4901 devcontainer does not build when behind an ssl proxy#4982
Draft
ChrisChapman-gh wants to merge 9 commits into
Draft
4901 devcontainer does not build when behind an ssl proxy#4982ChrisChapman-gh wants to merge 9 commits into
ChrisChapman-gh wants to merge 9 commits into
Conversation
…orm options in devcontainer.json
…_EXTRA_CA_CERTS environment variable
…orm options in devcontainer.json
…_EXTRA_CA_CERTS environment variable
…ing and updating Dockerfile arguments
…xy' of https://github.com/microsoft/AzureTRE into 4901-devcontainer-does-not-build-when-behind-an-ssl-proxy
ChrisChapman-gh
added
feature
dependencies
Unit Test Results0 tests 0 ✅ 0s ⏱️ Results for commit 05bbd41. |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses devcontainer usability behind SSL-intercepting proxies by adding a mechanism to trust user-provided root CAs during devcontainer build and during subsequent Docker/Porter builds executed from within the devcontainer. It also updates the devcontainer to mount a local .codex directory into the container.
Changes:
- Add a
/.devcontainer/trusted_cadrop-folder and install any provided CA certs into the devcontainer’s trusted store during devcontainer image build. - Ephemerally patch Dockerfiles/Porter Dockerfile templates during builds in the devcontainer to inject the devcontainer-trusted CAs via BuildKit build contexts.
- Mount
~/.codexinto the devcontainer and create the folder on initialization.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| Makefile | Injects devcontainer CA build-context and Dockerfile patching into image build flow; adds CA patch step before porter publish. |
| docs/tre-admins/setup-instructions/prerequisites.md | Documents how to use /.devcontainer/trusted_ca when behind an SSL proxy. |
| devops/scripts/porter_devcontainer_ca.sh | New helper to patch Porter bundle Dockerfile templates to inject trusted CAs during builds in the devcontainer. |
| devops/scripts/porter_build_bundle.sh | Adds devcontainer CA patching and passes build-context args to porter build. |
| devops/scripts/docker_devcontainer_ca.sh | New helper to patch generic Dockerfiles (multi-stage aware) to inject trusted CAs during devcontainer builds. |
| devops/scripts/bundle_runtime_image_build.sh | Applies Docker devcontainer CA patching and forwards build-context args to docker build. |
| CHANGELOG.md | Adds an enhancement entry for trusted CA support in devcontainer-driven builds. |
| .devcontainer/trusted_ca/.gitignore | Adds an always-present, gitignored folder intended to hold untracked CA cert files. |
| .devcontainer/scripts/initialize.cmd | Ensures ~/.codex exists on Windows hosts. |
| .devcontainer/scripts/initialize | Ensures ~/.codex exists on Linux/macOS hosts. |
| .devcontainer/Dockerfile | Installs any provided trusted CAs into the devcontainer and sets related CA environment variables. |
| .devcontainer/devcontainer.json | Adds .codex mount and forces linux/amd64 platform for build/run. |
Comment on lines
+93
to
+97
| trusted_ca_source="${MAKEFILE_DIR}/.devcontainer/trusted_ca"; \ | ||
| dockerfile=$(3); \ | ||
| if [ ! -f "$${dockerfile}" ]; then echo "Unable to find Dockerfile $${dockerfile}" >&2; exit 1; fi; \ | ||
| if [ ! -d "$${trusted_ca_source}" ]; then echo "Unable to find trusted CA directory $${trusted_ca_source}" >&2; exit 1; fi; \ | ||
| if ! find "$${trusted_ca_source}" -maxdepth 1 -type f \( -name '*.crt' -o -name '*.pem' -o -name '*.cer' \) -print -quit | grep -q .; then echo "No .crt, .pem, or .cer files found in $${trusted_ca_source}" >&2; exit 1; fi; \ |
Comment on lines
+54
to
+57
| if ! find "${trusted_ca_source}" -maxdepth 1 -type f \( -name '*.crt' -o -name '*.pem' -o -name '*.cer' \) -print -quit | grep -q .; then | ||
| echo "No .crt, .pem, or .cer files found in ${trusted_ca_source}" >&2 | ||
| return 1 | ||
| fi |
Comment on lines
+49
to
+52
| if ! find "${trusted_ca_source}" -maxdepth 1 -type f \( -name '*.crt' -o -name '*.pem' -o -name '*.cer' \) -print -quit | grep -q .; then | ||
| echo "No .crt, .pem, or .cer files found in ${trusted_ca_source}" >&2 | ||
| return 1 | ||
| fi |
| * Update dependencies to address Dependabot security alerts: `aiohttp` to 3.14.1, `Pygments` to 2.20.0, `esbuild`, `ws`, `js-yaml`, `@babel/core`, `flatted` (via vitest upgrade), and `react-router-dom`. ([#4950](https://github.com/microsoft/AzureTRE/issues/4950)) | ||
| * Added support for formatting UI code via `pre-commit` and fixed existing formatting issues. ([#4955](https://github.com/microsoft/AzureTRE/issues/4955)) | ||
| * Updated the version of `super-linter` used in the `build_validation_develop` workflow ([#4957](https://github.com/microsoft/AzureTRE/issues/4957)) | ||
| * Add trusted CA support for devcontainer image builds and Porter bundle build and publish workflows. |
Comment on lines
+12
to
+14
| "options": [ | ||
| "--platform=linux/amd64" | ||
| ], |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #4901
What is being addressed
TRE will not deploy when behind an SSL proxy as they uses internal SSL certificates to sign all requests and the CA is not available to either the devcontainer image or any of the subsequent docker builds.
The devcontainer has also been updated to allow local codex folder to be mounted in the vscode home folder.
How is this addressed
Dev Container
Added a folder where untracked CA files can be dropped, they will be added to the devcontainer's trusted CAs when it is built.
Docker files and porter
The Makefile and devops scripts have been patched so that each Dockerfile/Dockerfile.tmpl is configured to include the CA files from the devcontainers trusted_ca folder.
The patch only kicks in if running inside the devcontainer.
The patch is ephemeral and the Dockerfiles are reverted once finished with. (no long term changes to the Dockerfiles)
The patched CA trust should only persist for the duration of the docker build process and are not used by or present in the final container image.