修正容器 Dockerfile

.env

@@ -1 +0,0 @@
-COMPOSE_PROJECT_NAME=devcontainers

Makefile

@@ -0,0 +1,33 @@
+# 切换到 bash
+SHELL := /bin/bash
+
+# 定义变量
+REGISTRY_LOCAL ?= localhost:5000
+REGISTRY ?= crpi-kbfsbvlqwt19zxum-vpc.cn-hongkong.personal.cr.aliyuncs.com/registry-yqxpro
+GIT_SHA := $(shell git rev-parse --short HEAD)
+
+# 定义所有需要构建的子目录
+SUBDIRS = common-base develop-base universal-base
+
+# 默认目标：按顺序构建所有子目录
+all: $(SUBDIRS)
+
+# 模式规则：每个目录目标都依赖对应的目录
+%: %/
+	@echo "Building $@ Finished"
+
+# 目录构建规则
+%/:
+	@echo "Building $@..."
+	@pushd $@ && \
+		npx devcontainer build \
+			--platform linux/amd64,linux/arm64 \
+			--image-name $(REGISTRY_LOCAL)/devcontainers/$@ --push \
+			--cache-to type=registry,ref=$(REGISTRY_LOCAL)/devcontainers/$@:buildcache,mode=max \
+			--cache-from type=registry,ref=$(REGISTRY_LOCAL)/devcontainers/$@:buildcache && \
+		docker tag $(REGISTRY_LOCAL)/devcontainers/$@ $(REGISTRY)/devcontainers/$@:$(GIT_SHA) && \
+		docker push $(REGISTRY)/devcontainers/$@:$(GIT_SHA) && \
+		popd
+
+# 伪目标声明
+.PHONY: all parallel clean $(SUBDIRS)

authorized_keys

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEXPddCUCbsAShg6+21q/MIvFM27xlqVr+Yg3MoHqUZp

build.sh

@@ -1,29 +0,0 @@
-#!/bin/bash
-
-set -e
-
-export REGISTRY=registry.yqxpro.com
-
-pushd common-base
-npx devcontainer build \
-			--platform linux/amd64,linux/arm64 \
-			--image-name ${REGISTRY}/devcontainers/common-base --push \
-			--cache-to type=registry,ref=${REGISTRY}/devcontainers/common-base:buildcache,mode=max \
-			--cache-from type=registry,ref=${REGISTRY}/devcontainers/common-base:buildcache
-popd
-
-pushd develop-base
-npx devcontainer build \
-			--platform linux/amd64,linux/arm64 \
-			--image-name ${REGISTRY}/devcontainers/develop-base --push \
-			--cache-to type=registry,ref=${REGISTRY}/devcontainers/develop-base:buildcache,mode=max \
-			--cache-from type=registry,ref=${REGISTRY}/devcontainers/develop-base:buildcache
-popd
-
-pushd universal-base
-npx devcontainer build \
-			--platform linux/amd64,linux/arm64 \
-			--image-name ${REGISTRY}/devcontainers/universal-base --push \
-			--cache-to type=registry,ref=${REGISTRY}/devcontainers/universal-base:buildcache,mode=max \
-			--cache-from type=registry,ref=${REGISTRY}/devcontainers/universal-base:buildcache
-popd

