vscode: cannot use devcontainers and ssh remotes

[tmstn]

I've got vscode running in a sandbox with the following profile

${HOME}/.config/firejail/code.profile

include code-extended.profile
net fu_code
include /etc/firejail/code.profile
name code

fu_code is a bridge network running on 10.105.50.0/24.

code-extended.profile

whitelist ${HOME}/.config/Code
whitelist ${HOME}/.vscode
whitelist ${HOME}/.bin
whitelist ${HOME}/.scripts
whitelist ${HOME}/.containers
whitelist ${HOME}/data/dev
ignore read-only ${HOME}/.bin

Tunnelling through github works fine, but it seems strange for me to send and receive data through a remote location when the container is running on the same host so I would prefer to both connect to an ssh server bound to localhost (127.0.0.1:2222) by the container and attach to the running container (not at the same time obviously, but I would like both options available).

What do I need to add to my profiles to enable the vscode remotes functionality to work?

The commands used to run vscode and attach or ssh to the containers are :

firejail --quiet code --folder-uri "vscode-remote://ssh-remote+{hostname}/{remote_dir}"

or

firejail --quiet code --folder-uri "vscode-remote://attached-container+$(printf {container_id} | xxd -p)/{remote_dir}"

The ${HOME}/.ssh/config file is as allows:

Host {hostname}
	HostName 127.0.0.1
	Port 2222
	User root
	IdentityFile {key_file_path}/id_rsa
	StrictHostKeyChecking no

The $HOME/.config/Code/User/globalStorage/ms-vscode-remote.remote-containers/imageConfigs/localhost%2f{image_name}%3alatest.json file for attaching is as follows:

{
  "customizations": {
    "vscode": {
      "extensions": [
      ],
      "settings": {}
    }
  },
  "containerEnv": {
    "HOME": "/root"
  },
  "remoteUser": "root",
  "workspaceFolder": "{remote_dir}"
}

The podman container image is as follows:

FROM mcr.microsoft.com/devcontainers/base:ubuntu

RUN apt-get update
RUN apt-get -y install --no-install-recommends apt-utils 2>&1
RUN apt-get install -y ca-certificates
RUN apt-get -y install git
RUN apt-get install -y zsh
RUN apt-get install -y curl
RUN apt-get -y install openssh-client openssh-server

RUN apt-get update
RUN apt-get autoremove -y
RUN apt-get clean -y
RUN rm -rf /var/lib/apt/lists/*

RUN curl -sL "https://code.visualstudio.com/sha/download?build=stable&os=cli-alpine-x64" --output /tmp/vscode-cli.tar.gz
RUN tar -xf /tmp/vscode-cli.tar.gz -C /usr/bin
RUN rm /tmp/vscode-cli.tar.gz

RUN mkdir /var/run/sshd 
RUN sed -i 's/PermitRootLogin prohibit-password/PermitRootLogin no/' /etc/ssh/sshd_config
RUN sed 's@session\s*required\s*pam_loginuid.so@session optional pam_loginuid.so@g' -i /etc/pam.d/sshd
RUN echo "export VISIBLE=now" >> /etc/profile

WORKDIR /root

RUN mkdir -p "/root/.vscode"
RUN mkdir -p "/root/.vscode-server"
RUN mkdir -p "/root/.ssh"
RUN chmod 700 /root/.ssh
COPY --chmod=600 {key_file_path}/id_rsa.pub /root/.ssh/authorized_keys

EXPOSE 22

The container is started with the following commands:

podman create \
  --name {container_name} \
  --ulimit nofile=102400:102400 \
  --network bridge \
  --publish 127.0.0.1:2222:22 \
  --tty \
  localhost/{image_name}

podman start "{container_name}"

Everything works as expected when I run without firejail. SSH works as expected when --noprofile is used but attaching does not. Nothing works when --noprofile is omitted.

SSH when --noprofile is omitted shows an error dialog with the message:

Could not establish connection to "{hostname}":
ssh is not on the PATH

The error log is:

