philips-software/amp-devcontainer

amp-devcontainer is a fully loaded devcontainer useable for, embedded, C++ or Rust development

amp-devcontainer's Issues

Tighten apt install regex when no exact package match is found

Apparently when no exact package match is found, apt-get install (or apt install) can revert to regex matching of packages. This introduces the risk that additional unnecessary packages might be installed.

This behavior was seen in PR #294 when the non-existing g++-13 package was supposed to be added, but some clang-13 packages were installed instead.

See also this stack exchange post.

Update to GCC 13

Update from GCC 12 to GCC 13.

• Update GNU GCC to version 13
• Update ARM GNU GCC to version 13

Simplify adding annotations to the manifest

Per #201 annotations have been added to the manifest/index file. The way this is done is rather cumbersome at the moment. When docker/build-push-action#958 is solved by means of docker/build-push-action#992, together with docker/metadata-action#351, we can simplify this:

amp-devcontainer/.github/workflows/build-push.yml

Lines 58 to 70 in 1afec52

	- uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
	id: build-and-push
	with:
	file: .devcontainer/Dockerfile
	platforms: linux/amd64,linux/arm64
	push: ${{ github.event_name != 'merge_group' }}
	tags: ${{ steps.meta.outputs.tags }}
	labels: ${{ steps.meta.outputs.labels }}
	outputs: type=image,${{ steps.annotations.outputs.annotations }}
	sbom: true
	provenance: true
	cache-from: type=gha
	cache-to: type=gha,mode=max

to:

- uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
  id: build-and-push
  with:
    file: .devcontainer/Dockerfile
    platforms: linux/amd64,linux/arm64
    push: ${{ github.event_name != 'merge_group' }}
    tags: ${{ steps.meta.outputs.tags }}
    labels: ${{ steps.meta.outputs.labels }}
    annotations: ${{ steps.meta.outputs.labels }}
    sbom: true
    provenance: true
    cache-from: type=gha
    cache-to: type=gha,mode=max

And remove this:

amp-devcontainer/.github/workflows/build-push.yml

Lines 45 to 49 in 1afec52

	- run: |
	set -Eeuo pipefail
	ANNOTATIONS=$(echo '${{ steps.meta.outputs.labels }}' | sed 's/org.opencontainers.image./annotation-index.org.opencontainers.image./' | tr '\n' ',')
	echo "annotations=${ANNOTATIONS::-1}" >> "$GITHUB_OUTPUT"
	id: annotations

Simplify signing the image with cosign

After docker/build-push-action#999 is merged, signing the image can be simplified with a sign: true.

VS Code Settings not taken over from metadata in image label

Cross reference to microsoft/vscode-remote-release#9571 to track progress.

Error while starting devcontainer

Issue:

ERROR: could not find /tmp/devcontainercli-orqa/container-features/0.56.0-1707991056460: stat /tmp/devcontainercli-orqa/container-features/0.56.0-1707991056460: no such file or directory

Error: Command failed: docker buildx build --load --build-arg BUILDKIT_INLINE_CACHE=1 -f /tmp/devcontainercli-orqa/container-features/0.56.0-1707991056460/Dockerfile-with-features -t vsc-amp-devcontainer-1a18ff5b0c7c33a3b1e01a258e9f58be52d930f6363c8cc2f107f0c9b9e0772e --target dev_containers_target_stage --build-arg _DEV_CONTAINERS_BASE_IMAGE=dev_container_auto_added_stage_label /home/orqa/Documents/temp/amp-devcontainer

Steps to reproduce the behavior:

1. Clone the repository
2. Open folder in VSCode
3. Run container with Dev Containers Plugin
4. See error

Environment (please complete the following information):

• OS: Ubuntu 22.04
• Architecture x86_64
• Docker Version Docker 24.0.5, build ced0996

Additional context
Attached full error log file
error_log.txt

Migrate base image to Ubuntu 24.04

Re-base amp-devcontainer on Ubuntu 24.04.

• Update base image to Ubuntu 24.04
• Update all base packages to corresponding, latest, version for Ubuntu 24.04
• Update Clang packages to corresponding, latest, version for Ubuntu 24.04
• Check, and update where necessary, all compiled tool versions for compatibility with Ubuntu 24.04

Simplify SBOM interaction

At the moment there are different SBOMs generated; one during the docker/build-push action stage that uses Syft and the integrated buildx SBOM function; an another one again using Syft but scanning the output image to eventually submit the results to the GitHub Dependency Submission API.

If issue docker/build-push-action#861 and/or docker/build-push-action#889 are solved this can be consolidated into the build-push stage.

As an alternative instead of scanning the image again, the attested SBOM could be retrieved and fed to the Dependency Submission API.