build: run the dev container on arm64 hosts - #787
Conversation
|
@codex review |
The universal image publishes a linux/amd64 manifest only, so the Dev Container cannot start natively on arm64 hosts. Use the Ubuntu Noble base image, which is multi-arch, and supply Node.js, Python, and Docker through Dev Container features. Node ships a corepack shim for pnpm, so installing pnpm with npm fails on an existing file. Install the release pinned by packageManager through corepack instead, matching how the workflows resolve pnpm. Move the dependency steps into a script the Dev Container and the Ona install task share, and run it when the container is created. pnpm cannot hard link across the workspace mount, so it falls back to a store inside the repository. Ignore that directory.
b4c8893 to
60f66bb
Compare
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
sylvesterkaczmarek
left a comment
sylvesterkaczmarek
left a comment
There was a problem hiding this comment.
One Ona regression in the shared install move: the old task deliberately restricted apt-get update to /etc/apt/sources.list.d/ubuntu.sources with sourceparts=-, but .devcontainer/install.sh now refreshes every configured APT source. If rg is missing, an unrelated/private/broken repo can now fail Ona setup before ripgrep installs. I'd preserve the restricted update for the Ona path, or make the shared script accept that source configuration.
|
@codex review |
|
@sylvesterkaczmarek Thanks for catching this. Added the restricted |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4ab0f31701
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
2 participants
Summary
The Dev Container added in #697 cannot start on an Apple Silicon Mac. Its image,
mcr.microsoft.com/devcontainers/universal:4.0.1-noble, publishes alinux/amd64manifest only, so there is nothing for an arm64 host to run natively.Changes
mcr.microsoft.com/devcontainers/base:noble, which publisheslinux/amd64andlinux/arm64, and add Node.js 22 and Python 3.12 as features. Staying on Ubuntu Noble keeps the userland the Ona automations expect.docker-in-dockerfeature so the container checks fromcontainer-ci.ymlrun in the Dev Container: the image build, thedocker compose configvalidations, and the findings service smoke test.github-clifeature. The universal image bundledgh, and the documentedbulk-scanflow needs it to resolve a GitHub token..devcontainer/devcontainer-lock.json.corepack install, which reads thepackageManagerpin. Node ships a corepack shim for pnpm, sonpm install --global pnpmfails withEEXISTon that shim..devcontainer/install.sh..pnpm-store/, which pnpm creates in the repository because it cannot hard link across the workspace mount.Testing
Ran on an Apple Silicon Mac, in the Dev Container after
Rebuild Container Without Cache(Ubuntu 24.04.4,aarch64):pnpm run test(SDK): 2241 passed, 41 skipped, 0 failed.pnpm run test:mcp: 23 passed, 0 failed.python -m pytest(plugin): 1086 passed, 9 skipped, 109 subtests, 0 failed.pnpm run build,pnpm run types, andpnpm run format: clean.ruff check,ruff format --check, andpython .github/scripts/check_plugin_source_compatibility.py: clean.docker buildof the customer container, then--version,bulk-scan --help, andinfo --jsonagainst it.bun sdk/typescript/scripts/smoke-findings-service.ts: passed.docker compose configforcompose.yaml, the AppArmor overlay,compose.findings.yaml, andcompose.runner.yaml.packageManagerpin, bun 1.3.14, ripgrep 14.1.0, gh 2.99.0.Not tested: the Ona environment itself, which I do not have access to. The task graph, triggers, and working directory are unchanged; only the
installcommand now calls the shared script.Risk and rollout
Development-environment configuration only. No runtime, packaging, or public CLI behavior changes.
Public disclosure review