Succesfully enabled devcontainer support using sandboxing

[francoism90]

This is a different approach as seen in #342.

I have created https://github.com/francoism90/org.freedesktop.Sdk.Extension.podman, that allows easy integration into any IDE (like Zed/Zed Preview, but also VSCode) without having to escape the sandbox and installing multiple SDKs.

Instructions can be found at https://github.com/francoism90/org.freedesktop.Sdk.Extension.podman#zed--zed-preview.

I tried making this upstream available (flathub/flathub#8677), but I've given up in doing so. Instead, you can install the SDK using my repo, or build it yourself (which is also very easy).

[francoism90]

This is my devcontainer.json:

{
  "name": "my-devcontainer",
  "containerUser": "docker",
  "containerEnv": {
    "HOME": "/home/docker",
    "CONTAINER_ROLE": "shell",
  },
  "runArgs": ["--userns=keep-id", "--security-opt=label=disable", "--init"],
  "build": {
    "context": "./../",
    "dockerfile": "./../containers/Containerfile",
    "target": "development",
    "args": {
      "UID": "1000", // Replace with your desired UID (id -u)
      "GID": "1000", // Replace with your desired GID (id -g)
    },
  },
}

[lesterespiritu-a]

I was about to create a post for this workaround, can confirm it on my end as well.

Though, I just placed a wrapper to the host podman on one of the directories in PATH env, along with ZED_FLATPAK_NO_ESCAPE=1.

[francoism90]

@lesterespiritu-a Can you post the wrapper? Because I assume you do a host-spawn? With this approach it should not escape the sandbox.

[lesterespiritu-a]

@lesterespiritu-a Can you post the wrapper? Because I assume you do a host-spawn? With this approach it should not escape the sandbox.

Unfortunately, I am using flatpak-spawn --host. I have spoken before with the DevPod team about introducing a common podman extension which could resolve my setup as well as others, but I have been busy.

[francoism90]

@lesterespiritu-a No worries. You could give my approach a try and report back. :)

[lesterespiritu-a]

I have incorporated it minimally with my devpod setup idea.

Two extensions holding the clis devpod and podman-remote respectively:
org.freedesktop.Sdk.Extension.devpod
org.freedesktop.Sdk.Extension.podman

Applied to both Zed IDE and DevPod Desktop:
--filesystem=xdg-run/podman
--env=FLATPAK_ENABLE_SDK_EXT=devpod,podman

With a minimal test devcontainer configured as follows:

{
  "name": "Test",
  "image": "mcr.microsoft.com/devcontainers/base:2.1-jammy",
  "securityOpt": ["label=disable"],
  "runArgs": ["--userns=keep-id"],
}

It just works.

[francoism90]

@lesterespiritu-a Good work! Both should be upstream, but I'm not interested. I don't think Flathub is that friendly and open for PRs.

[Pioneer-1-1]

This has been open in #342 for about two months.

The guy/gal who runs this repo appears to be very good at updating for each new version of zed but to ignore practically everything else.

[francoism90]

@Pioneer-1-1 That's a very different approach compared to this one.

[francoism90]

I have updated the instructions, you can now set PODMAN_FLATPAK_FORCE_REMOTE=1 as env, which will intercept podman requests and send them to podman instead.