Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 23 additions & 6 deletions .devcontainer/Dockerfile
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# ghcr.io/eda-labs/eda-devcontainer
FROM mcr.microsoft.com/devcontainers/base:ubuntu
FROM public.ecr.aws/docker/library/debian:bookworm-slim

ARG EDA_VERSION=25.12.1
ARG EDA_PLAYGROUND_REPO=kaelemc/playground
Expand All @@ -9,22 +9,39 @@ ENV EDA_VERSION=${EDA_VERSION//./-}
ENV EDA_PLAYGROUND_REPO=$EDA_PLAYGROUND_REPO
ENV EDA_PLAYGROUND_DIR=$EDA_PLAYGROUND_DIR

RUN apt-get update && apt-get install -y \
RUN DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install --no-install-recommends -y \
make \
git \
ca-certificates \
curl \
jq \
btop \
sudo \
zsh \
&& rm -rf /var/lib/apt/lists/*

RUN useradd -m -s /bin/zsh vscode && \
groupadd -f docker && \
usermod -aG sudo,docker vscode && \
echo "vscode ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers.d/vscode && \
chmod 0440 /etc/sudoers.d/vscode

COPY --chmod=755 scripts/ /usr/local/bin/.
COPY codespaces-4vcpu-kpt-setters.yaml /eda-codespaces/codespaces-4vcpu-kpt-setters.yaml

RUN curl -s https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash
RUN curl -fsSL --retry 3 https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | TAG=v5.8.3 bash
Copy link

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

curl is downloading and piping https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh directly into bash while running as root, and the script is only pinned to the mutable main branch with no integrity verification. If the k3d GitHub repo or the network path is compromised, an attacker can serve arbitrary shell commands and gain code execution in the build environment (and any CI/CD context using this Dockerfile). To mitigate this, pin to an immutable reference (e.g., a specific commit or release asset) and verify its integrity (checksum/signature) before execution, or vendor the installer script in the repo instead of executing it directly from the network.

Copilot uses AI. Check for mistakes.

RUN echo "export PATH=$PATH:$EDA_PLAYGROUND_DIR/tools" >> /etc/profile
# Add EDA Playground tools to PATH (zsh)
RUN echo 'export PATH="$PATH:$EDA_PLAYGROUND_DIR/tools"' >> /etc/zsh/zshrc

USER vscode

RUN git clone "https://github.com/$EDA_PLAYGROUND_REPO" $EDA_PLAYGROUND_DIR && cd $EDA_PLAYGROUND_DIR && make download-tools
RUN git clone --depth 1 "https://github.com/$EDA_PLAYGROUND_REPO" $EDA_PLAYGROUND_DIR && cd $EDA_PLAYGROUND_DIR && make download-tools
Copy link

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This RUN git clone --depth 1 "https://github.com/$EDA_PLAYGROUND_REPO" ... && make download-tools step pulls code from an unpinned external GitHub repository and immediately executes its Makefile, with the repository location also overridable via the EDA_PLAYGROUND_REPO build arg. Because the fetched code is not tied to an immutable commit or verified by checksum/signature, a compromise of that GitHub repo (or a malicious override of the build arg) would allow arbitrary code execution during image build. To reduce this supply-chain risk, pin the clone to a specific, trusted commit or release and/or mirror/vendor the code in a controlled repository, and avoid allowing untrusted overrides of the repo location.

Copilot uses AI. Check for mistakes.

RUN curl -o $HOME/.bundle.yaml "https://raw.githubusercontent.com/nokia-eda/edaadm/refs/heads/main/bundles/eda-bundle-core-$EDA_VERSION.yaml" && \
$EDA_PLAYGROUND_DIR/tools/yq '.assets.registries[] | .name as $reg | .images[] | .name as $img | .tags[] | $reg + "/" + $img + ":" + .' $HOME/.bundle.yaml > $HOME/.images.txt
$EDA_PLAYGROUND_DIR/tools/yq '.assets.registries[] | .name as $reg | .images[] | .name as $img | .tags[] | $reg + "/" + $img + ":" + .' $HOME/.bundle.yaml > $HOME/.images.txt

