v0.1.1
What's new in v0.1.1
This release fixes the /api browser-trust fence (HTTP 403) pain point for network access and
simplifies the port-exposure design.
Fixes & improvements
DSH_TRUSTED_HOSTSenvironment variable — declare thehost[:port]authorities the/api
browser-trust fence accepts (space- or comma-separated list; each entry is passed as
--trusted-hosttodsh web). Required when browsers reach the UI from a non-loopback address
(LAN IP, domain name, or a Host-preserving reverse proxy); loopback access needs no configuration.
This addresses thetransport failure for /api/host.listDirectory: HTTP 403errors seen when
opening the UI over the network.- Simplified port exposure — the socat forwarder now listens on
0.0.0.0:3081inside the
container and forwards to dsh's127.0.0.1:3080. Because the two ports differ, the forwarder can
bind the wildcard address directly, and the previous container-IP detection workaround is gone.
The exposed port is now 3081 (update host mappings: compose"3081:3081", Quadlet
PublishPort=3081:3081). DSH_WEB_HOSTremoved — the loopback-only toggle is gone. For loopback-only use, simply don't
publish the port: the/apitrust fence already only allows loopback hosts unless
DSH_TRUSTED_HOSTSdeclares otherwise.- Home-based defaults —
DSH_HOMEnow defaults to$HOME/dshand the newDSH_WORKSPACE
defaults to$HOME/workspace(/home/codespace/dshand/home/codespace/workspaceon the
universal 6.x base). The entrypoint creates both and runs dsh from the workspace. Legacy 2.x
base images (vscodeuser) automatically follow their own home. - Docs & examples updated — README (EN + 中文), deployment and security guides, the
compose/Quadlet examples, and the CI smoke test all reflect the new layout. Raw
--trusted-hostpassthrough viacommand/Exec=still works alongside the env var. - AGENTS.md added — guidelines for agents and contributors working on this repository.
Breaking changes (vs v0.1.0)
- Exposed port changed from
3080to3081; update your port mappings. DSH_WEB_HOSTenvironment variable removed.
Upgrade note
Rebuild or pull the new image and recreate the container — the entrypoint, environment variables,
and exposed port have all changed.