Repository navigation
Expand file tree
/
Copy pathdevcontainer.json
More file actions
74 lines (68 loc) · 3.42 KB
/
Copy pathdevcontainer.json
File metadata and controls
74 lines (68 loc) · 3.42 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
{
"name": "Ghost",
"dockerComposeFile": ["../compose.dev.yaml", "compose.devcontainer.yaml"],
"service": "ghost-dev",
"workspaceFolder": "/workspaces/Ghost",
"shutdownAction": "stopCompose",
"remoteUser": "root",
// Installs docker CLI and mounts the host docker socket into ghost-dev so
// developers can run `docker ps / logs / inspect / exec` against peer
// compose services (mysql, redis, mailpit, gateway) from inside the dev
// container. Without this, diagnosing any compose-peer failure requires
// SSHing to the Codespaces host, which our image doesn't support out of
// the box.
//
// Security note: mounting the host's docker socket combined with
// `remoteUser: "root"` effectively gives the dev container root-equivalent
// control over the host Docker daemon (spawn privileged containers, mount
// host paths, etc.). This is the standard pattern for local / Codespaces
// dev containers where the host is the developer's own machine, but do
// NOT replicate this pattern in shared build agents, CI runners, or
// environments where untrusted code runs in the container.
// sshd enables `gh codespace ssh`/`logs` for direct diagnosis (top,
// free, docker stats) instead of only being able to probe over HTTP.
// Same trust boundary as docker-outside-of-docker below — standard for
// a Codespace/local dev container where the host is your own machine.
"features": {
"ghcr.io/devcontainers/features/docker-outside-of-docker:1": {},
"ghcr.io/devcontainers/features/sshd:1": {}
},
// Runs once the workspace mount is ready, after the container is created.
// Note: no Codespaces prebuild is configured for this repo, so this runs
// live on every creation rather than being baked into a snapshot ahead of
// time. A failed install must stop setup because postCreateCommand assumes
// workspace dependencies are available.
"onCreateCommand": "corepack enable && corepack prepare --activate && cd /workspaces/Ghost && pnpm install --prefer-offline",
// Runs after the workspace mount is ready on every container create.
"postCreateCommand": ".devcontainer/postCreate.sh",
// Runs whenever VS Code attaches to the container. Fires only inside the
// container, so this is safe (unlike a tasks.json runOn: folderOpen which
// also fires on host VS Code where node_modules doesn't exist yet).
// The script guards against double-starting if the stack is already up.
"postAttachCommand": "bash .devcontainer/start-dev-stack.sh",
// Portal, Comments UI, Signup Form, Sodo Search, Announcement Bar, and
// Admin Toolbar are NOT listed here — since the Caddy file_server switch
// (#28970) they build to disk (`vite build --watch`) instead of running
// a dev server, so there's no port to forward for them.
"forwardPorts": [2368, 3306, 6379, 1025, 8025, 5174, 4200, 4173],
"portsAttributes": {
"2368": { "label": "Ghost (via gateway)", "onAutoForward": "notify" },
"3306": { "label": "MySQL" },
"6379": { "label": "Redis" },
"1025": { "label": "Mailpit SMTP" },
"8025": { "label": "Mailpit Web" },
"5174": { "label": "Admin (Vite)" },
"4200": { "label": "Ember live-reload" },
"4173": { "label": "Koenig Lexical (optional)" }
},
"customizations": {
"vscode": {
"extensions": [
"dbaeumer.vscode-eslint",
"bradlc.vscode-tailwindcss",
"ms-playwright.playwright",
"editorconfig.editorconfig"
]
}
}
}