From 6a2d5b7f32b4f6695e4931cbf3e0de354df9657a Mon Sep 17 00:00:00 2001 From: Kai Schwarz Date: Tue, 8 Sep 2026 16:55:57 +0200 Subject: [PATCH] ci(devcontainer): mount the history file, not the host home MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The frame mounted ${localEnv:HOME} at /WSL_USER to reach one file inside it, ~/.zsh_history. That granted the container read-write reach over the host's SSH keys, shell profiles and every other repository on the machine as a side effect of wanting one history file. In the workspace repository the same pattern made the readonly flag on its GitHub token directory decorative — the same inodes were writable by the second path, verified by inode before the fix. That is what makes this a fleet-wide change (RSRMID-3052) rather than a per-repository tidy-up. Bind the single file at the same path instead, with a touch in initializeCommand so Docker cannot create a directory where the file belongs — on the host, where it would outlive the container. Recorded in the comment while narrowing it: nothing here currently reads that path. post-create.sh says symlinking ~/.zsh_history out of /WSL_USER "is devbase's job now", but this frame never lists the devbase Feature, so nothing does it — the script stopped and the Feature never started, which means this repository has no shell-history persistence at all today. Not fixed here: completing that migration is its own change, and this commit deliberately only stops the mount being wider than it needs to be. Also drops the GitHub.copilot extension, deprecated for us since the team works with Claude; anthropic.claude-code stays. Unrelated to the mount change, kept in the same commit only because it edits the same few lines of the same file. --- .devcontainer/devcontainer.json | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 6d4230e..d5ff0eb 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -14,7 +14,6 @@ "mrmlnc.vscode-apache", "ms-azuretools.vscode-docker", "eamodio.gitlens", - "GitHub.copilot", "bmewburn.vscode-intelephense-client", "anthropic.claude-code" ], @@ -29,8 +28,20 @@ } }, "remoteUser": "vscode", + // The history bind below names a *file*, and Docker creates a missing bind source + // itself, as a directory on the host, where it outlives the container. + "initializeCommand": "touch ${localEnv:HOME}/.zsh_history", + // Narrowed from a mount of the whole host home at /WSL_USER, which handed this + // container read-write reach over the host's SSH keys, credentials and every other + // repository on the machine in order to reach one history file. (RSRMID-3052) + // + // Be aware that path currently feeds nothing here. post-create.sh says symlinking + // ~/.zsh_history out of /WSL_USER "is devbase's job now", but this frame never + // lists the devbase Feature, so nothing does it: the script stopped and the Feature + // never started. Completing that migration is a separate change; this one only + // stops the mount being wider than it needs to be. "mounts": [ - "source=${localEnv:HOME}${localEnv:USERPROFILE},target=/WSL_USER,type=bind,consistency=cached" + "source=${localEnv:HOME}/.zsh_history,target=/WSL_USER/.zsh_history,type=bind,consistency=cached" ], "features": { "ghcr.io/devcontainers/features/node:1": {