build/build-image.sh

@@ -1,37 +0,0 @@
-#!/bin/bash
-set -eux
-
-export BUILDX_BUILDER=hk-builder
-
-export REGISTRY="registry.yqxpro.com"
-
-export S3_ENDPOINT_URL=https://oss-cn-hongkong-internal.aliyuncs.com
-export S3_REGION=cn-hongkong
-export S3_BUCKET=hk-builder-cache-yqxpro
-export S3_ACCESSKEY=LTAI5t8AtjWfsqQWYnyBeCjH
-export S3_SECRETKEY=UPKF20AmcW2zB5BwAMIQeQgZeTkMEs
-export S3_CONFIG=endpoint_url=${S3_ENDPOINT_URL},region=${S3_REGION},bucket=${S3_BUCKET},access_key_id=${S3_ACCESSKEY},secret_access_key=${S3_SECRETKEY}
-
-build() {
-  local target="$1"
-
-  echo "Build $target started"
-
-  pushd $target
-  npx devcontainer build \
-			--platform linux/amd64,linux/arm64 \
-			--image-name ${REGISTRY}/devcontainers/$target --push \
-	    --cache-to type=s3,${S3_CONFIG},prefix=$target/,mode=max \
-			--cache-from type=s3,${S3_CONFIG},prefix=$target/
-  popd
-
-  echo "Build $target completed"
-}
-
-main() {
-  for target in "$@"; do
-    build "$target"
-  done
-}
-
-main "$@"

build/builder-setup.sh

@@ -1,10 +0,0 @@
-#!/bin/bash
-set -eux
-
-export TARGET_USER=ecs-user
-export REGISTRY_IP=172.22.178.82
-
-curl -fsSL https://raw.githubusercontent.com/docker/docker-install/master/install.sh | sh
-sudo usermod -aG docker $TARGET_USER
-
-echo "$REGISTRY_IP registry.yqxpro.com" | sudo tee -a /etc/hosts

build/host-setup.sh

@@ -1,19 +0,0 @@
-#!/bin/bash
-set -eux
-
-# SSH 配置中先准备好 hk-builder-linux-arm64 和 hk-builder-linux-amd64
-docker buildx create \
-  --name hk-builder \
-  --driver docker-container \
-  --driver-opt network=host \
-  --platform linux/amd64 \
-  --node hk-builder-linux-amd64 \
-  ssh://hk-builder-linux-amd64
-docker buildx create \
-  --name hk-builder \
-  --driver docker-container \
-  --driver-opt network=host \
-  --platform linux/arm64 \
-  --append \
-  --node hk-builder-linux-arm64 \
-  ssh://hk-builder-linux-arm64

build/publish-image.sh

@@ -1,36 +0,0 @@
-#!/bin/bash
-set -eux
-
-export REGISTRY=registry.yqxpro.com
-export REGISTRY_PUBLISH=crpi-kbfsbvlqwt19zxum-vpc.cn-hongkong.personal.cr.aliyuncs.com/registry-yqxpro
-export TAG=$(git rev-parse --short HEAD)
-
-sudo apt update
-sudo apt install -y skopeo
-
-docker login $REGISTRY_PUBLISH
-
-skopeo copy --all \
-  docker://${REGISTRY}/devcontainers/common-base:latest \
-  docker://${REGISTRY_PUBLISH}/devcontainers-common-base:latest
-skopeo copy --all \
-  docker://${REGISTRY}/devcontainers/common-base:latest \
-  docker://${REGISTRY_PUBLISH}/devcontainers-common-base:${TAG}
-
-skopeo copy --all \
-  docker://${REGISTRY}/devcontainers/develop-base:latest \
-  docker://${REGISTRY_PUBLISH}/devcontainers-develop-base:latest
-skopeo copy --all \
-  docker://${REGISTRY}/devcontainers/develop-base:latest \
-  docker://${REGISTRY_PUBLISH}/devcontainers-develop-base:${TAG}
-
-skopeo copy --all \
-  docker://${REGISTRY}/devcontainers/universal-base:latest \
-  docker://${REGISTRY_PUBLISH}/devcontainers-universal-base:latest
-skopeo copy --all \
-  docker://${REGISTRY}/devcontainers/universal-base:latest \
-  docker://${REGISTRY_PUBLISH}/devcontainers-universal-base:${TAG}
-
-skopeo copy --all \
-  docker://${REGISTRY}/devcontainers/universal-base:latest \
-  oci-archive:devcontainers-universal-base.tar

