following the guide. But inside the container I have no /workspaces permissions.

Without compose it works and I can see my project:

drwxr-xr-t.   1 root   root     14 Jun  5 18:17 workspaces

With compose it does not work:

drwxr-xr-x.   1 root   root    162 Jun  4 17:18 workspaces

I'm not sure how to have compose mount the workspaces properly. It seems the only difference is the sticky bit. Until I can get it working there's probably no point in trying further within flatpak.

I'll try your workaround for the SELinux labeling issue next. And when the PR is merged we can try a new build without the workaround.

EDIT:

I tried ~/.config/containers/containers.conf and it did work for non-flatpak Zed. Thank you!

But I still can't get features to work inside flatpak. I am using --filesystem=/tmp/devcontainer-zed:create and I tried adding ~/.var/app/dev.zed.Zed/data/containers/containers.conf and ~/.var/app/dev.zed.Zed/config/containers/containers.conf. If I use non-flatpak to install the features then flatpak Zed can open the completed dev container.

EDIT2:

Your workaround also fixes docker compose and /workspace permissions! So I could try the flatpak zed by installing docker-compose to ~/.docker/cli-plugins/ - but first I need either that PR merged or to figure out why the labelling workaround isn't working.

flathubbot · 2026-06-17T15:49:50Z

🚧 Test build enqueued.

flathubbot · 2026-06-17T15:50:12Z

🚧 Started test build.

flathubbot · 2026-06-17T16:06:27Z

✅ Test build succeeded. To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/295171/dev.zed.Zed.flatpakref

Built for aarch64 and x86_64 architectures.

Add the Docker/Podman CLIs and socket permissions to the Flatpak bundle. This allows Dev Containers to be opened from inside the sandbox, they will run in a container on the host system. Reference: flathub/dev.zed.Zed#342 Signed-off-by: Jonathon Anderson <anderson.jonathonm@gmail.com>

flathubbot · 2026-06-24T15:22:57Z

🚧 Test build enqueued.

flathubbot · 2026-06-24T15:23:10Z

🚧 Started test build.

flathubbot · 2026-06-24T15:36:21Z

✅ Test build succeeded. To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/297002/dev.zed.Zed.flatpakref

Built for aarch64 and x86_64 architectures.

Add the Docker/Podman CLIs and socket permissions to the Flatpak bundle. This allows Dev Containers to be opened from inside the sandbox, they will run in a container on the host system. Reference: flathub/dev.zed.Zed#342 Signed-off-by: Jonathon Anderson <anderson.jonathonm@gmail.com>

flathubbot · 2026-07-02T14:34:57Z

🚧 Test build enqueued.

flathubbot · 2026-07-02T14:35:09Z

🚧 Started test build.

flathubbot · 2026-07-02T14:48:18Z

✅ Test build succeeded. To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/299392/dev.zed.Zed.flatpakref

Built for aarch64 and x86_64 architectures.

Pioneer-1-1 · 2026-07-19T14:30:02Z

I'm afraid I don't know of a way to update this branch but please update the flatpak manifest to pull the latest versions of the docker and podman cli's there were a couple of CVE's that got patched since your latest version. The updated manifest dev.zed.Zed.yaml is:

# dev.zed.Zed.yaml
app-id: dev.zed.Zed
runtime: org.freedesktop.Sdk
runtime-version: "25.08"
sdk: org.freedesktop.Sdk
sdk-extensions:
  - org.freedesktop.Sdk.Extension.golang
command: zed-wrapper
separate-locales: false
cleanup:
  - /include
  - /lib/*.a
  - /lib/*.la
  - /lib/pkgconfig
  - /man
  - /share/info
  - /share/man
finish-args:
  - --device=dri
  - --filesystem=home
  - --share=ipc
  - --share=network
  # - --socket=fallback-x11
  - --socket=pulseaudio
  - --socket=wayland
  # Enable access to Flatpak host commands (Needs linter exception: https://docs.flathub.org/docs/for-app-authors/linter#exceptions)
  - --talk-name=org.freedesktop.Flatpak
  # Enable access to Freedesktop Secret Service & related auth services since Zed uses Git heavily
  - --talk-name=org.freedesktop.secrets
  - --socket=ssh-auth
  - --socket=gpg-agent
  # Allow Zed to use SSH_ASKPASS for Git operations that require authentication
  - --env=SSH_ASKPASS=/app/libexec/openssh/gnome-ssh-askpass
  # Set an environment variable to inform users about updating Zed via Flatpak
  - --env=ZED_UPDATE_EXPLANATION="Please use flatpak to update zed"
  # Ensure Zed uses Flatpak sandbox binaries first over user binaries
  - --env=SHELL=/app/bin/app-sh
  # Enable access to Docker & Podman socket
  - --filesystem=/run/docker.sock:rw
  - --filesystem=xdg-run/podman/podman.sock:rw

