Provide a way to map in host certificate store(s) to started devcontainers

未關閉
  • 哪裡不對？
#1,334 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

評估

難度
5/5
預估耗時
一週以上
新手友好度
35/100
Issue 類型
功能
描述清晰度
基本清楚
活躍度
活躍
技術堆疊
docker, typescript
領域
devtools, infrastructure

研究方向

Start by reading the CLI entry points and build and up flows that handle image builds and container startup. The issue describes host certificate injection during both flows, including temporary mounts, live updates, host store selection, and support for common container distributions. Done means an approach is defined for these cases and certificates are available in the target container's standard store.

由索引模型根據 Issue 內容生成。

描述

Inspired by the recent 8 compromised intermediate certificates, I would like a way to mount my host's certificate stores into any images started with devcontainer up, or built with devcontainer build.

The fundamental problem is that outgoing network traffic in a devcontainer relies on certificates baked into the container. Depending on the particular definition, this could be quite old, and if the container was prebuilt by another part, not in the developer's control. This also causes some difficulties with things like MitM interceptors in corporate settings, where certificates are often present on the host, but for obvious reasons not present in standard certificate stores.

  • Injection during devcontainer build is necessary to account for dynamic feature build, as otherwise features need to use certificates already present in lower layers in the container. The common-utils feature does install the common platform root certificates, and it's possible to write a custom install-first feature for things like MitM roots, but both of these generally end up baking the certificates into the root image, which is precisely the problem. Injecting the certificates during build alleviates both of these issues. Note that these certificates would be intended to be some form of temporary mount, to prevent baking them into the image.
  • Injection during devcontainer up would be necessary to provide "live" certificate updates.

I'd prefer some way to do one or all of the following;

  • If no options are specified, inject all root certificates from the host standard store into the container.
  • A way to specify a particular host store. On linux this would probably be automatic via standard OpenSSL environment variables, but on Windows this would probably be one of the special store names.
  • A way to supply one or more certificate bundle names/paths.

It would be anticipated that the certificates would be placed in the in-container OS's standard certificate store; or, for the more common base distros, at least. These are well-known locations, and generally have ways to add user-supplied certificates outside of the distro-provided root certificates.

主要語言
TypeScript
星號
3k
分支
473
平均合併
10 小時 31 分鐘
30 天內合併 PR
9

環境準備

在 Codespaces 中開啟

在瀏覽器裡用你自己的 GitHub 帳號啟動這個專案的開發容器。

  • 沒有 Dockerfile 或 Docker Compose 檔案
  • 沒有 Pull Request 範本
  • 閱讀貢獻指南

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

devcontainers/cli 的其他 Issue

查看 devcontainers/cli 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。