feat: bundle devcontainer CLI in UDI

[rohanKanojia]

Summary

Related to eclipse-che/che#23458

• Adds @devcontainers/cli@0.88.0 to both universal/ubi9/Dockerfile and universal/ubi10/Dockerfile
• Eliminates runtime npm install -g @devcontainers/cli (+ curl | sh fallback) from every workspace start
• Unblocks airgapped clusters where npm/GitHub are unreachable

Why

Today the CLI is installed on every workspace start via npm install -g @devcontainers/cli. This costs start-up time and makes the flow depend on npm/GitHub reachability — a blocker in airgapped clusters. The install does not survive a pod restart because npm install -g under nvm lands in an image layer that gets replaced by stow.

What

Pinned @devcontainers/cli@0.88.0, installed the same way as yarn (npm install --global under nvm), in both ubi9 and ubi10 Dockerfiles. Follows the existing pattern exactly:

1. source /home/user/.bashrc — loads nvm so npm resolves
2. Version pinned via ENV DEVCONTAINER_CLI_VERSION for reproducible builds and CVE tracking
3. chgrp -R 0 /home/tooling && chmod -R g=u /home/tooling — required for arbitrary UID (OpenShift)
4. Installed globally under nvm in /home/tooling (not /home/user, which is replaced by PVC with persistUserHome)

No redundant PATH entry — the existing ENV PATH=$NVM_DIR/versions/node/v${NODEJS_DEFAULT_VERSION}/bin:$PATH already covers the global npm bin directory.

Licence

• License: MIT (LICENSE.txt, Copyright Microsoft Corporation)
• Size: ~1.9 MB installed
• Dependencies: "dependencies": {} — pre-bundled webpack artifact, single file at dist/spec-node/devContainersSpecCLI.js
• Third-party: 85 bundled components, all permissive (~60 MIT, ~16 ISC, 6 BSD-2/3, 1 0BSD, 1 Python-2.0). No GPL/LGPL/AGPL/MPL
• LICENSE.txt and ThirdPartyNotices.txt ship in the npm package directory

Architecture

No native modules — the package is arch-independent (amd64/arm64/ppc64le all unaffected).

Maintenance

Updates come from bumping the pinned DEVCONTAINER_CLI_VERSION env var.

Context

Related: eclipse-che/che#23458

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added Dev Containers CLI version 0.88.0 to the UBI9 and UBI10 development images.
• Bug Fixes
  • Normalized group ownership and permissions for the tooling directory in both images.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rohanKanojia

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Click here to review and test in web IDE:

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 6540ca0b-e408-4cb4-8abf-83a251a19e67

📥 Commits

Reviewing files that changed from the base of the PR and between 7e7d202 and fbf069b.

📒 Files selected for processing (2)

• universal/ubi10/Dockerfile
• universal/ubi9/Dockerfile

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The UBI9 and UBI10 Dockerfiles install @devcontainers/cli version 0.88.0 globally. They also normalize group ownership and permissions for /home/tooling.

Changes

Dev Containers CLI installation

Layer / File(s)	Summary
Install and configure the Dev Containers CLI universal/ubi9/Dockerfile, universal/ubi10/Dockerfile	Both images define DEVCONTAINER_CLI_VERSION=0.88.0, install @devcontainers/cli globally with npm, and update /home/tooling group ownership and permissions.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to a3f8d

The UBI9 and UBI10 images now bundle the pinned Dev Containers CLI and avoid runtime installation dependencies. No current merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: bundling the Dev Container CLI in the universal development image. It is concise and specific.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}