From 3072b5012ce102351aa49b0ebafde12960e2b9d4 Mon Sep 17 00:00:00 2001
From: Daniel Weuthen <weuthen@sipgate.de>
Date: Tue, 1 Sep 2026 20:17:43 +0200
Subject: [PATCH] [common-utils] - Make sudoers config optional

---
 src/common-utils/README.md                 |  1 +
 src/common-utils/devcontainer-feature.json |  7 ++++++-
 src/common-utils/main.sh                   | 11 +++++++----
 test/common-utils/scenarios.json           | 18 ++++++++++++++++++
 test/common-utils/sudoers-false.sh         | 16 ++++++++++++++++
 test/common-utils/sudoers-true.sh          | 19 +++++++++++++++++++
 6 files changed, 67 insertions(+), 5 deletions(-)
 create mode 100644 test/common-utils/sudoers-false.sh
 create mode 100644 test/common-utils/sudoers-true.sh

diff --git a/src/common-utils/README.md b/src/common-utils/README.md
index 3d21e8b3f..fd87c83e5 100644
--- a/src/common-utils/README.md
+++ b/src/common-utils/README.md
@@ -23,6 +23,7 @@ Installs a set of common command line utilities, Oh My Zsh!, and sets up a non-r
 | username | Enter name of a non-root user to configure or none to skip | string | automatic |
 | userUid | Enter UID for non-root user | string | automatic |
 | userGid | Enter GID for non-root user | string | automatic |
+| sudoers | Add sudoers entry for the non-root user | boolean | true |
 | nonFreePackages | Add packages from non-free Debian repository? (Debian only) | boolean | false |
 
 ## OS Support
diff --git a/src/common-utils/devcontainer-feature.json b/src/common-utils/devcontainer-feature.json
index 5b56f6184..3a14e9d44 100644
--- a/src/common-utils/devcontainer-feature.json
+++ b/src/common-utils/devcontainer-feature.json
@@ -1,6 +1,6 @@
 {
     "id": "common-utils",
-    "version": "2.5.9",
+    "version": "2.6.0",
     "name": "Common Utilities",
     "documentationURL": "https://github.com/devcontainers/features/tree/main/src/common-utils",
     "description": "Installs a set of common command line utilities, Oh My Zsh!, and sets up a non-root user.",
@@ -60,6 +60,11 @@
             "default": "automatic",
             "description": "Enter GID for non-root user"
         },
+        "sudoers": {
+            "type": "boolean",
+            "default": true,
+            "description": "Add non-root user to passwordless sudoers?"
+        },
         "nonFreePackages": {
             "type": "boolean",
             "default": false,
diff --git a/src/common-utils/main.sh b/src/common-utils/main.sh
index 5e5487aa2..9ddeabd7e 100644
--- a/src/common-utils/main.sh
+++ b/src/common-utils/main.sh
@@ -17,6 +17,7 @@ UPGRADE_PACKAGES="${UPGRADEPACKAGES:-"true"}"
 USERNAME="${USERNAME:-"automatic"}"
 USER_UID="${USERUID:-"automatic"}"
 USER_GID="${USERGID:-"automatic"}"
+SUDOERS="${SUDOERS:-"true"}"
 ADD_NON_FREE_PACKAGES="${NONFREEPACKAGES:-"false"}"
 INSTALL_SSL="${INSTALLSSL:-"true"}"
 
@@ -471,10 +472,12 @@ else
 fi
 
 # Add add sudo support for non-root user
-if [ "${USERNAME}" != "root" ] && [ "${EXISTING_NON_ROOT_USER}" != "${USERNAME}" ]; then
-    echo $USERNAME ALL=\(root\) NOPASSWD:ALL > /etc/sudoers.d/$USERNAME
-    chmod 0440 /etc/sudoers.d/$USERNAME
-    EXISTING_NON_ROOT_USER="${USERNAME}"
+if [ "$SUDOERS" = "true" ]; then
+    if [ "${USERNAME}" != "root" ] && [ "${EXISTING_NON_ROOT_USER}" != "${USERNAME}" ]; then
+        echo $USERNAME ALL=\(root\) NOPASSWD:ALL > /etc/sudoers.d/$USERNAME
+        chmod 0440 /etc/sudoers.d/$USERNAME
+        EXISTING_NON_ROOT_USER="${USERNAME}"
+    fi
 fi
 
 # *********************************
diff --git a/test/common-utils/scenarios.json b/test/common-utils/scenarios.json
index c70c574a7..f5e35dac2 100644
--- a/test/common-utils/scenarios.json
+++ b/test/common-utils/scenarios.json
@@ -264,6 +264,24 @@
             "common-utils": {}
         }
     },
+    "sudoers-true": {
+        "image": "debian:bullseye",
+        "remoteUser": "vscode",
+        "features": {
+            "common-utils": {
+                "sudoers": true
+            }
+        }
+    },
+    "sudoers-false": {
+        "image": "debian:bullseye",
+        "remoteUser": "vscode",
+        "features": {
+            "common-utils": {
+                "sudoers": false
+            }
+        }
+    },
     "terminal-title-on-xterm": {
         "image": "node",
         "features": {
diff --git a/test/common-utils/sudoers-false.sh b/test/common-utils/sudoers-false.sh
new file mode 100644
index 000000000..8b08ffe26
--- /dev/null
+++ b/test/common-utils/sudoers-false.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+# Optional: Import test library
+source dev-container-features-test-lib
+
+# Always run these checks as the non-root user
+user="$(whoami)"
+check "user" grep vscode <<< "$user"
+
+# Check that the sudoers file for the non-root user does not exist
+check "sudoers file does not exist" test ! -f /etc/sudoers.d/$user
+
+# Report result
+reportResults
diff --git a/test/common-utils/sudoers-true.sh b/test/common-utils/sudoers-true.sh
new file mode 100644
index 000000000..92b8399c3
--- /dev/null
+++ b/test/common-utils/sudoers-true.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+set -e
+
+# Optional: Import test library
+source dev-container-features-test-lib
+
+# Always run these checks as the non-root user
+user="$(whoami)"
+check "user" grep vscode <<< "$user"
+
+# Check if the sudoers file for the non-root user exists
+check "sudoers file exists" test -f /etc/sudoers.d/$user
+
+# Check if the sudoers entry for the non-root user is correctly configured
+check "sudoers entry for non-root user" sudo grep "$user ALL=(root) NOPASSWD:ALL" /etc/sudoers.d/$user
+
+# Report result
+reportResults