构建脚本准备

.env

@@ -1 +0,0 @@
-COMPOSE_PROJECT_NAME=devcontainers

authorized_keys

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEXPddCUCbsAShg6+21q/MIvFM27xlqVr+Yg3MoHqUZp

build.sh

@@ -1,29 +1,30 @@
 #!/bin/bash
 
-set -e
-
 export REGISTRY=registry.yqxpro.com
 
 pushd common-base
 npx devcontainer build \
 			--platform linux/amd64,linux/arm64 \
-			--image-name ${REGISTRY}/devcontainers/common-base --push \
+			--image-name ${REGISTRY}/devcontainers/common-base \
 			--cache-to type=registry,ref=${REGISTRY}/devcontainers/common-base:buildcache,mode=max \
-			--cache-from type=registry,ref=${REGISTRY}/devcontainers/common-base:buildcache
+			--cache-from type=registry,ref=${REGISTRY}/devcontainers/common-base:buildcache && \
+		docker push ${REGISTRY}/devcontainers/common-base &&\
 popd
 
 pushd develop-base
 npx devcontainer build \
 			--platform linux/amd64,linux/arm64 \
-			--image-name ${REGISTRY}/devcontainers/develop-base --push \
-			--cache-to type=registry,ref=${REGISTRY}/devcontainers/develop-base:buildcache,mode=max \
-			--cache-from type=registry,ref=${REGISTRY}/devcontainers/develop-base:buildcache
+			--image-name ${REGISTRY}/devcontainers/develop-base \
+			--cache-to type=local,ref=${REGISTRY}/devcontainers/develop-base,mode=max \
+			--cache-from type=local,ref=${REGISTRY}/devcontainers/develop-base && \
+		docker push ${REGISTRY}/devcontainers/develop-base &&\
 popd
 
 pushd universal-base
 npx devcontainer build \
 			--platform linux/amd64,linux/arm64 \
-			--image-name ${REGISTRY}/devcontainers/universal-base --push \
-			--cache-to type=registry,ref=${REGISTRY}/devcontainers/universal-base:buildcache,mode=max \
-			--cache-from type=registry,ref=${REGISTRY}/devcontainers/universal-base:buildcache
+			--image-name ${REGISTRY}/devcontainers/universal-base \
+			--cache-to type=local,dest=${HOME}/docker-buildcache/devcontainers/universal-base,mode=max \
+			--cache-from type=local,src=${HOME}/docker-buildcache/devcontainers/universal-base && \
+		docker push ${REGISTRY}/devcontainers/universal-base &&\
 popd

build/build-image.sh

@@ -1,37 +0,0 @@
-#!/bin/bash
-set -eux
-
-export BUILDX_BUILDER=hk-builder
-
-export REGISTRY="registry.yqxpro.com"
-
-export S3_ENDPOINT_URL=https://oss-cn-hongkong-internal.aliyuncs.com
-export S3_REGION=cn-hongkong
-export S3_BUCKET=hk-builder-cache-yqxpro
-export S3_ACCESSKEY=LTAI5t8AtjWfsqQWYnyBeCjH
-export S3_SECRETKEY=UPKF20AmcW2zB5BwAMIQeQgZeTkMEs
-export S3_CONFIG=endpoint_url=${S3_ENDPOINT_URL},region=${S3_REGION},bucket=${S3_BUCKET},access_key_id=${S3_ACCESSKEY},secret_access_key=${S3_SECRETKEY}
-
-build() {
-  local target="$1"
-
-  echo "Build $target started"
-
-  pushd $target
-  npx devcontainer build \
-			--platform linux/amd64,linux/arm64 \
-			--image-name ${REGISTRY}/devcontainers/$target --push \
-	    --cache-to type=s3,${S3_CONFIG},prefix=$target/,mode=max \
-			--cache-from type=s3,${S3_CONFIG},prefix=$target/
-  popd
-
-  echo "Build $target completed"
-}
-
-main() {
-  for target in "$@"; do
-    build "$target"
-  done
-}
-
-main "$@"

build/builder-setup.sh

@@ -1,10 +0,0 @@
-#!/bin/bash
-set -eux
-
-export TARGET_USER=ecs-user
-export REGISTRY_IP=172.22.178.82
-
-curl -fsSL https://raw.githubusercontent.com/docker/docker-install/master/install.sh | sh
-sudo usermod -aG docker $TARGET_USER
-
-echo "$REGISTRY_IP registry.yqxpro.com" | sudo tee -a /etc/hosts

