Skip to content

Commit 423ca90

Browse files
mattaerealmattaereal
authored
Merge pull request #20 from theredguild/develop
(refactor): Added security considerations. Renamed `isolated` to `hardened` to more explicit description. Added Codespaces variant.
2 parents c0ae23a + 0b1c425 commit 423ca90

13 files changed

Lines changed: 143 additions & 62 deletions

File tree

‎.devcontainer/airgapped/devcontainer.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -55,19 +55,19 @@
5555
"postStartCommand": "echo '🚀 Dev container is ready for Web3 development!'",
5656

5757

58-
// Mount isolation configuration for security and development workflow
58+
// Mount hardening configuration for security and development workflow
5959
// If you need to extract something from within the container, you can use docker cp, but use it at your own risk.
6060
// If you want to develop your devcontainer, you should comment this things, otherwise your changes inside the live container won't persist.
61-
// Disables mounting the host workspace into the container for isolation.
61+
// Disables mounting the host workspace into the container for hardening.
6262
"workspaceMount": "type=tmpfs,destination=/workspace,tmpfs-mode=1777",
63-
// Sets a workspace path entirely isolated within the container
63+
// Sets a hardened workspace
6464
"workspaceFolder": "/workspace",
6565

6666
// Docker run arguments for security hardening and resource management
6767
"runArgs": [
6868

6969
// Temporary filesystem mounts with security restrictions
70-
// These provide isolated, size-limited temporary storage
70+
// These provide size-limited temporary storage
7171
"--tmpfs=/tmp:rw,noexec,nosuid,size=512m", // Main temporary directory
7272
"--tmpfs=/var/tmp:rw,noexec,nosuid,size=512m", // System temporary directory
7373
"--tmpfs=/dev/shm:rw,noexec,nosuid,size=64m", // Shared memory directory
@@ -76,7 +76,7 @@
7676
// This reduces the attack surface by removing unnecessary privileges
7777
"--cap-drop=ALL",
7878

79-
// Security options for container isolation
79+
// Security options for container hardening
8080
// A few security additions (AppArmor & no new privileges)
8181
"--security-opt", "no-new-privileges", // Prevent privilege escalation
8282
"--security-opt", "apparmor:docker-default", // Use Docker's default AppArmor profile

‎.devcontainer/auditor/devcontainer.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,9 +58,9 @@
5858
}
5959
},
6060

61-
// Mount copying host folder into container, no isolation.
61+
// Mount copying host folder into container, no hardening.
6262
"workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind,consistency=cached",
63-
// Sets a workspace path entirely isolated within the container
63+
// Sets a hardened workspace path
6464
"workspaceFolder": "/workspace",
6565

6666
// Docker run arguments for security hardening and resource management

‎.devcontainer/codespaces/devcontainer.json‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
// For format details, see https://aka.ms/devcontainer.json.
3+
// This is a Dev Container for Github Codespaces based on eth-security-toolbox image created by Trail of Bits
4+
// check https://github.com/trailofbits/eth-security-toolbox for more information.
5+
"name": "Codespaces TRG's DevContainer",
6+
7+
// Build configuration - uses the eth-security-toolbox image
8+
"image": "ghcr.io/trailofbits/eth-security-toolbox:nightly",
9+
// Configure tool-specific properties for VS Code
10+
"customizations": {
11+
"vscode": {
12+
// Specialized extensions for smart contract auditing and development
13+
"extensions": [
14+
// check out https://marketplace.visualstudio.com/items?itemName=tintinweb.ethereum-security-bundle for more information
15+
"tintinweb.ethereum-security-bundle", // includes what is listed above ^
16+
"tintinweb.vscode-ethover",
17+
"trailofbits.weaudit",
18+
"trailofbits.contract-explorer",
19+
"trailofbits.sarif-explorer"
20+
],
21+
// VS Code settings optimized for auditing workflows
22+
"settings": {
23+
// Security settings - killswitch for automated tasks
24+
"task.autoDetect": "off", // Disable automatic task detection
25+
"task.problemMatchers.autoDetect": "off", // Disable automatic problem matchers
26+
27+
// Trust and security configuration
28+
"security.workspace.trust.enabled": false, // Trust no one by default
29+
30+
// Privacy settings - killswitch for telemetry
31+
"telemetry.telemetryLevel": "off", // Disable all telemetry collection
32+
33+
// Terminal configuration
34+
"terminal.integrated.defaultProfile.linux": "bash"
35+
}
36+
}
37+
},
38+
}