modules:
  - name: ssh-askpass
    buildsystem: simple
    build-commands:
      - make -C contrib gnome-ssh-askpass3
      - install -Dm755 contrib/gnome-ssh-askpass3 ${FLATPAK_DEST}/libexec/openssh/gnome-ssh-askpass
    sources:
      - type: archive
        sha256: ef6026dd2aea8d56059638d5d3262902c892ceba9f88395835e0d06d3fb63238
        url: https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-10.4p1.tar.gz
        x-checker-data:
          type: anitya
          project-id: 2565
          stable-only: true
          url-template: https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-$version.tar.gz

  - name: gcr
    buildsystem: meson
    cleanup:
      - /lib/girepository-1.0
      - /share/gir-1.0
      - /share/doc
      - /share/gtk-doc
      - /share/pkgconfig
    config-opts:
      - -Dgtk_doc=false
      - -Dintrospection=false
    sources:
      - type: archive
        sha256: bad10f3c553a0e1854649ab59c5b2434da22ca1a54ae6138f1f53961567e1ab7
        url: https://download.gnome.org/sources/gcr/3.41/gcr-3.41.2.tar.xz

  - name: netcat
    buildsystem: simple
    build-commands:
      - |
        while read patch; do
          echo "Applying $patch..."
          patch -Np1 -i "debian/patches/$patch"
        done < debian/patches/series
      # Allow building with static libbsd and libmd
      - sed -i 's/LIBS=/LIBS ?=/' Makefile
      - make CFLAGS="$CFLAGS" LDFLAGS="$LDFLAGS" LIBS="-Wl,-Bstatic -lbsd -lmd -Wl,-Bdynamic -lresolv"
      - install -Dm0755 nc /app/bin/nc
    sources:
      - type: archive
        url: https://salsa.debian.org/debian/netcat-openbsd/-/archive/debian/1.238-1/netcat-openbsd-debian-1.238-1.tar.gz
        sha256: ca2fed5e3e0e9841af812bd7ad2ed9e094f5c4cb72817e91323c75e14858af4a
        x-checker-data:
          type: anitya
          project-id: 21534
          stable-only: true
          url-template: https://salsa.debian.org/debian/netcat-openbsd/-/archive/debian/$version-1/netcat-openbsd-debian-$version-1.tar.gz
    modules:
      - name: libbsd
        buildsystem: autotools
        config-opts:
          - --enable-static
          - --disable-shared
        sources:
          - type: archive
            url: https://libbsd.freedesktop.org/releases/libbsd-0.12.2.tar.xz
            sha256: b88cc9163d0c652aaf39a99991d974ddba1c3a9711db8f1b5838af2a14731014
            x-checker-data:
              type: anitya
              project-id: 1567
              stable-only: true
              url-template: https://libbsd.freedesktop.org/releases/libbsd-$version.tar.xz
        modules:
          - name: libmd
            buildsystem: autotools
            config-opts:
              - --enable-static
              - --disable-shared
            sources:
              - type: archive
                url: https://libbsd.freedesktop.org/releases/libmd-1.2.0.tar.xz
                sha256: ac15ffb8430502fbaccdec66c5a82ee0eab0b0f36220df56710feadfeb13d0a0
                x-checker-data:
                  type: anitya
                  project-id: 15525
                  stable-only: true
                  url-template: https://libbsd.freedesktop.org/releases/libmd-$version.tar.xz