build/host-setup.sh

@@ -1,19 +0,0 @@
-#!/bin/bash
-set -eux
-
-# SSH 配置中先准备好 hk-builder-linux-arm64 和 hk-builder-linux-amd64
-docker buildx create \
-  --name hk-builder \
-  --driver docker-container \
-  --driver-opt network=host \
-  --platform linux/amd64 \
-  --node hk-builder-linux-amd64 \
-  ssh://hk-builder-linux-amd64
-docker buildx create \
-  --name hk-builder \
-  --driver docker-container \
-  --driver-opt network=host \
-  --platform linux/arm64 \
-  --append \
-  --node hk-builder-linux-arm64 \
-  ssh://hk-builder-linux-arm64

build/publish-image.sh

@@ -1,36 +0,0 @@
-#!/bin/bash
-set -eux
-
-export REGISTRY=registry.yqxpro.com
-export REGISTRY_PUBLISH=crpi-kbfsbvlqwt19zxum-vpc.cn-hongkong.personal.cr.aliyuncs.com/registry-yqxpro
-export TAG=$(git rev-parse --short HEAD)
-
-sudo apt update
-sudo apt install -y skopeo
-
-docker login $REGISTRY_PUBLISH
-
-skopeo copy --all \
-  docker://${REGISTRY}/devcontainers/common-base:latest \
-  docker://${REGISTRY_PUBLISH}/devcontainers-common-base:latest
-skopeo copy --all \
-  docker://${REGISTRY}/devcontainers/common-base:latest \
-  docker://${REGISTRY_PUBLISH}/devcontainers-common-base:${TAG}
-
-skopeo copy --all \
-  docker://${REGISTRY}/devcontainers/develop-base:latest \
-  docker://${REGISTRY_PUBLISH}/devcontainers-develop-base:latest
-skopeo copy --all \
-  docker://${REGISTRY}/devcontainers/develop-base:latest \
-  docker://${REGISTRY_PUBLISH}/devcontainers-develop-base:${TAG}
-
-skopeo copy --all \
-  docker://${REGISTRY}/devcontainers/universal-base:latest \
-  docker://${REGISTRY_PUBLISH}/devcontainers-universal-base:latest
-skopeo copy --all \
-  docker://${REGISTRY}/devcontainers/universal-base:latest \
-  docker://${REGISTRY_PUBLISH}/devcontainers-universal-base:${TAG}
-
-skopeo copy --all \
-  docker://${REGISTRY}/devcontainers/universal-base:latest \
-  oci-archive:devcontainers-universal-base.tar

build/registry-setup.sh

@@ -1,13 +0,0 @@
-#!/bin/bash
-set -eux
-
-tar xvzf certs.tgz
-docker run -d \
-  --restart=always \
-  --name registry \
-  -v "$(pwd)"/certs:/certs \
-  -e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
-  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.yqxpro.com.crt \
-  -e REGISTRY_HTTP_TLS_KEY=/certs/registry.yqxpro.com.key \
-  -p 443:443 \
-  registry:3

combined-init.sh

@@ -1,13 +0,0 @@
-#!/bin/bash
-set -eux
-
-/usr/local/share/desktop-init.sh echo "Desktop initialization complete"
-/usr/local/share/docker-init.sh echo "Docker initialization complete"
-/usr/local/share/ssh-init.sh echo "SSH initialization complete"
-
-# exposed ports
-# 5901 VNC
-# 6080 noVNC
-# 2222 SSH
-
-exec "$@"

common-base/.devcontainer/devcontainer.json

@@ -8,6 +8,7 @@
       "username": "codespace",
       "userUid": "1000",
       "userGid": "1000",
+      "configureZshAsDefaultShell": true,
     },
     "ghcr.io/devcontainers/features/sshd:1": {
       "gatewayPorts": "yes",

docker-compose.yml

@@ -1,33 +0,0 @@
-services:
-  dev-server:
-    image: registry.yqxpro.com/devcontainers/universal-base:latest
-    privileged: true
-    restart: always
-    ports:
-      - 2222:2222
-      - 6080:6080
-    volumes:
-      # environment
-      - ${PWD}/authorized_keys:/home/codespace/.ssh/authorized_keys
-      - ${PWD}/combined-init.sh:/usr/local/share/combined-init.sh
-      - ${PWD}/once-init.sh:/usr/local/share/once-init.sh
-      # workspace
-      - workspace:/workspace
-      # cache
-      - dev-server-maven-cache:/home/codespace/.m2/repository
-      - dev-server-docker-cache:/var/lib/docker
-      - dev-server-apt-cache:/var/cache/apt
-      - dev-server-vscode-cache:/home/codespace/.vscode-server
-      - dev-server-zed-cache:/home/codespace/.zed_server
-    entrypoint: /usr/local/share/combined-init.sh
-    command: sleep infinity
-
-volumes:
-  workspace:
-    name: dev-server-workspace
-    external: true
-  dev-server-maven-cache:
-  dev-server-docker-cache:
-  dev-server-apt-cache:
-  dev-server-vscode-cache:
-  dev-server-zed-cache:

