ci(devcontainer): mount the history file, not the host home - #372
Merged
Conversation
The frame mounted ${localEnv:HOME} at /WSL_USER to reach one file inside it,
~/.zsh_history, which post-create.sh symlinks into place. That granted the
container read-write reach over the host's SSH keys, shell profiles and every
other repository on the machine as a side effect of wanting one history file.
In the workspace repository the same pattern made the readonly flag on its
GitHub token directory decorative — the same inodes were writable by the second
path, verified by inode before the fix. That is what makes this a fleet-wide
change (RSRMID-3052) rather than a per-repository tidy-up.
Bind the single file at the same path instead. post-create.sh is unchanged and
still does the linking: this repository is **not** on the shared devbase Feature,
so that script is what makes history persist here, and removing it would have
silently ended history persistence rather than tidied anything.
A single-file bind needs the host file to exist first, so initializeCommand
touches it. Without that, Docker creates the missing source as a directory — on
the host, where it outlives the container — and the symlink then points at a
directory that zsh cannot write to. initializeCommand is the only place that can
run before the container exists, which is why the touch cannot live in
post-create.sh.
Also drops the GitHub.copilot extension, deprecated for us since the team works
with Claude; anthropic.claude-code stays. Unrelated to the mount change, kept in
the same commit only because it edits the same few lines of the same file.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of RSRMID-3052 — a fleet-wide fix. This frame mounted
${localEnv:HOME}at/WSL_USERto reach one file inside it,~/.zsh_history, whichpost-create.shsymlinks into place. That granted the container read-write reach over the host's SSH keys, shell profiles and every other repository on the machine, as a side effect of wanting one history file.Why this is more than untidy
In the workspace repository the same pattern made the
readonlyflag on its GitHub token directory decorative — the same inodes were reachable read-write by the second path. Verified there by inode before the fix:Same inode: readonly by one route, writable by the other. That workspace fix is merged and verified after a rebuild — no host-home mount remains and writes to the token directory now fail.
What changed here, and what deliberately did not
The bind names the single file, at the same path as before.
post-create.shis untouched and still does the linking. This repository is not on the shareddevbaseFeature, so that script is the only thing making history persist here. An earlier read of this sweep treated those legacy symlinks as leftovers worth removing — that was wrong, and removing it would have silently ended history persistence rather than tidying anything.initializeCommandis added purely totouch ~/.zsh_history. A single-file bind needs the host file to exist first; without it Docker creates the missing source as a directory, on the host, where it outlives the container, and the symlink then points at a directory zsh cannot write to.initializeCommandis the only hook that runs before the container exists, which is why this cannot live inpost-create.sh.