Succesfully enabled devcontainer support using sandboxing

[francoism90]

This is a different approach as seen in #342.

I have created a general Flatpak Podman SDK: https://github.com/francoism90/org.freedesktop.Sdk.Extension.podman, which provides podman, podman-remote (the one you need) and podman-compose (untested).

To make it work:

1. Install the SDK extension (or build it yourself) as seen in my repo

2. Create wrappers (this would require a PR or zed allowing to overrule paths):

# Create a permanent config-level bin directory
mkdir -p ~/.var/app/dev.zed.Zed/config/bin

# Copy your podman-remote interceptors into this folder
cat << 'EOF' > ~/.var/app/dev.zed.Zed/config/bin/podman
#!/bin/bash
exec podman-remote "$@"
EOF

cat << 'EOF' > ~/.var/app/dev.zed.Zed/config/bin/docker
#!/bin/bash
exec podman-remote "$@"
EOF

# Make both scripts executable
chmod +x ~/.var/app/dev.zed.Zed/config/bin/podman
chmod +x ~/.var/app/dev.zed.Zed/config/bin/docker

3. Append it as Flatpak PATH (again, zed should allow path overrule):

flatpak override --user dev.zed.Zed --env=PATH="/var/config/bin:$(flatpak run --command=sh dev.zed.Zed -c 'echo $PATH')"

4. Disable escape sandboxing and enable the SDK:

# Disable the sandbox escape feature
flatpak override --user dev.zed.Zed --env=ZED_FLATPAK_NO_ESCAPE=1

# Enable the Podman SDK extension inside the sandbox
flatpak override --user dev.zed.Zed --env=FLATPAK_ENABLE_SDK_EXT=podman

5. Add xdg-run/podman:ro as file access (Other files):

flatpak override --user dev.zed.Zed --filesystem=xdg-run/podman:ro

[francoism90]

This is my devcontainer.json:

{
  "name": "my-devcontainer",
  "containerUser": "docker",
  "containerEnv": {
    "HOME": "/home/docker",
    "CONTAINER_ROLE": "shell",
  },
  "runArgs": ["--userns=keep-id", "--security-opt=label=disable", "--init"],
  "build": {
    "context": "./../",
    "dockerfile": "./../containers/Containerfile",
    "target": "development",
    "args": {
      "UID": "1000", // Replace with your desired UID (id -u)
      "GID": "1000", // Replace with your desired GID (id -g)
    },
  },
}

[lesterespiritu-a]

I was about to create a post for this workaround, can confirm it on my end as well.

Though, I just placed a wrapper to the host podman on one of the directories in PATH env, along with ZED_FLATPAK_NO_ESCAPE=1.

[francoism90]

@lesterespiritu-a Can you post the wrapper? Because I assume you do a host-spawn? With this approach it should not escape the sandbox.

[lesterespiritu-a]

@lesterespiritu-a Can you post the wrapper? Because I assume you do a host-spawn? With this approach it should not escape the sandbox.

Unfortunately, I am using flatpak-spawn --host. I have spoken before with the DevPod team about introducing a common podman extension which could resolve my setup as well as others, but I have been busy.

[francoism90]

@lesterespiritu-a No worries. You could give my approach a try and report back. :)

[lesterespiritu-a]

I have incorporated it minimally with my devpod setup idea.

Two extensions holding the clis devpod and podman-remote respectively:
org.freedesktop.Sdk.Extension.devpod
org.freedesktop.Sdk.Extension.podman

Applied to both Zed IDE and DevPod Desktop:
--filesystem=xdg-run/podman
--env=FLATPAK_ENABLE_SDK_EXT=devpod,podman

With a minimal test devcontainer configured as follows:

{
  "name": "Test",
  "image": "mcr.microsoft.com/devcontainers/base:2.1-jammy",
  "securityOpt": ["label=disable"],
  "runArgs": ["--userns=keep-id"],
}

It just works.

[francoism90]

@lesterespiritu-a Good work! Both should be upstream, but I'm not interested. I don't think Flathub is that friendly and open for PRs.

[Pioneer-1-1]

This has been open in #342 for about two months.

The guy/gal who runs this repo appears to be very good at updating for each new version of zed but to ignore practically everything else.

[francoism90]

@Pioneer-1-1 That's a very different approach compared to this one.