once-init.sh

@@ -1,36 +0,0 @@
-#!/bin/bash
-set -eux
-
-# use VNC DISPLAY by default
-echo "export DISPLAY=:1.0" >> /etc/profile.d/00-restore-env.sh
-
-mkdir -pv /home/codespace/.cargo
-cat > /home/codespace/.cargo/config.toml << EOF
-[source.crates-io]
-replace-with = 'aliyun'
-
-[source.mirror]
-registry = "sparse+https://mirrors.tuna.tsinghua.edu.cn/crates.io-index/"
-
-[source.aliyun]
-registry = "sparse+https://mirrors.aliyun.com/crates.io-index/"
-
-#[registries.mirror]
-#index = "sparse+https://mirrors.tuna.tsinghua.edu.cn/crates.io-index/"
-EOF
-
-# fix permissions
-chown -R codespace:codespace /workspace
-chown -R codespace:codespace /home/codespace/
-chmod 700 /home/codespace/.ssh
-chmod 600 /home/codespace/.ssh/authorized_keys
-
-# configuration
-sudo -u codespace git config --global user.email "me@yqxpro.com"
-sudo -u codespace git config --global user.name "QXYang686"
-
-sudo -u codespace npm config set registry https://registry.npmmirror.com
-
-
-
-sudo -u codespace ln -snf /workspace/dev-server /home/codespace/Projects

system-setup.sh

@@ -4,10 +4,8 @@ sudo apt update
 sudo apt install -y npm git
 curl -fsSL https://raw.githubusercontent.com/docker/docker-install/master/install.sh | sh
 sudo usermod -aG docker $USER
-docker buildx create --use --bootstrap --name multiarch-builder --driver-opt network=host
-echo "127.0.0.1 registry.yqxpro.com" | sudo tee -a /etc/hosts
+docker buildx create --use --name multiarch-builder
 
-tar xvzf certs.tgz
 docker run -d \
   --restart=always \
   --name registry \

universal-base/.devcontaiener/Dockerfile

@@ -0,0 +1 @@
+FROM registry.yqxpro.com/devcontainers/develop-base

universal-base/.devcontainer/devcontainer.json

@@ -11,10 +11,14 @@
     "./local-features/nvs": "latest",
     "ghcr.io/devcontainers/features/python:1": {
       "version": "3.12.1",
+      "additionalVersions": "3.11.9",
       "installJupyterlab": "true",
       "configureJupyterlabAllowOrigin": "*",
+      "useOryxIfAvailable": "false",
     },
+    "./local-features/patch-python": {},
     "ghcr.io/devcontainers/features/anaconda:1": {},
+    "./local-features/patch-conda": {},
     "ghcr.io/devcontainers/features/java:1": {
       "jdkDistro": "tem",
       "version": "21",

universal-base/.devcontainer/local-features/patch-conda/devcontainer-feature.json

@@ -0,0 +1,5 @@
+{
+  "id": "patch-conda",
+  "name": "Patch Conda Packages",
+  "installsAfter": ["ghcr.io/devcontainers/features/anaconda"]
+}

universal-base/.devcontainer/local-features/patch-conda/install.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+#-------------------------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
+#-------------------------------------------------------------------------------------------------------------
+
+USERNAME=${USERNAME:-"codespace"}
+
+set -eux
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
+    exit 1
+fi
+
+# Ensure that login shells get the correct path if the user updated the PATH using ENV.
+rm -f /etc/profile.d/00-restore-env.sh
+echo "export PATH=${PATH//$(sh -lc 'echo $PATH')/\$PATH}" > /etc/profile.d/00-restore-env.sh
+chmod +x /etc/profile.d/00-restore-env.sh
+
+export DEBIAN_FRONTEND=noninteractive
+
+sudo_if() {
+    COMMAND="$*"
+    if [ "$(id -u)" -eq 0 ] && [ "$USERNAME" != "root" ]; then
+        su - "$USERNAME" -c "$COMMAND"
+    else
+        "$COMMAND"
+    fi
+}
+
+update_python_package() {
+    PYTHON_PATH=$1
+    PACKAGE=$2
+    VERSION=$3
+
+    sudo_if "$PYTHON_PATH -m pip uninstall --yes $PACKAGE"
+    sudo_if "$PYTHON_PATH -m pip install --upgrade --no-cache-dir $PACKAGE==$VERSION"
+    sudo_if "$PYTHON_PATH -m pip show --no-python-version-warning $PACKAGE"
+}
+
+update_conda_package() {
+    PACKAGE=$1
+    VERSION=$2
+
+    sudo_if "conda install -y -c defaults $PACKAGE=$VERSION"
+}
+
+sudo_if /opt/conda/bin/python3 -m pip install --upgrade pip
+
+# Temporary: Upgrade python packages due to security vulnerabilities
+# They are installed by the conda feature and Conda distribution does not have the patches
+
+# https://github.com/advisories/GHSA-79v4-65xg-pq4g
+update_python_package /opt/conda/bin/python3 cryptography "44.0.1"
+
+update_conda_package pyopenssl "25.0.0"
+
+# https://github.com/advisories/GHSA-9hjg-9r4m-mvj7
+update_conda_package requests "2.32.4"
+
+# https://github.com/advisories/GHSA-5rjg-fvgr-3xxf
+update_conda_package setuptools "78.1.1"
+
+# https://github.com/advisories/GHSA-g7vv-2v7x-gj9p
+update_python_package /opt/conda/bin/python3 tqdm "4.66.3"
+
+# https://github.com/advisories/GHSA-38jv-5279-wg99
+update_conda_package urllib3 "2.6.3"
+
+# https://nvd.nist.gov/vuln/detail/CVE-2025-6176
+update_conda_package brotli "1.2.0"