  - name: docker
    buildsystem: simple
    build-options:
      append-path: /usr/lib/sdk/golang/bin
    build-commands:
      - |-
        export GOPATH="$PWD"/go TARGET="$PWD"/out
        cd go/src/github.com/docker/cli && ./scripts/build/binary
      - install -Dm755 out/docker -T ${FLATPAK_DEST}/bin/docker.real
      # Remap Docker arguments to respect the document portal sandbox
      - install -Dm755 docker-map-doc-paths.py ${FLATPAK_DEST}/bin/docker
      # Include host-spawn shims for known credential helpers
      - ln -s /app/bin/host-spawn ${FLATPAK_DEST}/bin/docker-credential-secretservice
      - ln -s /app/bin/host-spawn ${FLATPAK_DEST}/bin/docker-credential-pass
      - ln -s /app/bin/host-spawn ${FLATPAK_DEST}/bin/docker-credential-gcr
      - ln -s /app/bin/host-spawn ${FLATPAK_DEST}/bin/docker-credential-acr-env
      - ln -s /app/bin/host-spawn ${FLATPAK_DEST}/bin/docker-credential-ecr-login
    sources:
      - type: git
        url: https://github.com/docker/cli.git
        tag: v29.4.0
        commit: 9d7ad9ff180b43ae5577d048a7bac1159ce7bacf
        dest: go/src/github.com/docker/cli
        x-checker-data:
          type: git
          url: https://github.com/docker/cli.git
          tag-pattern: "^(v\\d+\\.\\d+\\.\\d+)$"
      - type: file
        path: docker-map-doc-paths.py

  - name: podman
    buildsystem: simple
    build-options:
      append-path: /usr/lib/sdk/golang/bin
    build-commands:
      - make PREFIX=${FLATPAK_DEST} podman-remote
      - install -Dm755 bin/podman-remote -T ${FLATPAK_DEST}/bin/podman.real
      # Remap Podman arguments to respect the document portal sandbox
      - install -Dm755 docker-map-doc-paths.py ${FLATPAK_DEST}/bin/podman
    sources:
      - type: git
        url: https://github.com/containers/podman.git
        tag: v5.8.3
        commit: 93dbfd0d86ee57f8f91801f61ce57dd880a4725f
        x-checker-data:
          type: json
          url: https://api.github.com/repos/containers/podman/releases/latest
          tag-query: .tag_name
          timestamp-query: .published_at
          version-query: $tag | sub("^v"; "")
      - type: file
        path: docker-map-doc-paths.py

  - name: app-sh
    buildsystem: simple
    build-commands:
      - install -Dm755 app-sh -t ${FLATPAK_DEST}/bin/
      - install -Dm644 inject-app-bin.sh -t ${FLATPAK_DEST}/share/
    sources:
      - type: file
        path: app-sh/app-sh
      - type: file
        path: app-sh/inject-app-bin.sh

  - name: zed
    buildsystem: simple
    build-commands:
      - install -Dm 755 bin/* --target-directory ${FLATPAK_DEST}/bin
      - install -Dm 755 lib/* --target-directory ${FLATPAK_DEST}/lib
      - install -Dm 755 libexec/* --target-directory ${FLATPAK_DEST}/libexec
      - install -Dm 644 share/applications/* --target-directory ${FLATPAK_DEST}/share/applications
      - install -Dm 644 ${FLATPAK_ID}.metainfo.xml --target-directory ${FLATPAK_DEST}/share/metainfo
      - install -Dm 644 share/icons/hicolor/512x512/apps/zed.png --target-directory ${FLATPAK_DEST}/share/icons/hicolor/512x512/apps

      # Rename instances of `zed` to `${FLATPAK_ID}`
      - rename zed ${FLATPAK_ID} ${FLATPAK_DEST}/share/icons/hicolor/*/apps/*

