Skip to content

Commit 8045d10

Browse files
02ez02ez
authored
Merge pull request #1 from 02ez/copilot/fix-53426d94-92c8-4134-9b70-d3cb3c8922fb
Implement comprehensive devcontainer security hardening with multiple configuration options
2 parents f7e8e86 + a2c07f1 commit 8045d10

File tree

6 files changed

+318
-17
lines changed

6 files changed

+318
-17
lines changed

‎.devcontainer/Dockerfile.hardened‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Security-hardened Dockerfile for devcontainer
2+
# Uses specific pinned versions for security
3+
4+
# Use specific pinned version instead of "latest" or "dev"
5+
ARG VARIANT="1.0.19-22-bullseye"
6+
FROM mcr.microsoft.com/devcontainers/javascript-node:${VARIANT}
7+
8+
# Set security-focused environment variables
9+
ENV NODE_ENV=development
10+
ENV NPM_CONFIG_AUDIT_LEVEL=moderate
11+
12+
# Update packages and install security updates only
13+
USER root
14+
RUN apt-get update \
15+
&& apt-get upgrade -y \
16+
&& apt-get autoremove -y \
17+
&& apt-get clean \
18+
&& rm -rf /var/lib/apt/lists/*
19+
20+
# Switch back to non-root user for security
21+
USER node
22+
23+
# Set working directory
24+
WORKDIR /workspaces/docs

‎.devcontainer/README.md‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# Devcontainer Security Hardening
2+
3+
This directory contains security-hardened devcontainer configurations for the GitHub Docs project. These configurations follow security best practices to minimize potential attack vectors while maintaining development functionality.
4+
5+
## Available Configurations
6+
7+
### 1. Default Configuration (`devcontainer.json`)
8+
- **Security Level**: Moderate
9+
- **Use Case**: Standard development with basic security hardening
10+
- **Key Security Features**:
11+
- Removed SSH daemon access
12+
- Pinned GitHub CLI version
13+
- Disabled automatic git fetching
14+
- Removed external repository permissions
15+
- Disabled automatic server startup
16+
- Commented out automatic port visibility
17+
18+
### 2. Hardened Configuration (`devcontainer.hardened.json`)
19+
- **Security Level**: High
20+
- **Use Case**: Security-focused development with minimal features
21+
- **Key Security Features**:
22+
- Minimal extension set
23+
- No automatic command execution
24+
- Manual dependency installation required
25+
- Reduced resource allocation
26+
- Explicit security-focused naming
27+
28+
### 3. Team A Secure Configuration (`team-a-secure/devcontainer.json`)
29+
- **Security Level**: High
30+
- **Use Case**: Team-specific secure configuration
31+
- **Key Security Features**:
32+
- Team-specific extension subset
33+
- Manual setup required
34+
- Reduced resource requirements
35+
36+
### 4. Team B Secure Configuration (`team-b-secure/devcontainer.json`)
37+
- **Security Level**: Maximum
38+
- **Use Case**: Ultra-secure development environment
39+
- **Key Security Features**:
40+
- Minimal extension set (only essential linting)
41+
- No automatic commands whatsoever
42+
- Workspace trust required
43+
- Git sync confirmation required
44+
- Minimal resource allocation
45+
46+
## Security Improvements
47+
48+
### Removed Security Risks
49+
1. **SSH Daemon**: Removed `"sshd": "latest"` feature that provided remote access
50+
2. **External Repository Access**: Removed automatic permissions for `github/docs-early-access`
51+
3. **Automatic Command Execution**: Minimized or removed automatic lifecycle commands
52+
4. **Unpinned Versions**: Changed `"latest"` to specific pinned versions
53+
5. **Auto-fetching**: Disabled automatic git fetch operations
54+
55+
### Enhanced Security Features
56+
1. **Version Pinning**: All features use specific versions instead of "latest"
57+
2. **Minimal Extensions**: Reduced extension sets to only essential tools
58+
3. **Manual Operations**: Require manual approval for sensitive operations
59+
4. **Resource Limits**: Reduced resource allocation where appropriate
60+
5. **Non-root User**: Maintained non-root user execution
61+
62+
## Usage
63+
64+
### Selecting a Configuration
65+
When creating a codespace, you can choose from the available configurations:
66+
- Default project configuration (moderately hardened)
67+
- Team A codespace config (highly secure)
68+
- Team B codespace config (maximum security)
69+
70+
### Manual Setup Requirements
71+
For security-hardened configurations:
72+
1. Install dependencies: `npm ci`
73+
2. Start the development server: `npm start`
74+
3. Configure port visibility manually if needed: `gh cs ports visibility 4000:public`
75+
76+
## Security Best Practices
77+
78+
1. **Review Configuration**: Always review devcontainer configurations before use
79+
2. **Minimal Permissions**: Only grant necessary permissions and features
80+
3. **Manual Operations**: Prefer manual over automatic operations for sensitive tasks
81+
4. **Version Pinning**: Use specific versions instead of "latest" tags
82+
5. **Regular Updates**: Keep pinned versions updated but test changes thoroughly
83+
84+
## Migration Guide
85+
86+
### From Standard to Hardened Configuration
87+
1. Switch to `devcontainer.hardened.json` or team-specific configuration
88+
2. Install dependencies manually: `npm ci`
89+
3. Start development server manually: `npm start`
90+
4. Configure port visibility if needed: `gh cs ports visibility 4000:public`
91+
92+
### Custom Team Configurations
93+
To create a custom secure configuration:
94+
1. Copy an existing team configuration
95+
2. Customize extensions and settings for your team's needs
96+
3. Follow the minimal permissions principle
97+
4. Test the configuration thoroughly
98+
99+
## Security Considerations
100+
101+
- These configurations prioritize security over convenience
102+
- Some automatic features have been disabled and require manual intervention
103+
- External repository access must be granted explicitly when needed
104+
- Review and approve all configuration changes through your security review process

