You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Kubernetes-provider workspace up for a Dockerfile-backed devcontainer fails before the Dockerless build starts:
dockerless build: rename dir: open /workspaces/.dockerless/.devsy-internal: no such file or directory
Root cause
The Kubernetes dockerless fallback (dockerlessFallback in pkg/devcontainer/build.go) generates .devsy-internal/Dockerfile-without-features on the host, inside the Dockerfile build context, before the pod exists. Since Kubernetes has no bind mount, the primary workspace content (including the build context) is delivered into the pod exclusively via the tunnel StreamWorkspace/StreamMount RPCs (pkg/agent/tunnelserver/tunnelserver.go).
Both of those RPCs appended config.BuildArtifactExcludes() (.devsy-internal) to their tar excludes, so the generated build context never reached the pod. In-pod, prepareBuildDirectory (pkg/agent/dockerless.go) then can't find it at either the primary location or the /workspaces/.dockerless fallback, producing the observed rename dir error.
The exclude was introduced in 8e32743af (#615) to fix build-artifact leakage into LocalDockerDelivery's docker-volume seeding (pkg/agent/delivery/workspace_seed.go), which has its own independent tar/exclude logic and is unaffected by this change — the tunnelserver changes in that commit were an unrelated, untested "also fix it here" that caused this regression.
Fix
Remove config.BuildArtifactExcludes() from StreamWorkspace and StreamMount. Cleanup of .devsy-internal is unaffected: it still happens host-side (cleanupBuildInformation in run.go) and in-pod (cleanupBuildDirectory in dockerless.go) after the build.
Testing
pkg/agent/tunnelserver/tunnelserver_test.go: added TestStreamWorkspace_IncludesDevsyInternalBuildArtifacts and TestStreamMount_IncludesDevsyInternalBuildArtifacts, which seed a .devsy-internal/Dockerfile-without-features file and assert it survives the tar stream. Verified both fail against the pre-fix exclude and pass with the fix.
e2e/tests/build/build.go: added "kubernetes dockerless build cleans up .devsy-internal after streaming", exercising the exact repro (Dockerfile-backed devcontainer + Kubernetes provider + up), asserting the build actually ran with the transported Dockerfile and that .devsy-internal doesn't linger in the pod workspace or on the host afterward. Requires a kind cluster; not run locally in this sandbox.
The Kubernetes dockerless fallback generates .devsy-internal build
artifacts on the host before the workspace is streamed into the pod.
StreamWorkspace and StreamMount both appended
config.BuildArtifactExcludes() to their tar excludes, stripping
.devsy-internal from that stream. With no bind mount for Kubernetes,
this was the only transport into the pod, so prepareBuildDirectory
could never find the build context and dockerless build failed before
starting.
The exclude was introduced in 8e32743 (#615) to fix build-artifact
leakage into LocalDockerDelivery's docker-volume seeding
(workspace_seed.go), which has its own independent tar/exclude logic
and is unaffected by this change.
Fixes#1108
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 766a4adb-c024-4993-9dba-896a9963ab34
📥 Commits
Reviewing files that changed from the base of the PR and between fd525aa and b3b9f98.
📒 Files selected for processing (3)
e2e/tests/build/build.go
pkg/agent/tunnelserver/tunnelserver.go
pkg/agent/tunnelserver/tunnelserver_test.go
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.
📝 Walkthrough
Walkthrough
Workspace and mount streaming now preserves Devsy internal Dockerless build artifacts. Unit tests inspect streamed TAR entries, and a Kubernetes end-to-end test verifies Dockerless setup and artifact cleanup.
Added a Kubernetes Dockerless build test that checks SSH setup and confirms .devsy-context is absent from the workspace and host .devcontainer directory after streaming.
The change restores required workspace build artifacts during streaming while preserving cleanup behavior, and no actionable merge-blocking risk remains after normal checks and review.
Possibly related PRs
devsy-org/devsy#615: Directly relates to reversing the streaming build-artifact exclusions while retaining cleanup.
devsy-org/devsy#848: Also changes pkg/agent/tunnelserver/tunnelserver.go and related streaming tests.
AI Reviewer: run a review on demand. To trigger the first review automatically, go to your organization or repository integration settings. AI can make mistakes. Always validate suggestions.
TIP This summary will be updated as you push new changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Kubernetes-provider
workspace upfor a Dockerfile-backed devcontainer fails before the Dockerless build starts:Root cause
The Kubernetes dockerless fallback (
dockerlessFallbackinpkg/devcontainer/build.go) generates.devsy-internal/Dockerfile-without-featureson the host, inside the Dockerfile build context, before the pod exists. Since Kubernetes has no bind mount, the primary workspace content (including the build context) is delivered into the pod exclusively via the tunnelStreamWorkspace/StreamMountRPCs (pkg/agent/tunnelserver/tunnelserver.go).Both of those RPCs appended
config.BuildArtifactExcludes()(.devsy-internal) to their tar excludes, so the generated build context never reached the pod. In-pod,prepareBuildDirectory(pkg/agent/dockerless.go) then can't find it at either the primary location or the/workspaces/.dockerlessfallback, producing the observedrename direrror.The exclude was introduced in
8e32743af(#615) to fix build-artifact leakage intoLocalDockerDelivery's docker-volume seeding (pkg/agent/delivery/workspace_seed.go), which has its own independent tar/exclude logic and is unaffected by this change — the tunnelserver changes in that commit were an unrelated, untested "also fix it here" that caused this regression.Fix
Remove
config.BuildArtifactExcludes()fromStreamWorkspaceandStreamMount. Cleanup of.devsy-internalis unaffected: it still happens host-side (cleanupBuildInformationinrun.go) and in-pod (cleanupBuildDirectoryindockerless.go) after the build.Testing
pkg/agent/tunnelserver/tunnelserver_test.go: addedTestStreamWorkspace_IncludesDevsyInternalBuildArtifactsandTestStreamMount_IncludesDevsyInternalBuildArtifacts, which seed a.devsy-internal/Dockerfile-without-featuresfile and assert it survives the tar stream. Verified both fail against the pre-fix exclude and pass with the fix.e2e/tests/build/build.go: added"kubernetes dockerless build cleans up .devsy-internal after streaming", exercising the exact repro (Dockerfile-backed devcontainer + Kubernetes provider +up), asserting the build actually ran with the transported Dockerfile and that.devsy-internaldoesn't linger in the pod workspace or on the host afterward. Requires a kind cluster; not run locally in this sandbox.Fixes #1108
Summary by CodeRabbit