SHELL ["/bin/bash", "-c"]
RUN SRL=$(curl -s "https://raw.githubusercontent.com/nokia-eda/playground/refs/heads/main/topology/3-nodes-srl.yaml" | $EDA_PLAYGROUND_DIR/tools/yq '.spec.nodeTemplates | filter(.name == "default").[].nodeProfile'); \
curl "https://raw.githubusercontent.com/nokia-eda/kpt/refs/heads/main/eda-kpt-playground/$SRL/engine_v1_nodeprofile_srlinux_${SRL//[^0-9.]/}.yaml" | \
$EDA_PLAYGROUND_DIR/tools/yq '.spec.containerImage' >> $HOME/.images.txt
Comment on lines +45 to +47
Copy link

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The curl command in the complex shell pipeline lacks error handling. If any of the curl requests fail or the yq filtering produces no results, the script will continue silently. Consider adding error checks (set -e, or checking exit codes) to ensure the SRL image URL is successfully retrieved and appended.

Suggested change
RUN SRL=$(curl -s "https://raw.githubusercontent.com/nokia-eda/playground/refs/heads/main/topology/3-nodes-srl.yaml" | $EDA_PLAYGROUND_DIR/tools/yq '.spec.nodeTemplates | filter(.name == "default").[].nodeProfile'); \
curl "https://raw.githubusercontent.com/nokia-eda/kpt/refs/heads/main/eda-kpt-playground/$SRL/engine_v1_nodeprofile_srlinux_${SRL//[^0-9.]/}.yaml" | \
$EDA_PLAYGROUND_DIR/tools/yq '.spec.containerImage' >> $HOME/.images.txt
RUN set -euo pipefail; \
SRL=$(curl -fsSL "https://raw.githubusercontent.com/nokia-eda/playground/refs/heads/main/topology/3-nodes-srl.yaml" | \
"$EDA_PLAYGROUND_DIR/tools/yq" '.spec.nodeTemplates | filter(.name == "default").[].nodeProfile'); \
if [[ -z "${SRL:-}" ]]; then \
echo "Error: Failed to retrieve SRL node profile from topology definition." >&2; \
exit 1; \
fi; \
IMAGE_URL=$(curl -fsSL "https://raw.githubusercontent.com/nokia-eda/kpt/refs/heads/main/eda-kpt-playground/$SRL/engine_v1_nodeprofile_srlinux_${SRL//[^0-9.]/}.yaml" | \
"$EDA_PLAYGROUND_DIR/tools/yq" '.spec.containerImage'); \
if [[ -z "${IMAGE_URL:-}" ]]; then \
echo "Error: Failed to extract SRL container image from node profile." >&2; \
exit 1; \
fi; \
echo "$IMAGE_URL" >> "$HOME/.images.txt"

Copilot uses AI. Check for mistakes.
30 changes: 30 additions & 0 deletions .devcontainer/codespaces-4vcpu-kpt-setters.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
# This setters file is meant for use in codespaces (4vcpu) VMs
# to provide configuration for the EDA platform
# It is applied in the codespaces post-create script as an argument to `make try-eda.
Copy link

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment has a typo - "codespaces post-create script as an argument to make try-eda." is missing the closing backtick. It should be "argument to make try-eda`."

Suggested change
# It is applied in the codespaces post-create script as an argument to `make try-eda.
# It is applied in the codespaces post-create script as an argument to `make try-eda`.