‎.devcontainer/codespaces/motd‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
2+
┌── ┌──┐ ──┬──
3+
├─ └──┐ │
4+
└──THEREUM─┴──┴ECURITY─┴OOLBOX
5+
6+
https://github.com/trailofbits/eth-security-toolbox
7+
8+
by ################
9+
##########TRAIL#
10+
####
11+
#### ###########
12+
#### ###########
13+
\### #### ####
14+
/\\# of #### ####
15+
/ \ ############
16+
\__/ #### ####
17+
\### ####
18+
/\\#########
19+
/__\\##BITS#
20+
21+
Security Tools and Resources Installed:
22+
23+
https://github.com/crytic/echidna
24+
https://github.com/crytic/medusa
25+
https://github.com/crytic/slither
26+
https://github.com/crytic/building-secure-contracts
27+
28+
Use `solc-select` to switch between different versions of `solc`
29+

‎.devcontainer/eth-security-toolbox/devcontainer.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,9 +36,9 @@
3636
}
3737
},
3838

39-
// Mount copying host folder into container, no isolation.
39+
// Mount copying host folder into container, no hardening.
4040
"workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind,consistency=cached",
41-
// Sets a workspace path entirely isolated within the container
41+
// Sets a workspace path entirely hardened within the container
4242
"workspaceFolder": "/workspace",
4343

4444
// Docker run arguments for security hardening and resource management
@@ -48,7 +48,7 @@
4848
// "--read-only",
4949

5050
// Temporary filesystem mounts with security restrictions
51-
// These provide isolated, size-limited temporary storage
51+
// These provide hardened, size-limited temporary storage
5252
"--tmpfs=/tmp:rw,noexec,nosuid,size=512m", // Main temporary directory
5353
"--tmpfs=/var/tmp:rw,noexec,nosuid,size=512m", // System temporary directory
5454
"--tmpfs=/dev/shm:rw,noexec,nosuid,size=64m", // Shared memory directory
@@ -57,7 +57,7 @@
5757
// This reduces the attack surface by removing unnecessary privileges
5858
"--cap-drop=ALL",
5959

60-
// Security options for container isolation
60+
// Security options for container hardening
6161
// A few security additions (AppArmor & no new privileges)
6262
"--security-opt", "no-new-privileges", // Prevent privilege escalation
6363
"--security-opt", "apparmor:docker-default", // Use Docker's default AppArmor profile

.devcontainer/isolated/Dockerfile renamed to .devcontainer/hardened/Dockerfile

File renamed without changes.

.devcontainer/isolated/devcontainer.json renamed to .devcontainer/hardened/devcontainer.json

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
// This is the HARDENED version of TRG's DevContainer - provides enhanced security
44
// with capability dropping, security options, and resource limits while maintaining
55
// network connectivity for development.
6-
"name": "Isolated TRG's DevContainer",
6+
"name": "Hardened TRG's DevContainer",
77

88
// Build configuration - uses the local Dockerfile in this directory
99
"build": {
@@ -23,7 +23,7 @@
2323
// Container environment variables
2424
"containerEnv": {
2525
"SHELL": "/bin/zsh", // Use zsh as the default shell
26-
"DEVCONTAINER_ID_LABEL": "isolated-web3-devcontainer" // Label for container identification
26+
"DEVCONTAINER_ID_LABEL": "hardened-web3-devcontainer" // Label for container identification
2727
},
2828

2929
// Configure tool-specific properties for VS Code
@@ -65,19 +65,18 @@
6565
"postStartCommand": "echo '🚀 Dev container is ready for Web3 development!'",
6666

6767

68-
// Mount isolation configuration for security and development workflow
68+
// Mount hardening configuration for security and development workflow
6969
// If you need to extract something from within the container, you can use docker cp, but use it at your own risk.
7070
// If you want to develop your devcontainer, you should comment this things, otherwise your changes inside the live container won't persist.
71-
// Disables mounting the host workspace into the container for isolation.
71+
// Disables mounting the host workspace into the container for hardening.
7272
"workspaceMount": "type=tmpfs,destination=/workspace,tmpfs-mode=1777",
73-
// Sets a workspace path entirely isolated within the container
7473
"workspaceFolder": "/workspace",
7574

