feat(devcontainer): improve performance and reliability of devcontainer launch #119

stewartadam · 2025-12-03T01:19:10Z

Pull Request

Description

Captures learnings from recent customer projects to enhance the build speed and launch reliability of the dev container.

removes unused Python feature from container, which was causing compilation of Python on build
add volume mounts for node_modules and user config for better I/O performance
normalize workspace mount to /workspace for consistency across environments
add CA certificate injection for corporate TLS inspection (ZScaler, etc.)
add git config include parsing workaround for devcontainer identity issues
add containerEnv vars for pip, nodejs, and uv SSL certificate bundles

🚀 - Generated by Copilot

Related Issue(s)

Type of Change

Select all that apply:

Code & Documentation:

Bug fix (non-breaking change fixing an issue)
New feature (non-breaking change adding functionality)
Breaking change (fix or feature causing existing functionality to change)
Documentation update

Infrastructure & Configuration:

AI Artifacts:

Reviewed contribution with prompt-builder chatmode and addressed all feedback
Copilot instructions (.github/instructions/*.instructions.md)
Copilot prompt (.github/prompts/*.prompt.md)
Copilot chatmode (.github/chatmodes/*.chatmode.md)

Note for AI Artifact Contributors:

Chatmodes: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation chatmodes likely already exist. Review .github/chatmodes/ before creating new ones.

Model Versions: Only contributions targeting the latest Anthropic and OpenAI models will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected.

See Chatmodes Not Accepted and Model Version Requirements.

Other:

Script/automation (.ps1, .sh, .py)
Other (please describe):

Testing

Checklist

Required Checks

Documentation is updated (if applicable)
Files follow existing naming conventions
Changes are backwards compatible (if applicable)

Required Automated Checks

The following validation commands must pass before merging:

Markdown linting: npm run lint:md
Spell checking: npm run spell-check
Frontmatter validation: npm run lint:frontmatter
Link validation: npm run lint:md-links
PowerShell analysis: npm run lint:ps

Security Considerations

This PR does not contain any sensitive or NDA information
Any new dependencies have been reviewed for security issues
Security-related scripts follow the principle of least privilege

Additional Notes

…er launch

Copilot

Pull request overview

This PR enhances the devcontainer configuration to improve build performance and reliability, particularly for developers working behind corporate proxies with TLS inspection. The changes remove unused features (Python, Azure CLI), add volume mounts for better I/O performance, normalize the workspace path, and add support for corporate CA certificate injection and git identity configuration.

Key changes include:

Removal of unused Python and Azure CLI features to speed up container builds
Addition of volume mounts for node_modules and user config to improve performance
Implementation of corporate CA certificate injection for TLS inspection compatibility
Git config workaround to properly handle conditional includes in devcontainers

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
`.gitignore`	Adds gitconfig export files used by devcontainer git identity workaround
`.gitattributes`	Defines line ending rules for Windows and Linux scripts (has duplicate entry)
`.dockerignore`	Excludes `.git/` and `node_modules/` from Docker build context
`.devcontainer/scripts/post-create.sh`	Adds volume ownership fixes, npm install, and CA cert injection logic
`.devcontainer/scripts/post-attach.sh`	New script implementing git identity configuration workaround
`.devcontainer/devcontainer.json`	Configures workspace mount, volumes, environment variables, lifecycle commands (has JSON syntax error)
`.devcontainer/README.md`	Updates documentation to reflect removed features and add TLS troubleshooting

Comments suppressed due to low confidence (1)

.devcontainer/scripts/post-create.sh:44

Security concern: The CA certificate injection feature copies all .crt files from .devcontainer/ to the system trust store without validation. Consider adding validation to:

Verify the files are valid PEM-formatted certificates before copying
Add a warning message when certificates are being added
Document the security implications in comments

