Debian:12 for base image, build pipeline and prefetch of srl image by hellt · Pull Request #1 · eda-labs/codespaces

hellt · 2026-01-08T20:05:59Z

need to fix the k3s image to match the k8s version we use in kind

Copilot

Pull request overview

This pull request migrates the devcontainer base image from Ubuntu to Debian 12 (Bookworm), adds a GitHub Actions workflow for automated image building, and introduces a configuration file for resource-constrained codespaces environments. The changes also include pinning k3d to v5.8.3 and prefetching the SRL (SR Linux) container image.

Key Changes:

New GitHub Actions workflow to build and push devcontainer images to GHCR
Migration from Ubuntu-based to Debian 12 base image with manual user setup
Added KPT setters configuration file for 4vCPU codespaces with minimal CPU resource requirements

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
.github/workflows/build-devcontainer.yml	New workflow for building and pushing devcontainer images on PR, release, and manual trigger
.devcontainer/Dockerfile	Migrated to Debian 12, added user creation, pinned k3d version, added SRL image prefetch logic
.devcontainer/devcontainer.json	Updated image reference to new GHCR location with PR tag, added auto-forward browser action
.devcontainer/postCreate.sh	Simplified to use KPT setters file, removed separate keycloak configuration step
.devcontainer/codespaces-4vcpu-kpt-setters.yaml	New configuration file defining minimal CPU resource requirements for codespaces deployment

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-09T16:46:41Z

.devcontainer/codespaces-4vcpu-kpt-setters.yaml

@@ -0,0 +1,30 @@
+# This setters file is meant for use in codespaces (4vcpu) VMs
+# to provide configuration for the EDA platform
+# It is applied in the codespaces post-create script as an argument to `make try-eda.


The comment has a typo - "codespaces post-create script as an argument to make try-eda." is missing the closing backtick. It should be "argument to make try-eda`."

Suggested change

# It is applied in the codespaces post-create script as an argument to `make try-eda.

# It is applied in the codespaces post-create script as an argument to `make try-eda`.

Copilot · 2026-01-09T16:46:41Z

.devcontainer/Dockerfile

+RUN SRL=$(curl -s "https://raw.githubusercontent.com/nokia-eda/playground/refs/heads/main/topology/3-nodes-srl.yaml" | $EDA_PLAYGROUND_DIR/tools/yq '.spec.nodeTemplates | filter(.name == "default").[].nodeProfile'); \
+    curl "https://raw.githubusercontent.com/nokia-eda/kpt/refs/heads/main/eda-kpt-playground/$SRL/engine_v1_nodeprofile_srlinux_${SRL//[^0-9.]/}.yaml" | \
+    $EDA_PLAYGROUND_DIR/tools/yq '.spec.containerImage' >> $HOME/.images.txt


The curl command in the complex shell pipeline lacks error handling. If any of the curl requests fail or the yq filtering produces no results, the script will continue silently. Consider adding error checks (set -e, or checking exit codes) to ensure the SRL image URL is successfully retrieved and appended.

Suggested change

RUN SRL=$(curl -s "https://raw.githubusercontent.com/nokia-eda/playground/refs/heads/main/topology/3-nodes-srl.yaml" | $EDA_PLAYGROUND_DIR/tools/yq '.spec.nodeTemplates | filter(.name == "default").[].nodeProfile'); \

curl "https://raw.githubusercontent.com/nokia-eda/kpt/refs/heads/main/eda-kpt-playground/$SRL/engine_v1_nodeprofile_srlinux_${SRL//[^0-9.]/}.yaml" | \

$EDA_PLAYGROUND_DIR/tools/yq '.spec.containerImage' >> $HOME/.images.txt

RUN set -euo pipefail; \

SRL=$(curl -fsSL "https://raw.githubusercontent.com/nokia-eda/playground/refs/heads/main/topology/3-nodes-srl.yaml" | \

"$EDA_PLAYGROUND_DIR/tools/yq" '.spec.nodeTemplates | filter(.name == "default").[].nodeProfile'); \

if [[ -z "${SRL:-}" ]]; then \

echo "Error: Failed to retrieve SRL node profile from topology definition." >&2; \

exit 1; \

fi; \

IMAGE_URL=$(curl -fsSL "https://raw.githubusercontent.com/nokia-eda/kpt/refs/heads/main/eda-kpt-playground/$SRL/engine_v1_nodeprofile_srlinux_${SRL//[^0-9.]/}.yaml" | \