7675
// Docker run arguments for security hardening and resource management
7776
"runArgs": [
7877

7978
// Temporary filesystem mounts with security restrictions
80-
// These provide isolated, size-limited temporary storage
79+
// These provide hardened, size-limited temporary storage
8180
"--tmpfs=/tmp:rw,noexec,nosuid,size=512m", // Main temporary directory
8281
"--tmpfs=/var/tmp:rw,noexec,nosuid,size=512m", // System temporary directory
8382
"--tmpfs=/dev/shm:rw,noexec,nosuid,size=64m", // Shared memory directory
@@ -86,7 +85,7 @@
8685
// This reduces the attack surface by removing unnecessary privileges
8786
"--cap-drop=ALL",
8887

89-
// Security options for container isolation
88+
// Security options for container hardening
9089
// A few security additions (AppArmor & no new privileges)
9190
"--security-opt", "no-new-privileges", // Prevent privilege escalation
9291
"--security-opt", "apparmor:docker-default", // Use Docker's default AppArmor profile

‎.devcontainer/legacy/devcontainer.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,10 @@
2121
// }
2222
},
2323

24-
// Mount isolation. If you need to extract something from within the container, you can use docker cp, but use it at your own risk. If you want to develop your devcontainer, you should comment this things, otherwise your changes inside the live container won't persist.
24+
// Mount hardening. If you need to extract something from within the container, you can use docker cp, but use it at your own risk. If you want to develop your devcontainer, you should comment this things, otherwise your changes inside the live container won't persist.
2525
// Disables mounting the host workspace into the container.
2626
"workspaceMount": "type=tmpfs,destination=/workspace",
27-
// Sets a workspace path entirely isolated within the container
27+
// Sets a workspace path entirely hardened within the container
2828
"workspaceFolder": "/home/vscode/quests",
2929
"runArgs": [
3030
// Read only filesystem except for explicitly writable volumes (check mounts)

‎.devcontainer/minimal/devcontainer.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
// For format details, see https://aka.ms/devcontainer.json.
3-
// This is the MINIMAL version of TRG's DevContainer - provides essential security isolation
3+
// This is the MINIMAL version of TRG's DevContainer - provides essential security hardening
44
// with a balanced approach between security and usability for Web3 development.
55
"name": "Minimal TRG's DevContainer",
66

@@ -25,7 +25,7 @@
2525
// }
2626
},
2727

28-
// Mount copying host folder into container, no isolation.
28+
// Mount copying host folder into container, no hardening.
2929
"workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind,consistency=cached",
3030
"workspaceFolder": "/workspace",
3131

@@ -36,7 +36,7 @@
3636
// "--read-only",
3737

3838
// Temporary filesystem mounts with security restrictions
39-
// These provide isolated, size-limited temporary storage
39+
// These provide hardened, size-limited temporary storage
4040
"--tmpfs=/tmp:rw,noexec,nosuid,size=512m", // Main temporary directory
4141
"--tmpfs=/var/tmp:rw,noexec,nosuid,size=512m", // System temporary directory
4242
"--tmpfs=/dev/shm:rw,noexec,nosuid,size=64m", // Shared memory directory
@@ -45,7 +45,7 @@
4545
// This reduces the attack surface by removing unnecessary privileges
4646
"--cap-drop=ALL",
4747

48-
// Security options for container isolation
48+
// Security options for container hardening
4949
// A few security additions (AppArmor & no new privileges)
5050
"--security-opt", "no-new-privileges", // Prevent privilege escalation
5151
"--security-opt", "apparmor:docker-default", // Use Docker's default AppArmor profile

‎.devcontainer/paranoid/Dockerfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
# syntax=docker/dockerfile:1.8
22
# check=error=true
33
#
4-
# ISOLATED TRG DevContainer Dockerfile
5-
# This Dockerfile creates a highly isolated development environment for Web3 security research
6-
# with maximum security isolation, read-only filesystem, and network isolation.
4+
# PARANOID TRG DevContainer Dockerfile
5+
# This Dockerfile creates a highly paranoid development environment for Web3 security research
6+
# with maximum security hardening, read-only filesystem, and network hardening.
77
#
88
# Key security features:
99
# - Non-root user execution

0 commit comments

Comments
 (0)