[15:03:07.644] Log Level: 2
[15:03:07.677] VS Code version: 1.92.2
[15:03:07.677] Remote-SSH version: [email protected]
[15:03:07.677] linux x64
[15:03:07.691] SSH Resolver called for "ssh-remote+{hostname}", attempt 1
[15:03:07.693] "remote.SSH.useLocalServer": true
[15:03:07.693] "remote.SSH.useExecServer": true
[15:03:07.694] "remote.SSH.path": undefined
[15:03:07.694] "remote.SSH.configFile": undefined
[15:03:07.694] "remote.SSH.useFlock": true
[15:03:07.694] "remote.SSH.lockfilesInTmp": false
[15:03:07.695] "remote.SSH.localServerDownload": auto
[15:03:07.695] "remote.SSH.remoteServerListenOnSocket": false
[15:03:07.695] "remote.SSH.showLoginTerminal": false
[15:03:07.695] "remote.SSH.defaultExtensions": []
[15:03:07.696] "remote.SSH.loglevel": 2
[15:03:07.696] "remote.SSH.enableDynamicForwarding": true
[15:03:07.696] "remote.SSH.enableRemoteCommand": false
[15:03:07.696] "remote.SSH.serverPickPortsFromRange": {}
[15:03:07.697] "remote.SSH.serverInstallPath": {}
[15:03:07.697] "remote.SSH.permitPtyAllocation": false
[15:03:07.697] "remote.SSH.preferredLocalPortRange: undefined
[15:03:07.697] "remote.SSH.useCurlAndWgetConfigurationFiles: false
[15:03:07.724] SSH Resolver called for host: {hostname}
[15:03:07.724] Setting up SSH remote "{hostname}"
[15:03:07.736] Acquiring local install lock: /tmp/vscode-remote-ssh-bc968cd2-install.lock
[15:03:07.742] Looking for existing server data file at /home/tom/.config/Code/User/globalStorage/ms-vscode-remote.remote-ssh/vscode-ssh-host-bc968cd2-fee1edb8d6d72a0ddff41e5f71a671c23ed924b9-0.113.1-es/data.json
[15:03:07.743] Using commit id "fee1edb8d6d72a0ddff41e5f71a671c23ed924b9" and quality "stable" for server
[15:03:07.748] Install and start server if needed
[15:03:07.764] PATH: /home/tom/.go/bin:/home/tom/.scripts:/home/tom/.bin:/usr/local/bin:/home/tom/.go/bin:/home/tom/.scripts:/home/tom/.bin:/usr/local/bin:/home/tom/.go/bin:/home/tom/.scripts:/home/tom/.bin:/usr/local/bin:/home/tom/.go/bin:/home/tom/.scripts:/home/tom/.bin:/usr/local/bin:/home/tom/.go/bin:/home/tom/.scripts:/home/tom/.bin:/usr/local/bin:/home/tom/.go/bin:/home/tom/.scripts:/home/tom/.bin:/usr/local/bin:/home/tom/.go/bin:/home/tom/.scripts:/home/tom/.bin:/usr/local/bin:/home/tom/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/bin:/home/tom/.local/share/flatpak/exports/bin:/var/lib/flatpak/exports/bin:/usr/bin/site_perl:/usr/bin/vendor_perl:/usr/bin/core_perl
[15:03:07.764] Checking ssh with "ssh -V"
[15:03:07.796] Got error from ssh: spawn ssh EACCES
[15:03:07.797] Finding installed ssh failed: ssh is not on the PATH
[15:03:07.800] Resolver error: Error: ssh is not on the PATH
	at /home/tom/.vscode/extensions/ms-vscode-remote.remote-ssh-0.113.1/out/extension.js:2:594000
	at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
	at async T (/home/tom/.vscode/extensions/ms-vscode-remote.remote-ssh-0.113.1/out/extension.js:2:589165)
	at async t.getSshCommandPath (/home/tom/.vscode/extensions/ms-vscode-remote.remote-ssh-0.113.1/out/extension.js:2:592446)
	at async P.create (/home/tom/.vscode/extensions/ms-vscode-remote.remote-ssh-0.113.1/out/extension.js:2:566228)
	at async e (/home/tom/.vscode/extensions/ms-vscode-remote.remote-ssh-0.113.1/out/extension.js:2:559528)
	at async /home/tom/.vscode/extensions/ms-vscode-remote.remote-ssh-0.113.1/out/extension.js:2:582435
	at async t.withShowDetailsEvent (/home/tom/.vscode/extensions/ms-vscode-remote.remote-ssh-0.113.1/out/extension.js:2:586054)
	at async /home/tom/.vscode/extensions/ms-vscode-remote.remote-ssh-0.113.1/out/extension.js:2:557083
	at async T (/home/tom/.vscode/extensions/ms-vscode-remote.remote-ssh-0.113.1/out/extension.js:2:555134)
	at async t.resolveWithLocalServer (/home/tom/.vscode/extensions/ms-vscode-remote.remote-ssh-0.113.1/out/extension.js:2:556623)
	at async k (/home/tom/.vscode/extensions/ms-vscode-remote.remote-ssh-0.113.1/out/extension.js:2:579574)
	at async t.resolve (/home/tom/.vscode/extensions/ms-vscode-remote.remote-ssh-0.113.1/out/extension.js:2:583465)
	at async /home/tom/.vscode/extensions/ms-vscode-remote.remote-ssh-0.113.1/out/extension.js:2:851126
[15:03:07.823] ------