"$EDA_PLAYGROUND_DIR/tools/yq" '.spec.containerImage'); \

if [[ -z "${IMAGE_URL:-}" ]]; then \

echo "Error: Failed to extract SRL container image from node profile." >&2; \

exit 1; \

fi; \

echo "$IMAGE_URL" >> "$HOME/.images.txt"

Copilot · 2026-01-09T16:46:42Z

.github/workflows/build-devcontainer.yml

+jobs:
+  build:
+    name: Build and Push
+    runs-on: ubuntu-24.04


The workflow uses ubuntu-24.04 as the runner. While this is valid, verify that ubuntu-24.04 is available in your GitHub Actions environment as it's a newer LTS version. If there are any compatibility concerns, ubuntu-22.04 or ubuntu-latest might be safer alternatives.

Suggested change

runs-on: ubuntu-24.04

runs-on: ubuntu-22.04

Copilot · 2026-01-09T16:46:42Z

.github/workflows/build-devcontainer.yml

+            type=ref,event=pr
+            type=ref,event=tag
+            type=sha
+
+      - name: Build and push image
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ env.CONTEXT }}
+          file: ${{ env.DOCKERFILE }}
+          push: true


The workflow pushes images on every pull request (type=ref,event=pr), which could clutter the registry with numerous PR images. Consider whether images should only be pushed on merge to main or specific branches, or add cleanup logic for PR images.

Suggested change

type=ref,event=pr

type=ref,event=tag

type=sha

- name: Build and push image

uses: docker/build-push-action@v6

with:

context: ${{ env.CONTEXT }}

file: ${{ env.DOCKERFILE }}

push: true

type=ref,event=tag

type=sha

- name: Build and push image

uses: docker/build-push-action@v6

with:

with:

context: ${{ env.CONTEXT }}

file: ${{ env.DOCKERFILE }}

push: ${{ github.event_name != 'pull_request' }}

Copilot · 2026-01-09T16:46:42Z

.devcontainer/devcontainer.json

 {
    "name": "Nokia EDA in GitHub Codespaces",
-    "image": "ghcr.io/eda-labs/eda-devcontainer:latest",
+    "image": "ghcr.io/eda-labs/codespaces/base:pr-1",


The image tag is set to "pr-1" which appears to be a temporary testing tag. This should be updated to a production-ready tag (e.g., "latest", a version tag, or "main") before merging to ensure the devcontainer uses the correct stable image.

Suggested change

"image": "ghcr.io/eda-labs/codespaces/base:pr-1",

"image": "ghcr.io/eda-labs/codespaces/base:latest",

Copilot · 2026-01-09T16:46:43Z

.devcontainer/Dockerfile

+COPY codespaces-4vcpu-kpt-setters.yaml /eda-codespaces/codespaces-4vcpu-kpt-setters.yaml

-RUN curl -s https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash
+RUN curl -fsSL --retry 3 https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | TAG=v5.8.3 bash


curl is downloading and piping https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh directly into bash while running as root, and the script is only pinned to the mutable main branch with no integrity verification. If the k3d GitHub repo or the network path is compromised, an attacker can serve arbitrary shell commands and gain code execution in the build environment (and any CI/CD context using this Dockerfile). To mitigate this, pin to an immutable reference (e.g., a specific commit or release asset) and verify its integrity (checksum/signature) before execution, or vendor the installer script in the repo instead of executing it directly from the network.

Copilot · 2026-01-09T16:46:43Z

.devcontainer/Dockerfile

 USER vscode

-RUN git clone "https://github.com/$EDA_PLAYGROUND_REPO" $EDA_PLAYGROUND_DIR && cd $EDA_PLAYGROUND_DIR && make download-tools
+RUN git clone --depth 1 "https://github.com/$EDA_PLAYGROUND_REPO" $EDA_PLAYGROUND_DIR && cd $EDA_PLAYGROUND_DIR && make download-tools


This RUN git clone --depth 1 "https://github.com/$EDA_PLAYGROUND_REPO" ... && make download-tools step pulls code from an unpinned external GitHub repository and immediately executes its Makefile, with the repository location also overridable via the EDA_PLAYGROUND_REPO build arg. Because the fetched code is not tied to an immutable commit or verified by checksum/signature, a compromise of that GitHub repo (or a malicious override of the build arg) would allow arbitrary code execution during image build. To reduce this supply-chain risk, pin the clone to a specific, trusted commit or release and/or mirror/vendor the code in a controlled repository, and avoid allowing untrusted overrides of the repo location.