Example:

if compgen -G ".devcontainer/*.crt" > /dev/null; then
  echo "WARNING: Adding custom CA certificates to system trust store"
  # Validate certs before copying
  for cert in .devcontainer/*.crt; do
    if openssl x509 -in "$cert" -noout 2>/dev/null; then
      sudo cp "$cert" /usr/local/share/ca-certificates/
    else
      echo "ERROR: Invalid certificate file: $cert"
      exit 1
    fi
  done
  sudo update-ca-certificates
fi

  if compgen -G ".devcontainer/*.crt" > /dev/null; then
    sudo cp .devcontainer/*.crt /usr/local/share/ca-certificates/
    sudo update-ca-certificates
  fi
  echo "Container's system CA certificates updated successfully"

.devcontainer/scripts/post-create.sh

.devcontainer/scripts/post-attach.sh

.devcontainer/devcontainer.json

.devcontainer/scripts/post-attach.sh

.gitattributes

.devcontainer/devcontainer.json

.devcontainer/scripts/post-create.sh

Copilot · 2025-12-03T01:24:31Z

.devcontainer/scripts/post-create.sh

+  # Adds a root CA to the system certificate store. Useful if developer machines
+  # have MITM TLS inspection happening, e.g. with ZScaler.
+  echo "Updating container system CA certificates..."
+  if compgen -G ".devcontainer/*.crt" > /dev/null; then
+    sudo cp .devcontainer/*.crt /usr/local/share/ca-certificates/
+    sudo update-ca-certificates
+  fi
+  echo "Container's system CA certificates updated successfully"


The update_ca_certs function trusts any .crt file present in .devcontainer/ by copying it into the system CA store. This enables an attacker to commit a malicious root CA to the repo, causing the container to trust attacker-controlled TLS endpoints (e.g., for npm, pip, git), enabling MITM and credential/token theft. Restrict trusted CAs to a pre-approved, immutable source (e.g., mount a secure host-managed CA volume or require explicit opt-in via a verified checksum), and validate certificates before installation (e.g., whitelist filenames and verify SHA256).

Suggested change

# Adds a root CA to the system certificate store. Useful if developer machines

# have MITM TLS inspection happening, e.g. with ZScaler.

echo "Updating container system CA certificates..."

if compgen -G ".devcontainer/*.crt" > /dev/null; then

sudo cp .devcontainer/*.crt /usr/local/share/ca-certificates/

sudo update-ca-certificates

fi

echo "Container's system CA certificates updated successfully"

# Adds a root CA to the system certificate store, but only if it matches a pre-approved whitelist.

# This prevents malicious CAs from being trusted.

echo "Updating container system CA certificates..."

# Define whitelist: filename:sha256sum (add entries as needed)

declare -A CA_CERT_WHITELIST=(

# Example entry (replace with your actual cert and hash):

# ["my-org-root.crt"]="0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"

)

local found_valid=0

for certfile in .devcontainer/*.crt; do

if [[ ! -f "${certfile}" ]]; then

continue

fi

certname="$(basename "${certfile}")"

expected_hash="${CA_CERT_WHITELIST[${certname}]:-}"

if [[ -z "${expected_hash}" ]]; then

echo "WARNING: Skipping unapproved CA certificate: ${certname}"

continue

fi

actual_hash="$(sha256sum "${certfile}" | awk '{print $1}')"

if [[ "${actual_hash}" != "${expected_hash}" ]]; then

echo "WARNING: Hash mismatch for ${certname}, skipping."

continue

fi

echo "Installing approved CA certificate: ${certname}"

sudo cp "${certfile}" /usr/local/share/ca-certificates/

found_valid=1

done

if (( found_valid )); then

sudo update-ca-certificates

echo "Container's system CA certificates updated successfully"

else

echo "No valid CA certificates installed."

fi

@WilliamBerryiii thoughts? I'm inclined to consider this a non-risk, if an attacker has access to the repo they can do far worse damage by updating any of the initialization scripts for the dev container.

Would love perspective from @agreaves-ms on this ... I'm on the fence here (mainly because I'm on windows and mucking with the cert store can be a PITA if things go sideways).

