How to set up a devcontainer together with a Docker entrypoint script?

[AngryMaciek]

I have asked this question on Stack Overflow but did not get any response yet:
https://stackoverflow.com/questions/78171886/how-to-set-up-a-devcontainer-together-with-a-docker-entrypoint-script

For completeness of information I will post the question body below too.

---

Background

I have a git repository with a Dockerfile inside as well as entrypoint.sh script.
It is set to build a development container with a non-root user, see a (minimal, simplified) example below:

Dockerfile:

FROM bitnami/minideb:bullseye
ENV LANG C.UTF-8
COPY entrypoint.sh /bin/entrypoint.sh
RUN /bin/bash -c "chmod +x /bin/entrypoint.sh"
ENTRYPOINT ["/bin/entrypoint.sh"]
CMD ["/bin/bash"]

Entrypoint:

#!/bin/bash

ID=${HOSTUID:-9001}
useradd --shell /bin/bash -u $ID -o -c "" -m user
export HOME=/home/user
exec /usr/sbin/gosu user "$@"

This works well on my local machine where I can build a container and then docker exec interactively a bash shell to operate/test inside with docker exec -it {NAME} bash,

Question

I have recently noticed a raise of the devcontainer standard which is used by GitHub Codespaces as well as DevPod and I wanted to add a devcontainer.json file to my repository so that I can start an in-browser VS Code instance which runs inside my container (based on the two files above).

My JSON configuration:

{

    "name": "dev",

    "build": {
        "dockerfile": "../Dockerfile"
    },

    "customizations": {
        "codespaces": {
            "openFiles": []
        }
    }

}

However, whenever I start a new instance of the development environment I can check in the terminal inside that I am still root, not user. I checked with cat /etc/passwd that the latter is not even created, which suggests to me that the entrypoint script was not executed.

Could someone please let me know how should I set up the devcontainer.json file so that the terminal inside the development environment is the same as when building the container manually?

PS:

All this is based on a public repo of mine: https://github.com/AngryMaciek/hypercomplex.
Feel free to fork it and test possible solutions yourselves with Codespaces.

[samruddhikhandale]

Hi 👋

I have recently noticed a raise of the devcontainer standard which is used by GitHub Codespaces as well as DevPod and I wanted to add a devcontainer.json file to my repository so that I can start an in-browser VS Code instance which runs inside my container (based on the two files above).

Super nice to hear this, a very warm welcome to "Dev Containers" 👋

However, whenever I start a new instance of the development environment I can check in the terminal inside that I am still root, not user. I checked with cat /etc/passwd that the latter is not even created, which suggests to me that the entrypoint script was not executed.

For the supporting tools like VS Code's Dev Container extension or GitHub Codespaces, the ENTRYPOINT scripts are run in the background. If the ENTRYPOINT script fails, it might not be immediately apparent, and the container might start up anyway, because the startup of the container is not directly dependent on the success of the ENTRYPOINT script (I believe this might be happening in your case). Also, because the ENTRYPOINT script is run in the background, the container might be ready and you might be able to start interacting with it before the ENTRYPOINT script has finished executing. This means that any changes made by the ENTRYPOINT script might not be immediately visible when you start interacting with the container.

Hence, when using a dev container, we recommend using lifecycle hooks instead of an ENTRYPOINT script. Learn more about it at https://containers.dev/implementors/json_reference/#lifecycle-scripts to find which one will be suitable in your case. If you use a lifecycle hook, you will also avoid copying over entrypoint.sh file.

Are you familiar with dev container Features? They will be very handy looking at the config in https://github.com/AngryMaciek/hypercomplex. Read more at https://containers.dev/implementors/features/

Let us know if anything is unclear or if you are still facing issues, happy to dig deeper in your dev container config and help fix the issue for you.

[chrmarti]

I agree, some more details: The entrypoint is overridden by default, you can use "overrideCommand": false in the devcontainer.json to run it, but you then also need to make sure that the container stays up (e.g., with sleep inf at the end of the entrypoint script). You can use "remoteUser": "user" to let Codespaces use this user, though that leaves the possibility of a race condition when the entrypoint takes a bit longer to create the user.

It might be easier to create the user as part of the image using the Dockerfile. If you are on Linux that user's UID and GID will be updated to those of the local user before the container is started (looking at the HOSTUID variable you are using). If that user is not the container's default user, you again need "remoteUser": "user" in the devcontainer.json to make use of it.

[samruddhikhandale]

It might be easier to create the user as part of the image using the Dockerfile. If you are on Linux that user's UID and GID will be updated to those of the local user before the container is started (looking at the HOSTUID variable you are using). If that user is not the container's default user, you again need "remoteUser": "user" in the devcontainer.json to make use of it.

+1 On a side note, common-utils Feature is also another simpler way to create a new user.

[jankogasic]

Hello @chrmarti and @samruddhikhandale ,

I will ask my question on this thread since I think it is highly similar.

I have set "overrideCommand": false since I want my ENTRYPOINT to be executed. Is there a way to specify sleep infinity inside devcontainer.json instead of adding it to Dockerfile as CMD ["sleep", "infinity"]? Maybe I can achieve this by using some of the Lifecycle scripts?

[chrmarti]

The command can only be passed to Docker with docker run and there is currently no way to specify this in the devcontainer.json.