[15:03:08.777] Opening exec server for ssh-remote+{hostname}
[15:03:08.824] Acquiring local install lock: /tmp/vscode-remote-ssh-bc968cd2-install.lock
[15:03:08.825] Initizing new exec server for ssh-remote+{hostname}
[15:03:08.968] Looking for existing server data file at /home/tom/.config/Code/User/globalStorage/ms-vscode-remote.remote-ssh/vscode-ssh-host-bc968cd2-fee1edb8d6d72a0ddff41e5f71a671c23ed924b9-0.113.1-es/data.json
[15:03:08.996] Using commit id "fee1edb8d6d72a0ddff41e5f71a671c23ed924b9" and quality "stable" for server
[15:03:09.001] Install and start server if needed
[15:03:09.018] PATH: /home/tom/.go/bin:/home/tom/.scripts:/home/tom/.bin:/usr/local/bin:/home/tom/.go/bin:/home/tom/.scripts:/home/tom/.bin:/usr/local/bin:/home/tom/.go/bin:/home/tom/.scripts:/home/tom/.bin:/usr/local/bin:/home/tom/.go/bin:/home/tom/.scripts:/home/tom/.bin:/usr/local/bin:/home/tom/.go/bin:/home/tom/.scripts:/home/tom/.bin:/usr/local/bin:/home/tom/.go/bin:/home/tom/.scripts:/home/tom/.bin:/usr/local/bin:/home/tom/.go/bin:/home/tom/.scripts:/home/tom/.bin:/usr/local/bin:/home/tom/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/bin:/home/tom/.local/share/flatpak/exports/bin:/var/lib/flatpak/exports/bin:/usr/bin/site_perl:/usr/bin/vendor_perl:/usr/bin/core_perl
[15:03:09.018] Checking ssh with "ssh -V"
[15:03:09.033] Got error from ssh: spawn ssh EACCES
[15:03:09.034] Finding installed ssh failed: ssh is not on the PATH
[15:03:09.036] Exec server for ssh-remote+{hostname} failed: Error: ssh is not on the PATH
[15:03:09.037] Error opening exec server for ssh-remote+{hostname}: Error: ssh is not on the PATH

Attach in both cases shows an error dialog with the message:

Cannot attach to the container with name/id {container_id}, it no longer exists.

The error log is

[66 ms] Dev Containers 0.380.0 in VS Code 1.92.2 (fee1edb8d6d72a0ddff41e5f71a671c23ed924b9).
[65 ms] Start: Resolving Remote
[69 ms] Setting up container: {container_id}
[85 ms] Start: Run: podman inspect --type container {container_id}

When I click "More Actions", then "Choose Container" another error dialog appears:

**Docker returned an error.**
Make sure the Docker daemon is running

And the following is appended to the error log

[39496 ms] Getting Docker parameters for own remote.
[39549 ms] Start: Run: podman version --format {{json .}}
[39579 ms] time="2024-08-26T15:09:33+01:00" level=error msg="set sticky bit on: chmod /run/user/1001/libpod: read-only file system"

[39581 ms] Exit code 1

[rusty-snake]

net fu_code
running on the same host
127.0.0.1:2222

If you have two network namespaces (that's what net does), you have two loopback interfaces.

See #108.

${HOME}/.config/firejail/code.profile

Why don't use a .local?

[tmstn]

I did wonder whether the network would become a problem after solving the PATH issue but I didn't want to get ahead of myself. I tried running with --noprofile --net=fu_code and got the following error dialog:

Could not establish connection to "{hostname}".

And the error log:

[15:45:34.119] Received install output: local-server-2> Running ssh connection command: ssh -v -T -D 44359 -o ConnectTimeout=15 {hostname}
local-server-2> Spawned ssh, pid=177
OpenSSH_9.8p1, OpenSSL 3.3.1 4 Jun 2024
ssh: connect to host 127.0.0.1 port 2222: Connection refused
local-server-2> ssh child died, shutting down

[15:45:34.119] Failed to parse remote port from server output
[15:45:34.120] Exec server for ssh-remote+{hostname} failed: Error
[15:45:34.120] Error opening exec server for ssh-remote+{hostname}: Error

So I've created a new profile for when working with devcontainers called code-devcon.profile:

include code-extended.profile
include /etc/firejail/code.profile
name code

And changed the firejail command to:

firejail --profile=code-devcon --quiet code --folder-uri "vscode-remote://ssh-remote+{hostname}/{remote_dir}"

And we are back to the PATH error from the original post.

Would using .local file extensions change functionality at all. I am open to using it either way if its the standard.