devcontainers: run git on the host

[florian-lackner365]

What are you proposing?

Let's add a config option for devcontainers that makes Zed run git commands on the host.

It could be a simple setting like:

• Run git on the host

Why does this matter?

Git operations are a recurring point of friction in devcontainers, e.g. #47121. The git setup of developers is often non-standard and in any case the git binary needs access to the users credentials (SSH / PGP). The official stance of the devcontainers maintainers seems to be:

add your git config and credentials to your container

Why is this problematic?

1. It's not straightforward, because git reads a lot of config files. It's hard to make it work for every possible setup.
2. Devcontainers run untrusted code and from a security point of view it's preferable to render credentials inaccessible.

Are there any examples or context?

Here's the corresponding help page for VS Code. It's complicated to get this working and it needs to be redone for every container.

Possible approach

I think there might be a better solution: Perform your git operations on the host.

The credentials / config sharing problem doesn't exist under this setting.

If this is something Zed would be willing to support I can implement it 👍

[lentzi90]

I like this idea! The credentials in the container is an issue that have been bothering me for a while. In more sensitive projects I end up doing development through zed in the container, and then jump out to a normal terminal for git commit and push. For less sensitive stuff I just keep the credentials in the container. This feature would give me the best of both.

[blue42u]

Thanks! As an extension, IMHO a setting to move all write operations outside the container and make the workspace mount read-only would be helpful. Invariably my workspace ends up tainted due to UID mismatches between the host and container users, which is one of my biggest pain points with dev containers (even with VSCode). A read-only workspace mount would prevent the container from accidentally creating files that I need root to remove.

[florian-lackner365]

thank you for you comment.

FYI I faced the same problem and I think it can be worked around by creating a user with the same UID as the host in your devcontainer and by using it to run the IDE. I've got this working 👍 You need to change the devcontainer file though 😢