Co-authored-by: Copilot <[email protected]>

Copilot

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (1)

.devcontainer/scripts/post-create.sh:42

Consider adding validation to check if the .crt files are valid PEM-formatted certificates before copying them to the system certificate store. Blindly copying arbitrary files with .crt extension could introduce security risks if the files are malformed or malicious. Add a basic validation check using openssl x509 -in "$file" -noout before copying.

  if compgen -G ".devcontainer/*.crt" > /dev/null; then
    sudo cp .devcontainer/*.crt /usr/local/share/ca-certificates/
    sudo update-ca-certificates

.devcontainer/devcontainer.json

.devcontainer/scripts/post-attach.sh

.devcontainer/devcontainer.json

Copilot

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 9 comments.

.devcontainer/scripts/post-create.sh

.devcontainer/scripts/post-attach.sh

.gitattributes

.devcontainer/scripts/post-create.sh

.gitattributes

Co-authored-by: Copilot <[email protected]>

Copilot

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 2 comments.

.devcontainer/scripts/post-attach.sh

Co-authored-by: Copilot <[email protected]>

Copilot

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 7 comments.

Copilot · 2025-12-03T21:04:17Z

.devcontainer/scripts/post-attach.sh

+  for conf in .gitconfig.global .gitconfig.local; do
+    if [[ -f "$conf" ]]; then
+      echo "*** Parsing ${conf##.gitconfig.} Git configuration export"
+      while IFS='=' read -r key value; do
+        local key value


The local keyword should be declared before the variable assignment in the while read loop. Move the local key value declaration outside and before the loop to avoid redeclaring on each iteration.

Suggested fix:

copy_user_gitconfig() { local key value for conf in .gitconfig.global .gitconfig.local; do if [[ -f "$conf" ]]; then echo "*** Parsing ${conf##.gitconfig.} Git configuration export" while IFS='=' read -r key value; do case "$key" in user.name | user.email | user.signingkey | commit.gpgsign) echo "Set Git config ${key}=${value}" git config --global "$key" "$value" ;; esac done < "$conf" rm -f "${conf}" fi done }

Suggested change

for conf in .gitconfig.global .gitconfig.local; do

if [[ -f "$conf" ]]; then

echo "*** Parsing ${conf##.gitconfig.} Git configuration export"

while IFS='=' read -r key value; do

local key value

local key value

for conf in .gitconfig.global .gitconfig.local; do

if [[ -f "$conf" ]]; then

echo "*** Parsing ${conf##.gitconfig.} Git configuration export"

while IFS='=' read -r key value; do

.devcontainer/scripts/post-create.sh

.devcontainer/scripts/post-attach.sh

.devcontainer/scripts/post-create.sh

.devcontainer/devcontainer.json

.devcontainer/scripts/post-attach.sh

.devcontainer/scripts/post-create.sh

stewartadam added 2 commits December 2, 2025 17:01

feat(devcontainer): improve performance and reliability of devcontain…

0873d9f

…er launch

feat(devcontainer): improve performance and reliability of devcontain…

e38bd50

…er launch

Copilot AI review requested due to automatic review settings December 3, 2025 01:19

Copilot started reviewing on behalf of stewartadam December 3, 2025 01:19 View session

Copilot finished reviewing on behalf of stewartadam December 3, 2025 01:22

Copilot AI reviewed Dec 3, 2025

View reviewed changes

Quote $USER in shell script

c60ad7c

Co-authored-by: Copilot <[email protected]>

Copilot AI review requested due to automatic review settings December 3, 2025 01:25

Copilot started reviewing on behalf of stewartadam December 3, 2025 01:25 View session

stewartadam and others added 2 commits December 2, 2025 17:25

Use braces for string with inline variable expansion

94232b2

Co-authored-by: Copilot <[email protected]>

Use braces for string with inline variable expansion

6345a4a

Co-authored-by: Copilot <[email protected]>

Copilot finished reviewing on behalf of stewartadam December 3, 2025 01:29

Copilot AI reviewed Dec 3, 2025

View reviewed changes

stewartadam added 4 commits December 2, 2025 17:32

ignore crt files dropped into .devcontainer folder

a8ce6c3

fix typos

8969f0d

apply shell suggestions

5e3bed2

fix sentence structure

0c050dc

Copilot AI review requested due to automatic review settings December 3, 2025 01:45