universal-base/.devcontainer/local-features/patch-python/devcontainer-feature.json

@@ -0,0 +1,5 @@
+{
+  "id": "patch-python",
+  "name": "Patch Python Packages",
+  "installsAfter": ["ghcr.io/devcontainers/features/python"]
+}

universal-base/.devcontainer/local-features/patch-python/install.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+#-------------------------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
+#-------------------------------------------------------------------------------------------------------------
+
+USERNAME=${USERNAME:-"codespace"}
+
+set -eux
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
+    exit 1
+fi
+
+# Ensure that login shells get the correct path if the user updated the PATH using ENV.
+rm -f /etc/profile.d/00-restore-env.sh
+echo "export PATH=${PATH//$(sh -lc 'echo $PATH')/\$PATH}" > /etc/profile.d/00-restore-env.sh
+chmod +x /etc/profile.d/00-restore-env.sh
+
+export DEBIAN_FRONTEND=noninteractive
+
+sudo_if() {
+    COMMAND="$*"
+    if [ "$(id -u)" -eq 0 ] && [ "$USERNAME" != "root" ]; then
+        su - "$USERNAME" -c "$COMMAND"
+    else
+        "$COMMAND"
+    fi
+}
+
+update_package() {
+    PYTHON_PATH=$1
+    PACKAGE=$2
+    VERSION=$3
+
+    sudo_if "$PYTHON_PATH -m pip uninstall --yes $PACKAGE"
+    sudo_if "$PYTHON_PATH -m pip install --upgrade --no-cache-dir $PACKAGE==$VERSION"
+    sudo_if "$PYTHON_PATH -m pip show --no-python-version-warning $PACKAGE"
+}
+# Updating pip version for python 3.11. Must be removed when pinned version 3.11 is updated to a different python version.
+sudo_if /usr/local/python/3.11.*/bin/python -m pip install --upgrade pip
+
+# https://github.com/advisories/GHSA-5rjg-fvgr-3xxf
+# Updating setuptools version for python 3.11. Must be removed when pinned version 3.11 is updated to a different python version.
+update_package /usr/local/python/3.11.*/bin/python setuptools "78.1.1"

universal-base/.devcontainer/local-features/setup-user/devcontainer-feature.json

@@ -21,7 +21,9 @@
     "ghcr.io/devcontainers/features/node:1",
     "./local-features/nvs",
     "ghcr.io/devcontainers/features/python:1",
+    "./local-features/patch-python",
     "ghcr.io/devcontainers/features/anaconda:1",
+    "./local-features/patch-conda",
     "ghcr.io/devcontainers/features/java:1",
     "ghcr.io/devcontainers/features/go:1",
     "ghcr.io/devcontainers/features/rust:1"

universal-base/.devcontainer/local-features/setup-user/install.sh

@@ -9,8 +9,7 @@ fi
 
 # Ensure that login shells get the correct path if the user updated the PATH using ENV.
 rm -f /etc/profile.d/00-restore-env.sh
-touch /etc/profile.d/00-restore-env.sh # 暂时把有问题的替换忽略
-# echo "export PATH=${PATH//$(sh -lc 'echo $PATH')/\$PATH}" > /etc/profile.d/00-restore-env.sh
+echo "export PATH=${PATH//$(sh -lc 'echo $PATH')/\$PATH}" > /etc/profile.d/00-restore-env.sh
 chmod +x /etc/profile.d/00-restore-env.sh
 
 export DEBIAN_FRONTEND=noninteractive