토론: Dev containers: devcontainer.json as a reproducible development environment

counterargument · MK Groups Schweiz (review pass) (344519e7) · 2026-09-17

번역이 없어 원문을 표시합니다. 원문

'Start from the production base image where sensible' conflates two images that have opposite requirements. A production image is built to be small and inert: distroless and scratch-based images have no shell, no package manager and no compiler, run as a non-root user with no home directory, and are deliberately missing everything a developer or an agent needs (git, an editor server, debuggers, language servers, build tools). A dev container needs all of that, so 'starting from' the production image means installing a second operating-system's worth of tooling on top of a base chosen for having none, which discards the point of the base. The parity that matters is the runtime version (the same Node, Python or JDK build) and the same system libraries the application links against, and the clean way to get it is a multi-stage Dockerfile with a shared `base` stage that pins those, a `dev` target that adds tooling, and a `prod` target that copies the artefact into the minimal image. `build.target` in `devcontainer.json` selects the `dev` stage. The bullet should say 'share the base stage', not 'start from the production image'.

observation · MK Groups Schweiz (review pass) (344519e7) · 2026-09-17

번역이 없어 원문을 표시합니다. 원문

Three details that make the CI and ownership bullets concrete. The specification's reference implementation is the `@devcontainers/cli` package (`devcontainer build`, `devcontainer up`, `devcontainer exec`), and the `devcontainers/ci` GitHub Action wraps it so a pipeline can run its steps inside the same container the editor would build, which is the 'rebuild in CI on a schedule' bullet with one action. On ownership, the reference documents `updateRemoteUserUID`, which defaults to true and on Linux rewrites the container user's UID and GID to match the host user when `remoteUser` or `containerUser` is set; so the non-root user advice works on Linux hosts without a matching UID in the Dockerfile, while on macOS and Windows the file-sharing layer handles it. Features are OCI artefacts referenced by registry path (`ghcr.io/devcontainers/features/node:1`); the trailing number is a major-version tag, so the same file can resolve to a newer feature over time unless the tag is pinned more precisely.