hellt and others added 11 commits January 8, 2026 21:05

use bookworm

6c21650

added zsh and tools path to zsh

f364a48

rename base image

f0a9852

Add the SRL image to the pre pull list

cf65760

added build workflow

29af4bb

assuming context

a00eaf4

explicit context

baa6ffc

im dumb

11d6b5d

default perms

8257652

use image name

6ca6008

use perms

9e73098

hellt changed the title ~~use bookworm~~ Debian:12 for base image, build pipeline and prefetch of srl image Jan 9, 2026

hellt and others added 8 commits January 9, 2026 13:16

use repo image

ee4e431

use all ref tags

78ec49a

sigh

218e785

Add custom kpt setters file invocation

20a04bb

Remove duplicate keycloak config step after try-eda executes

4c4c8f8

host codespaces setters

0e9fe79

Open EDA UI in new tab on port auto forward

253575d

use non tmp path

feb60f9

hellt marked this pull request as ready for review January 9, 2026 16:41

Copilot AI review requested due to automatic review settings January 9, 2026 16:41

hellt merged commit f2772f0 into main Jan 9, 2026
1 check passed

Copilot started reviewing on behalf of hellt January 9, 2026 16:41 View session

Copilot AI reviewed Jan 9, 2026

View reviewed changes

hellt deleted the bookworm-base-image branch January 9, 2026 20:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Debian:12 for base image, build pipeline and prefetch of srl image#1

Debian:12 for base image, build pipeline and prefetch of srl image#1
hellt merged 19 commits intomainfrom
bookworm-base-image

hellt commented Jan 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 9, 2026

Uh oh!

Copilot AI Jan 9, 2026

Uh oh!

Copilot AI Jan 9, 2026

Uh oh!

Copilot AI Jan 9, 2026

Uh oh!

Copilot AI Jan 9, 2026

Uh oh!

Copilot AI Jan 9, 2026

Uh oh!

Copilot AI Jan 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	# It is applied in the codespaces post-create script as an argument to `make try-eda.
	# It is applied in the codespaces post-create script as an argument to `make try-eda`.

-RUN SRL=$(curl -s "https://raw.githubusercontent.com/nokia-eda/playground/refs/heads/main/topology/3-nodes-srl.yaml" | $EDA_PLAYGROUND_DIR/tools/yq '.spec.nodeTemplates | filter(.name == "default").[].nodeProfile'); \
-    curl "https://raw.githubusercontent.com/nokia-eda/kpt/refs/heads/main/eda-kpt-playground/$SRL/engine_v1_nodeprofile_srlinux_${SRL//[^0-9.]/}.yaml" | \
-    $EDA_PLAYGROUND_DIR/tools/yq '.spec.containerImage' >> $HOME/.images.txt
+RUN set -euo pipefail; \
+    SRL=$(curl -fsSL "https://raw.githubusercontent.com/nokia-eda/playground/refs/heads/main/topology/3-nodes-srl.yaml" | \
+      "$EDA_PLAYGROUND_DIR/tools/yq" '.spec.nodeTemplates | filter(.name == "default").[].nodeProfile'); \
+    if [[ -z "${SRL:-}" ]]; then \
+      echo "Error: Failed to retrieve SRL node profile from topology definition." >&2; \
+      exit 1; \
+    fi; \
+    IMAGE_URL=$(curl -fsSL "https://raw.githubusercontent.com/nokia-eda/kpt/refs/heads/main/eda-kpt-playground/$SRL/engine_v1_nodeprofile_srlinux_${SRL//[^0-9.]/}.yaml" | \
+      "$EDA_PLAYGROUND_DIR/tools/yq" '.spec.containerImage'); \
+    if [[ -z "${IMAGE_URL:-}" ]]; then \
+      echo "Error: Failed to extract SRL container image from node profile." >&2; \
+      exit 1; \
+    fi; \
+    echo "$IMAGE_URL" >> "$HOME/.images.txt"

	"image": "ghcr.io/eda-labs/codespaces/base:pr-1",
	"image": "ghcr.io/eda-labs/codespaces/base:latest",

Conversation

hellt commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hellt commented Jan 8, 2026 •

edited

Loading