‎.devcontainer/devcontainer.hardened.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
// Hardened devcontainer configuration for enhanced security
2+
// For format details, see https://aka.ms/devcontainer.json. For config options, see the README at:
3+
// https://github.com/microsoft/vscode-dev-containers/tree/v0.177.0/containers/javascript-node
4+
// - Security hardened version with minimal features and restricted access
5+
{
6+
"name": "docs.github.com (Security Hardened)",
7+
"build": {
8+
"dockerfile": "Dockerfile.hardened",
9+
// Use specific Node version instead of generic variant
10+
"args": { "VARIANT": "22" }
11+
},
12+
13+
// Minimal features - removed SSH daemon for security
14+
"features": {
15+
// Only essential GitHub CLI, pinned to specific version
16+
"ghcr.io/devcontainers/features/github-cli:1": {
17+
"version": "2.40.1"
18+
}
19+
},
20+
21+
"customizations": {
22+
"vscode": {
23+
// Set *default* container specific settings.json values on container create.
24+
"settings": {
25+
"terminal.integrated.shell.linux": "/bin/bash",
26+
"cSpell.language": ",en",
27+
// Disable auto-fetch for security - manual fetching required
28+
"git.autofetch": false
29+
},
30+
// Minimal essential extensions only - removed potential security risks
31+
"extensions": [
32+
"dbaeumer.vscode-eslint",
33+
"sissel.shopify-liquid",
34+
"davidanson.vscode-markdownlint",
35+
"bierner.markdown-preview-github-styles",
36+
"streetsidesoftware.code-spell-checker"
37+
// Removed extensions that could pose security risks:
38+
// - Custom extensions that might have privileged access
39+
// - GitHub Copilot extensions (can be added manually if needed)
40+
]
41+
}
42+
// Removed codespaces repository permissions for security
43+
// External repository access must be granted manually
44+
},
45+
46+
// Use 'forwardPorts' to make a list of ports inside the container available locally.
47+
"forwardPorts": [4000],
48+
49+
"portsAttributes": {
50+
"4000": {
51+
"label": "Review"
52+
}
53+
},
54+
55+
// Security hardened lifecycle commands - minimal automatic execution
56+
// Manual setup required for enhanced security
57+
"onCreateCommand": "echo 'Security hardened container created. Run npm ci manually to install dependencies.'",
58+
// Removed automatic npm start for security - manual startup required
59+
// Removed automatic port visibility command - manual configuration required
60+
61+
// Comment out connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root.
62+
"remoteUser": "node",
63+
64+
// Reduced resource requirements for security-focused lightweight setup
65+
"hostRequirements": {
66+
"memory": "8gb",
67+
"cpus": "2"
68+
}
69+
}

‎.devcontainer/devcontainer.json‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
// For format details, see https://aka.ms/devcontainer.json. For config options, see the README at:
22
// https://github.com/microsoft/vscode-dev-containers/tree/v0.177.0/containers/javascript-node
3+
//
4+
// SECURITY NOTE: This configuration has been hardened for security.
5+
// See .devcontainer/README.md for details on security improvements and available configurations.
36
// -
47
{
58
"name": "docs.github.com",
@@ -10,9 +13,11 @@
1013
},
1114

1215
// Install features. Type 'feature' in the VS Code command palette for a full list.
16+
// Security hardened: removed SSH daemon, pinned GitHub CLI version
1317
"features": {
14-
"sshd": "latest",
15-
"ghcr.io/devcontainers/features/github-cli:1": {}
18+
"ghcr.io/devcontainers/features/github-cli:1": {
19+
"version": "2.40.1"
20+
}
1621
},
1722