Copilot started reviewing on behalf of stewartadam December 3, 2025 01:46 View session

Copilot finished reviewing on behalf of stewartadam December 3, 2025 01:49

Copilot AI reviewed Dec 3, 2025

View reviewed changes

Apply suggestions from code review

fc010ee

Co-authored-by: Copilot <[email protected]>

Copilot AI review requested due to automatic review settings December 3, 2025 20:44

Copilot started reviewing on behalf of stewartadam December 3, 2025 20:45 View session

Copilot finished reviewing on behalf of stewartadam December 3, 2025 20:47

Copilot AI reviewed Dec 3, 2025

View reviewed changes

.devcontainer/scripts/post-attach.sh Outdated Show resolved Hide resolved

.devcontainer/scripts/post-attach.sh Show resolved Hide resolved

Apply suggestions from code review

8443b6f

Co-authored-by: Copilot <[email protected]>

Copilot AI review requested due to automatic review settings December 3, 2025 20:59

Copilot started reviewing on behalf of stewartadam December 3, 2025 21:00 View session

Copilot finished reviewing on behalf of stewartadam December 3, 2025 21:02

Copilot AI reviewed Dec 3, 2025

View reviewed changes

-  # Adds a root CA to the system certificate store. Useful if developer machines
-  # have MITM TLS inspection happening, e.g. with ZScaler.
-  echo "Updating container system CA certificates..."
-  if compgen -G ".devcontainer/*.crt" > /dev/null; then
-    sudo cp .devcontainer/*.crt /usr/local/share/ca-certificates/
-    sudo update-ca-certificates
-  fi
-  echo "Container's system CA certificates updated successfully"
+  # Adds a root CA to the system certificate store, but only if it matches a pre-approved whitelist.
+  # This prevents malicious CAs from being trusted.
+  echo "Updating container system CA certificates..."
+  # Define whitelist: filename:sha256sum (add entries as needed)
+  declare -A CA_CERT_WHITELIST=(
+    # Example entry (replace with your actual cert and hash):
+    # ["my-org-root.crt"]="0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+  )
+  local found_valid=0
+  for certfile in .devcontainer/*.crt; do
+    if [[ ! -f "${certfile}" ]]; then
+      continue
+    fi
+    certname="$(basename "${certfile}")"
+    expected_hash="${CA_CERT_WHITELIST[${certname}]:-}"
+    if [[ -z "${expected_hash}" ]]; then
+      echo "WARNING: Skipping unapproved CA certificate: ${certname}"
+      continue
+    fi
+    actual_hash="$(sha256sum "${certfile}" | awk '{print $1}')"
+    if [[ "${actual_hash}" != "${expected_hash}" ]]; then
+      echo "WARNING: Hash mismatch for ${certname}, skipping."
+      continue
+    fi
+    echo "Installing approved CA certificate: ${certname}"
+    sudo cp "${certfile}" /usr/local/share/ca-certificates/
+    found_valid=1
+  done
+  if (( found_valid )); then
+    sudo update-ca-certificates
+    echo "Container's system CA certificates updated successfully"
+  else
+    echo "No valid CA certificates installed."
+  fi

feat(devcontainer): improve performance and reliability of devcontainer launch #119

Are you sure you want to change the base?

feat(devcontainer): improve performance and reliability of devcontainer launch #119

Uh oh!

Conversation

stewartadam commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request

Description

Related Issue(s)

Type of Change

Testing

Checklist

Required Checks

Required Automated Checks

Security Considerations

Additional Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

stewartadam Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

WilliamBerryiii Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

stewartadam commented Dec 3, 2025 •

edited

Loading