      # Ensure zed-wrapper is used as the Exec command in the `.desktop` file
      - desktop-file-edit --set-key="Exec" --set-value="zed-wrapper %U" ${FLATPAK_DEST}/share/applications/${FLATPAK_ID}.desktop
      # Modify original `.desktop` file to use the correct icon name
      - desktop-file-edit --set-icon="${FLATPAK_ID}" ${FLATPAK_DEST}/share/applications/${FLATPAK_ID}.desktop
    sources:
      - type: archive
        url: https://github.com/zed-industries/zed/releases/download/v1.11.3/zed-linux-x86_64.tar.gz
        sha256: 483ee09c885801dd7a0230e3ccf5c463c4dbe4559927f5856fd568e7b1a32e3e
        only-arches:
          - x86_64
        x-checker-data:
          type: json
          url: https://api.github.com/repos/zed-industries/zed/releases/latest
          version-query: .tag_name
          url-query: .assets[] | select(.name=="zed-linux-x86_64.tar.gz") | .browser_download_url
          is-main-source: true
      - type: archive
        url: https://github.com/zed-industries/zed/releases/download/v1.11.3/zed-linux-aarch64.tar.gz
        sha256: deba67d5fcc042b8ad9f92e803464b4ea0b220880fdc373ba5827fcad4ebd9fc
        only-arches:
          - aarch64
        x-checker-data:
          type: json
          url: https://api.github.com/repos/zed-industries/zed/releases/latest
          version-query: .tag_name
          url-query: .assets[] | select(.name=="zed-linux-aarch64.tar.gz") | .browser_download_url
          is-main-source: true
      - type: file
        path: dev.zed.Zed.metainfo.xml

  - name: host-spawn
    buildsystem: simple
    build-commands:
      - install -Dm755 host-spawn /app/bin/host-spawn
    sources:
      - type: file
        url: https://github.com/1player/host-spawn/releases/download/v1.6.2/host-spawn-x86_64
        sha256: 077bc09a087292447ba17cfe2156a93f71bf56c4c6be8e38d3abe65c1240f34c
        dest-filename: host-spawn
        only-arches: [x86_64]
        x-checker-data:
          type: json
          url: https://api.github.com/repos/1player/host-spawn/releases/latest
          tag-query: .tag_name
          version-query: .tag_name
          timestamp-query: .published_at
          url-query: '[.assets[] | select(.name|test(".+x86_64$"))][0] | .browser_download_url'
      - type: file
        url: https://github.com/1player/host-spawn/releases/download/v1.6.2/host-spawn-aarch64
        sha256: 8b30215b0b6b66c8c34a3e22d372dd39020295cd0904608bc2c5f5ecff829e5f
        dest-filename: host-spawn
        only-arches: [aarch64]
        x-checker-data:
          type: json
          url: https://api.github.com/repos/1player/host-spawn/releases/latest
          tag-query: .tag_name
          version-query: .tag_name
          timestamp-query: .published_at
          url-query: '[.assets[] | select(.name|test(".+aarch64$"))][0] | .browser_download_url'

  - name: zed-wrapper
    buildsystem: meson
    config-opts:
      - -Deditor_binary=/app/bin/zed
      - -Deditor_title=Zed
      - -Dprogram_name=zed-wrapper
      - -Dfirst_run_template=README.md
      - -Dsdk_update_template=sdk_update.md
      - -Dflagfile_prefix=flatpak-zed
      - -Ddefault_loglevel=0
    sources:
      - type: git
        commit: d581fd9b873acbf6fb22899aa388435f6c00f61a
        url: https://github.com/flathub-infra/ide-flatpak-wrapper
      - type: file
        path: README.md
      - type: file
        path: sdk_update.md

This updates the CLI's and brings this up to date with the current version of zed.

P.S. does anyone know if it's possible to submit a PR for a PR?

blue42u · 2026-07-21T14:45:15Z

@Pioneer-1-1 Thanks! I've updated them to Podman 5.8.3 and Docker 29.6.2. Note that Podman 6+ doesn't work (yet) because it expects Cgroups v2 inside the Flatpak sandbox, I just reported this upstream (podman-container-tools/podman#29241).