Copilot uses AI. Check for mistakes.
apiVersion: v1
kind: ConfigMap
metadata:
name: codespaces-4vcpu-apply-setter-fn-config
data:
# AI Engine
EAE_REQ_CPU: 10m
# Artifact server
ASVR_REQ_CPU: 10m
# Bootstrap server
BSVR_REQ_CPU: 10m
# EDA Cert Checker
ECC_REQ_CPU: 10m
# EDA Metrics Server
EMS_REQ_CPU: 10m
# Identity Server - Keycloak
KC_REQ_CPU: 10m
# Appstore Controller
ASC_REQ_CPU: 10m
# Identity Server Database - Postgres
PG_REQ_CPU: 10m
# Flow Engine
FE_REQ_CPU: 10m
# NPP
NPP_REQ_CPU: 10m
# TestMan
TM_REQ_CPU: 10m
5 changes: 3 additions & 2 deletions .devcontainer/devcontainer.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "Nokia EDA in GitHub Codespaces",
"image": "ghcr.io/eda-labs/eda-devcontainer:latest",
"image": "ghcr.io/eda-labs/codespaces/base:pr-1",
Copy link

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The image tag is set to "pr-1" which appears to be a temporary testing tag. This should be updated to a production-ready tag (e.g., "latest", a version tag, or "main") before merging to ensure the devcontainer uses the correct stable image.

Suggested change
"image": "ghcr.io/eda-labs/codespaces/base:pr-1",
"image": "ghcr.io/eda-labs/codespaces/base:latest",

Copilot uses AI. Check for mistakes.
"features": {
"ghcr.io/devcontainers/features/docker-in-docker:2": {
"version": "latest",
Expand Down Expand Up @@ -46,7 +46,8 @@
"portsAttributes": {
"9443": {
"protocol": "https",
"label": "EDA UI"
"label": "EDA UI",
"onAutoForward": "openBrowser"
}
},
"hostRequirements": {
Expand Down
4 changes: 1 addition & 3 deletions .devcontainer/postCreate.sh
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,4 @@ cd $EDA_PLAYGROUND_DIR

ensure-docker-is-ready

make try-eda NO_KIND=yes NO_LB=yes

make configure-codespaces-keycloak
make try-eda NO_KIND=yes NO_LB=yes KPT_SETTERS_FILE=/eda-codespaces/codespaces-4vcpu-kpt-setters.yaml
55 changes: 55 additions & 0 deletions .github/workflows/build-devcontainer.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
name: Build Devcontainer Image

"on":
pull_request:
workflow_dispatch:
release:
types:
- published

env:
REGISTRY: ghcr.io
IMAGE_NAME: ghcr.io/eda-labs/codespaces/base
DOCKERFILE: .devcontainer/Dockerfile
CONTEXT: .devcontainer/

jobs:
build:
name: Build and Push
runs-on: ubuntu-24.04
Copy link

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow uses ubuntu-24.04 as the runner. While this is valid, verify that ubuntu-24.04 is available in your GitHub Actions environment as it's a newer LTS version. If there are any compatibility concerns, ubuntu-22.04 or ubuntu-latest might be safer alternatives.

Suggested change
runs-on: ubuntu-24.04
runs-on: ubuntu-22.04

Copilot uses AI. Check for mistakes.
permissions:
contents: read
packages: write
steps:
- name: Checkout
uses: actions/checkout@v4

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Log in to GHCR
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Docker meta
id: meta
uses: docker/metadata-action@v5
with:
images: |
${{ env.IMAGE_NAME }}
tags: |
type=ref,event=branch
type=ref,event=pr
type=ref,event=tag
type=sha

- name: Build and push image
uses: docker/build-push-action@v6
with:
context: ${{ env.CONTEXT }}
file: ${{ env.DOCKERFILE }}
push: true
Comment on lines +45 to +54
Copy link

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow pushes images on every pull request (type=ref,event=pr), which could clutter the registry with numerous PR images. Consider whether images should only be pushed on merge to main or specific branches, or add cleanup logic for PR images.

Suggested change
type=ref,event=pr
type=ref,event=tag
type=sha
- name: Build and push image
uses: docker/build-push-action@v6
with:
context: ${{ env.CONTEXT }}
file: ${{ env.DOCKERFILE }}
push: true
type=ref,event=tag
type=sha
- name: Build and push image
uses: docker/build-push-action@v6
with:
with:
context: ${{ env.CONTEXT }}
file: ${{ env.DOCKERFILE }}
push: ${{ github.event_name != 'pull_request' }}

Copilot uses AI. Check for mistakes.
tags: ${{ steps.meta.outputs.tags }}