build/registry-setup.sh

@@ -1,13 +0,0 @@
-#!/bin/bash
-set -eux
-
-tar xvzf certs.tgz
-docker run -d \
-  --restart=always \
-  --name registry \
-  -v "$(pwd)"/certs:/certs \
-  -e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
-  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.yqxpro.com.crt \
-  -e REGISTRY_HTTP_TLS_KEY=/certs/registry.yqxpro.com.key \
-  -p 443:443 \
-  registry:3

combined-init.sh

@@ -1,13 +0,0 @@
-#!/bin/bash
-set -eux
-
-/usr/local/share/desktop-init.sh echo "Desktop initialization complete"
-/usr/local/share/docker-init.sh echo "Docker initialization complete"
-/usr/local/share/ssh-init.sh echo "SSH initialization complete"
-
-# exposed ports
-# 5901 VNC
-# 6080 noVNC
-# 2222 SSH
-
-exec "$@"

common-base/.devcontainer/devcontainer.json

@@ -8,6 +8,7 @@
       "username": "codespace",
       "userUid": "1000",
       "userGid": "1000",
+      "configureZshAsDefaultShell": true,
     },
     "ghcr.io/devcontainers/features/sshd:1": {
       "gatewayPorts": "yes",

develop-base/.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM registry.yqxpro.com/devcontainers/common-base
+FROM localhost:5000/devcontainers/common-base
 
 # Mount for docker-in-docker
 VOLUME [ "/var/lib/docker" ]

develop-base/.devcontainer/devcontainer.json

@@ -4,9 +4,36 @@
     "context": ".",
   },
   "features": {
-    "ghcr.io/devcontainers/features/git:1": {},
+    "ghcr.io/devcontainers/features/git:1": {
-    "ghcr.io/devcontainers/features/git-lfs:1": {},
+      "version": "latest",
-    "ghcr.io/devcontainers/features/docker-in-docker:2": {},
+      "ppa": "false",
-    "ghcr.io/devcontainers/features/kubectl-helm-minikube:1": {},
+    },
+    "ghcr.io/devcontainers/features/git-lfs:1": {
+      "version": "latest",
+    },
+    "ghcr.io/devcontainers/features/docker-in-docker:2": {
+      "version": "latest",
+    },
+    "ghcr.io/devcontainers/features/kubectl-helm-minikube:1": {
+      "version": "latest",
+    },
+  },
+  "remoteUser": "codespace",
+  "containerUser": "codespace",
+
+  // Use 'forwardPorts' to make a list of ports inside the container available locally.
+  // "forwardPorts": [],
+
+  // Configure tool-specific properties.
+  "customizations": {
+    // Configure properties specific to VS Code.
+    "vscode": {
+      // Set *default* container specific settings.json values on container create.
+      "settings": {
+        "lldb.executable": "/usr/bin/lldb",
+      },
+      // Add the IDs of extensions you want installed when the container is created.
+      "extensions": [],
+    },
   },
 }

docker-compose.yml

@@ -1,33 +0,0 @@
-services:
-  dev-server:
-    image: registry.yqxpro.com/devcontainers/universal-base:latest
-    privileged: true
-    restart: always
-    ports:
-      - 2222:2222
-      - 6080:6080
-    volumes:
-      # environment
-      - ${PWD}/authorized_keys:/home/codespace/.ssh/authorized_keys
-      - ${PWD}/combined-init.sh:/usr/local/share/combined-init.sh
-      - ${PWD}/once-init.sh:/usr/local/share/once-init.sh
-      # workspace
-      - workspace:/workspace
-      # cache
-      - dev-server-maven-cache:/home/codespace/.m2/repository
-      - dev-server-docker-cache:/var/lib/docker
-      - dev-server-apt-cache:/var/cache/apt
-      - dev-server-vscode-cache:/home/codespace/.vscode-server
-      - dev-server-zed-cache:/home/codespace/.zed_server
-    entrypoint: /usr/local/share/combined-init.sh
-    command: sleep infinity
-
-volumes:
-  workspace:
-    name: dev-server-workspace
-    external: true
-  dev-server-maven-cache:
-  dev-server-docker-cache:
-  dev-server-apt-cache:
-  dev-server-vscode-cache:
-  dev-server-zed-cache:

once-init.sh

@@ -1,36 +0,0 @@
-#!/bin/bash
-set -eux
-
-# use VNC DISPLAY by default
-echo "export DISPLAY=:1.0" >> /etc/profile.d/00-restore-env.sh
-
-mkdir -pv /home/codespace/.cargo
-cat > /home/codespace/.cargo/config.toml << EOF
-[source.crates-io]
-replace-with = 'aliyun'
-
-[source.mirror]
-registry = "sparse+https://mirrors.tuna.tsinghua.edu.cn/crates.io-index/"
-
-[source.aliyun]
-registry = "sparse+https://mirrors.aliyun.com/crates.io-index/"
-
-#[registries.mirror]
-#index = "sparse+https://mirrors.tuna.tsinghua.edu.cn/crates.io-index/"
-EOF
-
-# fix permissions
-chown -R codespace:codespace /workspace
-chown -R codespace:codespace /home/codespace/
-chmod 700 /home/codespace/.ssh
-chmod 600 /home/codespace/.ssh/authorized_keys
-
-# configuration
-sudo -u codespace git config --global user.email "me@yqxpro.com"
-sudo -u codespace git config --global user.name "QXYang686"
-
-sudo -u codespace npm config set registry https://registry.npmmirror.com
-
-
-
-sudo -u codespace ln -snf /workspace/dev-server /home/codespace/Projects

system-setup.sh

@@ -1,21 +1,20 @@
 #!/bin/bash
 
+export REGISTRY_USERNAME=qxyang686@qq.com
+export REGISTRY_PASSWORD=
+export REGISTRY_HOST=crpi-kbfsbvlqwt19zxum-vpc.cn-hongkong.personal.cr.aliyuncs.com
+export REGISTRY=crpi-kbfsbvlqwt19zxum-vpc.cn-hongkong.personal.cr.aliyuncs.com/registry-yqxpro
+
 sudo apt update
 sudo apt install -y npm git
 curl -fsSL https://raw.githubusercontent.com/docker/docker-install/master/install.sh | sh
 sudo usermod -aG docker $USER
-docker buildx create --use --bootstrap --name multiarch-builder --driver-opt network=host
+docker buildx create --use --name multiarch-builder
-echo "127.0.0.1 registry.yqxpro.com" | sudo tee -a /etc/hosts
+docker login --username=$REGISTRY_USERNAME --password=$REGISTRY_PASSWORD $REGISTRY_HOST
 
-tar xvzf certs.tgz
 docker run -d \
-  --restart=always \
+  -p 5000:5000 \
   --name registry \
-  -v "$(pwd)"/certs:/certs \
-  -e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
-  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.yqxpro.com.crt \
-  -e REGISTRY_HTTP_TLS_KEY=/certs/registry.yqxpro.com.key \
-  -p 443:443 \
   registry:3
 
 git clone https://gitea.yqxpro.com/QXYang686/devcontainers.git

universal-base/.devcontaiener/Dockerfile

@@ -0,0 +1 @@
+FROM localhost:5000/devcontainers/develop-base

universal-base/.devcontaiener/devcontainer.json

@@ -11,23 +11,37 @@
     "./local-features/nvs": "latest",
     "ghcr.io/devcontainers/features/python:1": {
       "version": "3.12.1",
+      "additionalVersions": "3.11.9",
       "installJupyterlab": "true",
       "configureJupyterlabAllowOrigin": "*",
+      "useOryxIfAvailable": "false",
     },
-    "ghcr.io/devcontainers/features/anaconda:1": {},
+    "./local-features/patch-python": {},
+    "ghcr.io/devcontainers/features/conda:1": {
+      "version": "latest",
+    },
+    "./local-features/patch-conda": {},
     "ghcr.io/devcontainers/features/java:1": {
-      "jdkDistro": "tem",
+      "version": "25",
-      "version": "21",
+      "additionalVersions": "21",
-      "additionalVersions": "8,21,25",
       "installGradle": "true",
       "installMaven": "true",
     },
-    "ghcr.io/devcontainers/features/go:1": {},
+    "ghcr.io/devcontainers/features/go:1": {
+      "version": "latest",
+    },
     "ghcr.io/devcontainers/features/rust:1": {
+      "version": "latest",
       "profile": "complete",
     },
     "./local-features/setup-user": "latest",
   },
+  "remoteUser": "codespace",
+  "containerUser": "codespace",
+
+  // Use 'forwardPorts' to make a list of ports inside the container available locally.
+  // "forwardPorts": [],
+
   // Configure tool-specific properties.
   "customizations": {
     // Configure properties specific to VS Code.
@@ -60,7 +74,10 @@
             "type": "pythonEnvironment",
           },
         ],
+        "lldb.executable": "/usr/bin/lldb",
       },
+      // Add the IDs of extensions you want installed when the container is created.
+      "extensions": [],
     },
   },
 }

universal-base/.devcontaiener/local-features/patch-conda/devcontainer-feature.json

@@ -0,0 +1,7 @@
+{
+    "id": "patch-conda",
+    "name": "Patch Conda Packages",
+	"installsAfter": [
+		"ghcr.io/devcontainers/features/conda"
+	]
+}

universal-base/.devcontaiener/local-features/patch-conda/install.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+#-------------------------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
+#-------------------------------------------------------------------------------------------------------------
+
+USERNAME=${USERNAME:-"codespace"}
+
+set -eux
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
+    exit 1
+fi
+
+# Ensure that login shells get the correct path if the user updated the PATH using ENV.
+rm -f /etc/profile.d/00-restore-env.sh
+echo "export PATH=${PATH//$(sh -lc 'echo $PATH')/\$PATH}" > /etc/profile.d/00-restore-env.sh
+chmod +x /etc/profile.d/00-restore-env.sh
+
+export DEBIAN_FRONTEND=noninteractive
+
+sudo_if() {
+    COMMAND="$*"
+    if [ "$(id -u)" -eq 0 ] && [ "$USERNAME" != "root" ]; then
+        su - "$USERNAME" -c "$COMMAND"
+    else
+        "$COMMAND"
+    fi
+}
+
+update_python_package() {
+    PYTHON_PATH=$1
+    PACKAGE=$2
+    VERSION=$3
+
+    sudo_if "$PYTHON_PATH -m pip uninstall --yes $PACKAGE"
+    sudo_if "$PYTHON_PATH -m pip install --upgrade --no-cache-dir $PACKAGE==$VERSION"
+    sudo_if "$PYTHON_PATH -m pip show --no-python-version-warning $PACKAGE"
+}
+
+update_conda_package() {
+    PACKAGE=$1
+    VERSION=$2
+
+    sudo_if "conda install -y -c defaults $PACKAGE=$VERSION"
+}
+
+sudo_if /opt/conda/bin/python3 -m pip install --upgrade pip
+
+# Temporary: Upgrade python packages due to security vulnerabilities
+# They are installed by the conda feature and Conda distribution does not have the patches
+
+# https://github.com/advisories/GHSA-79v4-65xg-pq4g
+update_python_package /opt/conda/bin/python3 cryptography "44.0.1"
+
+update_conda_package pyopenssl "25.0.0"
+
+# https://github.com/advisories/GHSA-9hjg-9r4m-mvj7
+update_conda_package requests "2.32.4"
+
+# https://github.com/advisories/GHSA-5rjg-fvgr-3xxf
+update_conda_package setuptools "78.1.1"
+
+# https://github.com/advisories/GHSA-g7vv-2v7x-gj9p
+update_python_package /opt/conda/bin/python3 tqdm "4.66.3"
+
+# https://github.com/advisories/GHSA-38jv-5279-wg99
+update_conda_package urllib3 "2.6.3"
+
+# https://nvd.nist.gov/vuln/detail/CVE-2025-6176
+update_conda_package brotli "1.2.0"

universal-base/.devcontaiener/local-features/patch-python/devcontainer-feature.json

@@ -0,0 +1,5 @@
+{
+  "id": "patch-python",
+  "name": "Patch Python Packages",
+  "installsAfter": ["ghcr.io/devcontainers/features/python"]
+}

universal-base/.devcontaiener/local-features/patch-python/install.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+#-------------------------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
+#-------------------------------------------------------------------------------------------------------------
+
+USERNAME=${USERNAME:-"codespace"}
+
+set -eux
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
+    exit 1
+fi
+
+# Ensure that login shells get the correct path if the user updated the PATH using ENV.
+rm -f /etc/profile.d/00-restore-env.sh
+echo "export PATH=${PATH//$(sh -lc 'echo $PATH')/\$PATH}" > /etc/profile.d/00-restore-env.sh
+chmod +x /etc/profile.d/00-restore-env.sh
+
+export DEBIAN_FRONTEND=noninteractive
+
+sudo_if() {
+    COMMAND="$*"
+    if [ "$(id -u)" -eq 0 ] && [ "$USERNAME" != "root" ]; then
+        su - "$USERNAME" -c "$COMMAND"
+    else
+        "$COMMAND"
+    fi
+}
+
+update_package() {
+    PYTHON_PATH=$1
+    PACKAGE=$2
+    VERSION=$3
+
+    sudo_if "$PYTHON_PATH -m pip uninstall --yes $PACKAGE"
+    sudo_if "$PYTHON_PATH -m pip install --upgrade --no-cache-dir $PACKAGE==$VERSION"
+    sudo_if "$PYTHON_PATH -m pip show --no-python-version-warning $PACKAGE"
+}
+# Updating pip version for python 3.11. Must be removed when pinned version 3.11 is updated to a different python version.
+sudo_if /usr/local/python/3.11.*/bin/python -m pip install --upgrade pip
+
+# https://github.com/advisories/GHSA-5rjg-fvgr-3xxf
+# Updating setuptools version for python 3.11. Must be removed when pinned version 3.11 is updated to a different python version.
+update_package /usr/local/python/3.11.*/bin/python setuptools "78.1.1"

universal-base/.devcontaiener/local-features/setup-user/devcontainer-feature.json

@@ -21,7 +21,9 @@
     "ghcr.io/devcontainers/features/node:1",
     "./local-features/nvs",
     "ghcr.io/devcontainers/features/python:1",
-    "ghcr.io/devcontainers/features/anaconda:1",
+    "./local-features/patch-python",
+    "ghcr.io/devcontainers/features/conda:1",
+    "./local-features/patch-conda",
     "ghcr.io/devcontainers/features/java:1",
     "ghcr.io/devcontainers/features/go:1",
     "ghcr.io/devcontainers/features/rust:1"

universal-base/.devcontaiener/local-features/setup-user/install.sh

@@ -9,8 +9,7 @@ fi
 
 # Ensure that login shells get the correct path if the user updated the PATH using ENV.
 rm -f /etc/profile.d/00-restore-env.sh
-touch /etc/profile.d/00-restore-env.sh # 暂时把有问题的替换忽略
+echo "export PATH=${PATH//$(sh -lc 'echo $PATH')/\$PATH}" > /etc/profile.d/00-restore-env.sh
-# echo "export PATH=${PATH//$(sh -lc 'echo $PATH')/\$PATH}" > /etc/profile.d/00-restore-env.sh
 chmod +x /etc/profile.d/00-restore-env.sh
 
 export DEBIAN_FRONTEND=noninteractive

universal-base/.devcontainer/Dockerfile

@@ -1 +0,0 @@
-FROM registry.yqxpro.com/devcontainers/develop-base