11{
22 // For format details, see https://aka.ms/devcontainer.json.
3- // This is the ISOLATED version of TRG's DevContainer - provides maximum security isolation
4- // with a read-only filesystem and network isolation for high-security Web3 development.
3+ // This is the HARDENED version of TRG's DevContainer - provides enhanced security
4+ // with capability dropping, security options, and resource limits while maintaining
5+ // network connectivity for development.
56 "name" : " Isolated TRG's DevContainer"
67
78 // Build configuration - uses the local Dockerfile in this directory
2930 "customizations" : {
3031 "vscode" : {
3132 // Web3 security and development extensions
32- // check out https://marketplace.visualstudio.com/items?itemName=tintinweb.ethereum-security-bundle for more information
3333 "extensions" : [
3434 " tintinweb.ethereum-security-bundle" // Comprehensive Ethereum security tools
3535 " tintinweb.vscode-ethover" // Ethereum hover information
5656 "terminal.integrated.defaultProfile.linux" : " zsh" // Use zsh by default
5757 "terminal.integrated.profiles.linux" : { "zsh" : { "path" : " /usr/bin/zsh"
5858 // Using bash might be more safe and stable, but zsh provides better features
59- }
59+ },
6060 }
6161 },
6262
6363 // Commands to run during container lifecycle
64- "initializeCommand" : " echo 'Initializing isolated dev container...'"
64+ "initializeCommand" : " echo 'Initializing hardened dev container...'"
6565 "postStartCommand" : " echo '🚀 Dev container is ready for Web3 development!'"
6666
67- // Workspace configuration - isolated within container
68- "workspaceFolder" : " /workspace"
69- // Mount workspace as tmpfs for complete isolation - no host file access.
70- // This ensures that the workspace is ephemeral and does not persist data.
71- "workspaceMount" : " type=tmpfs,destination=/workspace,tmpfs-mode=1777"
72-
73- // Docker run arguments for security and isolation
74- "runArgs" : [
75- // Security hardening - drop all Linux capabilities to reduce attack surface
76- " --cap-drop=ALL"
77-
78- // Read-only filesystem for maximum security, preventing any persistent changes
79- " --read-only"
80-
81- // Security options for container isolation
82- " --security-opt"
83- " no-new-privileges:true" // Prevent privilege escalation from within the container
84- " --security-opt"
85- " apparmor=docker-default" // Apply Docker's default AppArmor profile for enhanced security
86-
87- // Network isolation - completely disconnect from the internet for a secure environment
88- " --network=none"
89-
90- // --- Writable, EXECUTABLE Mounts for VS Code Server ---
91- " --tmpfs" " /home/vscode/.vscode-server:rw,exec,nosuid,size=512m,uid=1000,gid=1000"
92- " --tmpfs" " /home/vscode/.vscode-server-insiders:rw,exec,nosuid,size=256m,uid=1000,gid=1000"
9367
94- // --- Writable, NON-EXECUTABLE Mounts for Caches, Configs, and Logs ---
95- " --tmpfs" " /home/vscode/.cache:rw,noexec,nosuid,size=256m,uid=1000,gid=1000"
96- " --tmpfs" " /home/vscode/.config:rw,noexec,nosuid,size=128m,uid=1000,gid=1000"
97- " --tmpfs" " /home/vscode/.local:rw,noexec,nosuid,size=256m,uid=1000,gid=1000"
98- " --tmpfs" " /home/vscode/.gnupg:rw,noexec,nosuid,size=32m,uid=1000,gid=1000"
99- " --tmpfs" " /tmp:rw,noexec,nosuid,size=512m"
100- " --tmpfs" " /var/tmp:rw,noexec,nosuid,size=512m"
101- " --tmpfs" " /var/log:rw,noexec,nosuid,size=128m"
102- " --tmpfs" " /run:rw,noexec,nosuid,size=128m"
103- " --tmpfs" " /home/vscode/.devcontainer:rw,noexec,nosuid,size=32m,uid=1000,gid=1000"
68+ // Mount isolation configuration for security and development workflow
69+ // If you need to extract something from within the container, you can use docker cp, but use it at your own risk.
70+ // If you want to develop your devcontainer, you should comment this things, otherwise your changes inside the live container won't persist.
71+ // Disables mounting the host workspace into the container for isolation.
72+ "workspaceMount" : " type=tmpfs,destination=/workspace,tmpfs-mode=1777"
73+ // Sets a workspace path entirely isolated within the container
74+ "workspaceFolder" : " /workspace"
10475
105- // Resource limits for container performance and stability
106- // "--memory=1g", // Limit container memory to 1GB to prevent resource exhaustion
107- // "--cpus=2" // Limit container to 2 CPU cores for predictable performance
108- ]
76+ // Docker run arguments for security hardening and resource management
77+ "runArgs" : [
78+
79+ // Temporary filesystem mounts with security restrictions
80+ // These provide isolated, size-limited temporary storage
81+ " --tmpfs=/tmp:rw,noexec,nosuid,size=512m" // Main temporary directory
82+ " --tmpfs=/var/tmp:rw,noexec,nosuid,size=512m" // System temporary directory
83+ " --tmpfs=/dev/shm:rw,noexec,nosuid,size=64m" // Shared memory directory
84+
85+ // Security hardening - drop all Linux capabilities
86+ // This reduces the attack surface by removing unnecessary privileges
87+ " --cap-drop=ALL"
88+
89+ // Security options for container isolation
90+ // A few security additions (AppArmor & no new privileges)
91+ " --security-opt" " no-new-privileges" // Prevent privilege escalation
92+ " --security-opt" " apparmor:docker-default" // Use Docker's default AppArmor profile
93+
94+ // Use seccomp's default security profile
95+ // seccomp provides system call filtering for additional security
96+ // "--security-opt", "seccomp=default",
97+
98+ // Network security configuration
99+ // If you really want to isolate it, just disconnect it from the internet.
100+ // You should COPY your working files inside before, otherwise you'll have to mount them manually.
101+ // "--network=none",
102+
103+ // IPv6 security - disable IPv6 to reduce attack surface
104+ " --sysctl=net.ipv6.conf.all.disable_ipv6=1" // Disable IPv6 globally
105+ " --sysctl=net.ipv6.conf.default.disable_ipv6=1" // Disable IPv6 by default
106+
107+ // Network capability restrictions
108+ " --cap-drop=NET_RAW" // Disable raw packet access
109+ " --network=bridge" // Use bridge networking
110+
111+ // DNS configuration for security and reliability
112+ " --dns=1.1.1.1" // Primary DNS (Cloudflare)
113+ " --dns=1.0.0.1" // Secondary DNS (Cloudflare)
114+
115+ // Resource limits for container performance and security
116+ // Play a little bit with resources to prevent resource exhaustion
117+ // "--memory=512m", // Memory limit (commented out)
118+ // "--cpus=2" // CPU limit (commented out)
119+ ],
120+
121+ // Writable mounts in case you want to set --read-only above.
122+ // Currently no additional mounts are configured
123+ "mounts" : [
124+ ]
109125}
0 commit comments