1823
"customizations": {
@@ -21,7 +26,8 @@
2126
"settings": {
2227
"terminal.integrated.shell.linux": "/bin/bash",
2328
"cSpell.language": ",en",
24-
"git.autofetch": true
29+
// Security: disabled auto-fetch, manual git operations recommended
30+
"git.autofetch": false
2531
},
2632
// Visual Studio Code extensions which help authoring for docs.github.com.
2733
"extensions": [
@@ -37,16 +43,9 @@
3743
"GitHub.copilot-chat"
3844
]
3945
},
40-
"codespaces": {
41-
"repositories": {
42-
// allow Codespaces to pull from separate repo when user has access
43-
"github/docs-early-access": {
44-
"permissions": {
45-
"contents": "write"
46-
}
47-
}
48-
}
49-
}
46+
// Security hardened: removed external repository permissions
47+
// External repository access must be granted manually as needed
48+
"codespaces": {}
5049
},
5150

5251
// Use 'forwardPorts' to make a list of ports inside the container available locally.
@@ -58,11 +57,12 @@
5857
}
5958
},
6059

61-
// Lifecycle commands
60+
// Security hardened lifecycle commands
61+
// Reduced automatic command execution for enhanced security
6262
"onCreateCommand": "npm ci",
63-
"postStartCommand": "nohup bash -c 'npm start &'",
64-
// Set the port to be public
65-
"postAttachCommand": "gh cs ports visibility 4000:public -c \"$CODESPACE_NAME\"",
63+
"postStartCommand": "echo 'Container started. Run npm start manually when ready.'",
64+
// Security: removed automatic port visibility command - manual configuration required
65+
// "postAttachCommand": "gh cs ports visibility 4000:public -c \"$CODESPACE_NAME\"",
6666

6767
// Comment out connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root.
6868
"remoteUser": "node",

‎.devcontainer/team-a-secure/devcontainer.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"name": "Team A Secure Codespace Config",
3+
"build": {
4+
"dockerfile": "../Dockerfile.hardened",
5+
"args": { "VARIANT": "22" }
6+
},
7+
8+
// Team A specific minimal features
9+
"features": {
10+
"ghcr.io/devcontainers/features/github-cli:1": {
11+
"version": "2.40.1"
12+
}
13+
},
14+
15+
"customizations": {
16+
"vscode": {
17+
"settings": {
18+
"terminal.integrated.shell.linux": "/bin/bash",
19+
"cSpell.language": ",en",
20+
"git.autofetch": false,
21+
// Team A specific settings
22+
"editor.formatOnSave": true,
23+
"eslint.validate": ["javascript", "typescript", "markdown"]
24+
},
25+
// Team A minimal essential extensions
26+
"extensions": [
27+
"dbaeumer.vscode-eslint",
28+
"sissel.shopify-liquid",
29+
"davidanson.vscode-markdownlint",
30+
"bierner.markdown-preview-github-styles"
31+
]
32+
}
33+
},
34+
35+
"forwardPorts": [4000],
36+
37+
"portsAttributes": {
38+
"4000": {
39+
"label": "Team A Review"
40+
}
41+
},
42+
43+
// Security-first approach - manual setup required
44+
"onCreateCommand": "echo 'Team A secure container ready. Manual setup required for security.'",
45+
46+
"remoteUser": "node",
47+
48+
"hostRequirements": {
49+
"memory": "8gb",
50+
"cpus": "2"
51+
}
52+
}

‎.devcontainer/team-b-secure/devcontainer.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"name": "Team B Secure Codespace Config",
3+
"build": {
4+
"dockerfile": "../Dockerfile.hardened",
5+
"args": { "VARIANT": "22" }
6+
},
7+
8+
// Team B specific minimal features - even more restrictive
9+
"features": {
10+
"ghcr.io/devcontainers/features/github-cli:1": {
11+
"version": "2.40.1"
12+
}
13+
},
14+
15+
"customizations": {
16+
"vscode": {
17+
"settings": {
18+
"terminal.integrated.shell.linux": "/bin/bash",
19+
"cSpell.language": ",en",
20+
"git.autofetch": false,
21+
// Team B ultra-secure settings
22+
"editor.formatOnSave": false,
23+
"git.confirmSync": true,
24+
"security.workspace.trust.enabled": true
25+
},
26+
// Team B ultra-minimal extensions
27+
"extensions": [
28+
"dbaeumer.vscode-eslint",
29+
"davidanson.vscode-markdownlint"
30+
]
31+
}
32+
},
33+
34+
"forwardPorts": [4000],
35+
36+
"portsAttributes": {
37+
"4000": {
38+
"label": "Team B Review"
39+
}
40+
},
41+
42+
// Maximum security - no automatic commands
43+
// All setup must be done manually
44+
45+
"remoteUser": "node",
46+
47+
// Minimal resource allocation for security
48+
"hostRequirements": {
49+
"memory": "4gb",
50+
"cpus": "2"
51+
}
52+
}

0 commit comments

Comments
 (0)