Repository navigation
fix(devcontainer-cli): resolve a ${localEnv:...} remoteUser; say why the unlock status failed (devcontainer-cli 1.22.1) - #191
Merged
Conversation
…hy the unlock status failed (launcher-remote-user-localenv, unlock-status-masks-errors, devcontainer-cli 1.22.1)
devcontainer up writes the devcontainer.metadata label with devcontainer.json's
text unresolved, so a "remoteUser": "${localEnv:NAME:default}" reached
docker exec -u literally and every openbao-setup call failed. The launcher now
resolves ${localEnv:...} (and ${env:...}) as the CLI does, falls back to
containerUser and then Config.User, and never passes a "${" to -u.
Get-OpenBaoUnlockStatus no longer reports every non-zero exit as "no
openbao-setup that knows the key file": a failing exec gives one line with the
exit code and stderr's first line, after up too; keyfile:create exits 1 on it.
Reported by the AOF host agent (their PR #316 worked around it).
Co-Authored-By: Claude Opus 5.5 <claude-opus-5-5@noreply.invalid>
Claude-Session: https://claude.ai/code/session_01DPsHU3AJNa3yD4E84h5gfH
Signed-off-by: devhost agent <devhost-agent@noreply.invalid>
…remoteUser and the unlock-status failure line (launcher-remote-user-localenv) Co-Authored-By: Claude Opus 5.5 <claude-opus-5-5@noreply.invalid> Claude-Session: https://claude.ai/code/session_01DPsHU3AJNa3yD4E84h5gfH Signed-off-by: devhost agent <devhost-agent@noreply.invalid>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The launcher (
bootstrap/host/DevcontainerCli.psm1, devcontainer-cli 1.22.1):Get-DevcontainerRemoteUsernow resolves${localEnv:NAME}/${localEnv:NAME:default}(and${env:…}) from the label, the way the CLI does atup. If the value doesn't resolve, it falls back to containerUser, thenConfig.User, then no-u. It never passes a${todocker exec -u.Get-OpenBaoUnlockStatusnow tells a failedexecapart from "no openbao-setup that knows the key file". On a failure the launcher prints<engine> exec as user 'X' failed (exit N): <stderr's first line>, afterupas well, and keyfile:create exits 1. Exit 4, exit 2 and a missing binary behave as before.Why
devcontainer upwrites thedevcontainer.metadatalabel unresolved, so a variable remoteUser broketask dc:openbao:keyfile:create(exit 4, wrong message) and the automatic unlock afterup(it failed silently and OpenBao stayed sealed). The AOF host agent reported it and worked around it in their PR #316. Backlog:launcher-remote-user-localenv,unlock-status-masks-errors.Open choice for the Operator: the module has no
.envreader.Import-DotEnvexists only inbootstrap.ps1. Undertask,dotenv:already loads.devcontainer/.env. When the launcher is run directly, a${localEnv:NAME:default}resolves to its default.Checklist
Signed-off-by:, DCO)versionbumped (1.22.0 → 1.22.1) and## [1.22.1]added to the CHANGELOGinstall.shuntouchedtest/bootstrap/OpenBaoKeyFile.Tests.ps1(81 passed, 2 skipped Windows-only); the whole bootstrap Pester suite passes (355)task lint: PSScriptAnalyzer, yamllint, shellcheck, changelog and versions checks pass. In the devhost, bash unit suites this change doesn't touch fail because they read the devhost's ownHOST_TYPE/SSH_AGENT_MODE. CI is the check.NOTES.mdupdated,task docsrunhttps://claude.ai/code/session_01DPsHU3AJNa3yD4E84h5gfH