Skip to content

[tech] Microsoft changed the tag name for ubuntu devcontainers after …#34

Merged
DarkaMaul merged 3 commits intotrailofbits:mainfrom
ebendler:update_apps
Mar 23, 2026
Merged

[tech] Microsoft changed the tag name for ubuntu devcontainers after …#34
DarkaMaul merged 3 commits intotrailofbits:mainfrom
ebendler:update_apps

Conversation

@ebendler
Copy link
Copy Markdown
Contributor

@ebendler ebendler commented Mar 12, 2026

…2.0.5, so fix that and point to 2.1.7-ubuntu24.04. Also update uv to 0.10.9 and fzf to 0.70.0.

Here's the commit where msft broke it: devcontainers/images@92a034a

@CLAassistant
Copy link
Copy Markdown

CLAassistant commented Mar 12, 2026

CLA assistant check
All committers have signed the CLA.

Copy link
Copy Markdown
Contributor

@DarkaMaul DarkaMaul left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot for the update here!

I'm wondering if we could not set up dependabot to automatically update our dependencies here.

Comment thread Dockerfile Outdated
@ebendler
Copy link
Copy Markdown
Contributor Author

Thanks a lot for the update here!

I'm wondering if we could not set up dependabot to automatically update our dependencies here.

I know it can update base images if the format is correct (wouldn't work here because msft changed the tag naming), let me see if the other stuff can be automated.

Microsoft changed how they name the Ubuntu base container from
"ubuntu-24.04" to "ubuntu24.04", so it was impossible to automate update
detection.

The uv tag was updated to "0.10" with a hash to pin so that dependabot
can understand it.

Add "git" devc feature to the JSON so that the latest git is used
instead of the one in apt.

Also add a dependabot config to update the base image hashes weekly and
check for devc feature updates.
@ebendler
Copy link
Copy Markdown
Contributor Author

OK, so there does not seem to be any capability to automate version checking inside the Dockerfile. If you don't care about pinning precise versions of stuff like fzf, fd, rg, there are devc features for that. But I'll leave that up do you all.

@DarkaMaul
Copy link
Copy Markdown
Contributor

Hi! Thanks for your patience here :)
I'm going to merge this one without the dependabot change, and set up a renovate bot to keep this updated.

@DarkaMaul DarkaMaul merged commit 40ca54d into trailofbits:main Mar 23, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants