Thore CimbalandClaude Sonnet 5
328b028c5d
The devcontainer could never actually be built successfully - verified by building it from scratch for the first time in a while. Found and fixed six issues: - kubectl: apt.kubernetes.io was deprecated/shut down by Google in 2023, switched to the official successor repo pkgs.k8s.io - docker-ce-cli: apt line hardcoded arch=amd64, breaking the build on Apple Silicon; resolved dynamically via dpkg --print-architecture - useradd -G docker failed because only the Docker CLI (no daemon) is installed, so no package ever creates the docker group; added explicit groupadd - oh-my-zsh install had a nested-quoting bug that made the RUN step fail; simplified to download-then-run instead of one nested `su -c "sh -c ..."` - sops binary was hardcoded to linux.amd64, only working on arm64 by luck via Docker Desktop's QEMU emulation; resolved dynamically like docker-ce - docker.sock was mounted but unusable (permission denied) since the container's docker group GID never matched the host socket's GID; added a root entrypoint (docker-init.sh) that reconciles this at container start, then drops to the vscode user via gosu Also fixed two stale mas-secrets.sops.yaml references (actual filename is mas-secret.yaml) in README.md and postCreateCommand.sh, set the vscode user's default shell to zsh (oh-my-zsh was installed but never used by default), and documented all of the above plus a build+run verification snippet in README.md so this class of drift is caught before it goes unnoticed again. Verified end-to-end: cold `docker build --no-cache`, then a real container run against the actual mounted kubeconfig, age key, and docker socket - kubectl reaches the live cluster, sops decrypts a real secret, and docker ps talks to the real daemon as the vscode user. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
24 lines
925 B
Bash
24 lines
925 B
Bash
#!/bin/bash
|
|
# Runs as root at container start (before any `docker exec -u vscode` from VS Code).
|
|
# The docker.sock's GID is only known once the host socket is actually bind-mounted,
|
|
# so it can't be baked in at image build time - it must be reconciled here, at runtime.
|
|
set -e
|
|
|
|
if [ -S /var/run/docker.sock ]; then
|
|
SOCK_GID=$(stat -c '%g' /var/run/docker.sock)
|
|
CURRENT_GID=$(getent group docker | cut -d: -f3)
|
|
if [ -n "$SOCK_GID" ] && [ "$SOCK_GID" != "$CURRENT_GID" ]; then
|
|
EXISTING_GROUP=$(getent group "$SOCK_GID" | cut -d: -f1)
|
|
if [ -n "$EXISTING_GROUP" ]; then
|
|
# GID is already taken by another group (e.g. GID 0/root - Docker Desktop for
|
|
# Mac/Windows owns the socket this way inside its VM), so join that group
|
|
# instead of trying to reassign it to 'docker'.
|
|
usermod -aG "$EXISTING_GROUP" vscode
|
|
else
|
|
groupmod -g "$SOCK_GID" docker
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
exec gosu vscode "$@"
|