All: IMHO we need to get Zed upstream more interested in the Flatpak side of things if we're going to make progress on bugs/missing features like this. I posted a discussion proposing a Flatpak remote (zed-industries/zed#56435) and a proof of concept (zed-industries/zed#60700) before getting swamped at my day job. If you have time, please feel free to jump in and show support or propose other ideas.

flathubbot · 2026-07-21T14:46:06Z

🚧 Test build enqueued.

flathubbot · 2026-07-21T14:46:22Z

🚧 Started test build.

flathubbot · 2026-07-21T15:00:35Z

✅ Test build succeeded. To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/304522/dev.zed.Zed.flatpakref

Built for aarch64 and x86_64 architectures.

This was referenced Apr 8, 2026

Revert "feat: don't escape flatpak sandbox (#275)" #343

Closed

Update README.md #337

Closed

blue42u mentioned this pull request Apr 11, 2026

Add support for Devcontainers in sandbox mode flathub/dev.zed.Zed-Preview#203

Open

blue42u force-pushed the devcontainer-fixes branch from f453de2 to 5615b63 Compare April 12, 2026 15:59

blue42u force-pushed the devcontainer-fixes branch from 5084c74 to a852f2a Compare June 17, 2026 15:49

francoism90 mentioned this pull request Jun 22, 2026

Succesfully enabled devcontainer support using sandboxing #388

Open

blue42u force-pushed the devcontainer-fixes branch from a852f2a to 3293643 Compare June 24, 2026 15:22

blue42u force-pushed the devcontainer-fixes branch from 3293643 to f706872 Compare July 2, 2026 14:34

Add support for Devcontainers in sandbox mode

f531194

blue42u force-pushed the devcontainer-fixes branch from f706872 to f531194 Compare July 21, 2026 14:46

Uh oh!

Conversation

blue42u commented Apr 7, 2026

Uh oh!

flathubbot commented Apr 7, 2026

Uh oh!

flathubbot commented Apr 7, 2026

Uh oh!

flathubbot commented Apr 7, 2026

Uh oh!

acch commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Pioneer-1-1 commented Apr 7, 2026

Uh oh!

blue42u commented Apr 7, 2026

Uh oh!

egerlach commented Apr 7, 2026

Uh oh!

Pioneer-1-1 commented Apr 8, 2026

Uh oh!

Pioneer-1-1 commented Apr 8, 2026

Uh oh!

Hizoul commented Apr 9, 2026

Uh oh!

alexojegu commented Apr 9, 2026

Uh oh!

Pioneer-1-1 commented Apr 10, 2026

Uh oh!

flathubbot commented Apr 10, 2026

Uh oh!

flathubbot commented Apr 10, 2026

Uh oh!

flathubbot commented Apr 10, 2026

Uh oh!

Pioneer-1-1 commented Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

blue42u commented Apr 10, 2026

Uh oh!

Pioneer-1-1 commented Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Pioneer-1-1 commented Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

blue42u commented Apr 11, 2026

Uh oh!

Pioneer-1-1 commented Apr 11, 2026

Uh oh!

flathubbot commented Apr 12, 2026

Uh oh!

flathubbot commented Apr 12, 2026

Uh oh!

flathubbot commented Apr 12, 2026

Uh oh!

Pioneer-1-1 commented Apr 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

napkid commented Apr 13, 2026

Uh oh!

flathubbot commented May 30, 2026

Uh oh!

flathubbot commented May 30, 2026

Uh oh!

flathubbot commented May 30, 2026

Uh oh!

wallzero commented May 30, 2026

Uh oh!

Pioneer-1-1 commented May 30, 2026

Uh oh!

wallzero commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

blue42u commented Jun 5, 2026

Uh oh!

wallzero commented Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

flathubbot commented Jun 17, 2026

acch commented Apr 7, 2026 •

edited

Loading

Pioneer-1-1 commented Apr 10, 2026 •

edited

Loading

Pioneer-1-1 commented Apr 10, 2026 •

edited

Loading

Pioneer-1-1 commented Apr 10, 2026 •

edited

Loading

Pioneer-1-1 commented Apr 12, 2026 •

edited

Loading

wallzero commented Jun 4, 2026 •

edited

Loading

wallzero commented Jun 5, 2026 •

edited

Loading