`docker-in-docker` -`buildx` gets removed on `codespaces` by "Configuring codespace..." step

[stefan-cukl]

.devcontainer/devcontainer.json

{
  "image": "mcr.microsoft.com/devcontainers/python:3",
  "features": {
    "ghcr.io/devcontainers/features/docker-in-docker:2": {
      "moby": false
    }
  }
}

the feature installs buildx under the ${_REMOTE_USER_HOME}/.docker/cli-plugins/docker-buildx path

features/src/docker-in-docker/install.sh

Lines 317 to 326 in 1869e59

	if [ "${INSTALL_DOCKER_BUILDX}" = "true" ]; then
	buildx_version="latest"
	find_version_from_git_tags buildx_version "https://github.com/docker/buildx" "refs/tags/v"
	echo "(*) Installing buildx ${buildx_version}..."
	buildx_file_name="buildx-v${buildx_version}.linux-${architecture}"
	cd /tmp && wget "https://github.com/docker/buildx/releases/download/v${buildx_version}/${buildx_file_name}"
	mkdir -p ${_REMOTE_USER_HOME}/.docker/cli-plugins
	mv ${buildx_file_name} ${_REMOTE_USER_HOME}/.docker/cli-plugins/docker-buildx

BUT there's a final step in the container build that removes the ${_REMOTE_USER_HOME}/.docker folder

creation.log @ codespaces

...
=================================================================================
2023-05-12 09:31:38.786Z: Configuring codespace...
2023-05-12 09:31:38.788Z: $ cp -r /root/.docker /var/lib/docker/codespacemount/.persistedshare
2023-05-12 09:31:38.789Z: cp process exited with exit code 0
2023-05-12 09:31:38.790Z: $ rm -rf /home/vscode/.docker
2023-05-12 09:31:38.791Z: rm process exited with exit code 0
2023-05-12 09:31:38.791Z: $ ln -sfn /workspaces/.codespaces/.persistedshare/.docker /home/vscode/.docker
2023-05-12 09:31:38.792Z: ln process exited with exit code 0
2023-05-12 09:31:38.792Z: $ chown -R vscode /workspaces/.codespaces/.persistedshare/.docker
2023-05-12 09:31:38.793Z: chown process exited with exit code 0

[jkeech]

This looks like an incompatibility with Codespaces specifically. Codespaces is setting up ~/.docker primarily to enable automatic login for docker-in-docker using container registry secrets via the ~/.docker/config.json file.

I can think of a few possible solutions. I'm sure there are others as well.

• Codespaces could do a more targeted update of that file directly instead of the entire ~/.docker folder
• Codespaces could switch to setting up cred store in the container (which has some performance penalties relative to the file when restarting the codespace).
• We could also offer an opt-out mechanism under the customizations.codespaces namespace in the devcontainer.json file to skip setting up docker auth automatically inside the main dev container. This would leave ~/.docker completely untouched, but also not pre-authenticated to any registries.

cc @samruddhikhandale @joshspicer

[samruddhikhandale]

Appreciate all the 💡

Codespaces is setting up ~/.docker primarily to enable automatic login for docker-in-docker using container registry secrets via the ~/.docker/config.json file.

I believe this behavior is only Codespace specific? If Codespaces adds this ~/.docker/config.json file, then it makes sense to delete it instead of the entire ~/.docker folder.

Codespaces could do a more targeted update of that file directly instead of the entire ~/.docker folder

+1

[stefan-cukl]

this is now fixed by #827