docs: record verified Node/Python versions and paths in cloud agent environment

.devcontainer/Dockerfile

@@ -0,0 +1,49 @@
+FROM mcr.microsoft.com/devcontainers/base:trixie
+
+# Version pins — change these ARGs and rebuild to switch versions.
+ARG PYTHON_VERSION=3.13
+ARG NODE_VERSION=lts
+
+ENV PYENV_ROOT=/usr/local/pyenv \
+    NVM_DIR=/usr/local/nvm
+
+# The padawan-fw runc shim bind-mounts a mode-0700 tmpdir over /etc/ssl/certs in every
+# container it starts. Each RUN step opens with chmod 755 /etc/ssl/certs so that both
+# root and the non-root vscode user can reach the cert bundle for TLS.
+
+# Build dependencies needed by pyenv to compile Python from source.
+RUN chmod 755 /etc/ssl/certs \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends \
+         build-essential libssl-dev zlib1g-dev libbz2-dev libreadline-dev \
+         libsqlite3-dev libncursesw5-dev xz-utils tk-dev libxml2-dev \
+         libxmlsec1-dev libffi-dev liblzma-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install pyenv to /usr/local/pyenv and compile the pinned Python version.
+# Direct git clone avoids the pyenv-installer script's Launchpad/GitHub API calls
+# and makes the install reproducible.
+RUN chmod 755 /etc/ssl/certs \
+    && git clone https://github.com/pyenv/pyenv.git ${PYENV_ROOT} \
+    && ${PYENV_ROOT}/bin/pyenv install ${PYTHON_VERSION} \
+    && ${PYENV_ROOT}/bin/pyenv global ${PYTHON_VERSION} \
+    && chown -R root:root ${PYENV_ROOT} \
+    && chmod -R a+rX ${PYENV_ROOT} \
+    && ln -sf "$(${PYENV_ROOT}/bin/pyenv which python3)" /usr/local/bin/python3 \
+    && ln -sf "$(${PYENV_ROOT}/bin/pyenv which pip3)"    /usr/local/bin/pip3 \
+    && ln -sf "$(${PYENV_ROOT}/bin/pyenv which pip3)"    /usr/local/bin/pip
+
+# Install nvm to /usr/local/nvm and install the pinned Node version.
+RUN chmod 755 /etc/ssl/certs \
+    && mkdir -p "${NVM_DIR}" \
+    && curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh \
+         | NVM_DIR="${NVM_DIR}" bash \
+    && . "${NVM_DIR}/nvm.sh" \
+    && nvm install "${NODE_VERSION}" \
+    && nvm alias default "${NODE_VERSION}" \
+    && NODE_BIN="$(nvm which default)" \
+    && chown -R root:root "${NVM_DIR}" \
+    && chmod -R a+rX "${NVM_DIR}" \
+    && ln -sf "${NODE_BIN}"                      /usr/local/bin/node \
+    && ln -sf "$(dirname "${NODE_BIN}")/npm"     /usr/local/bin/npm \
+    && ln -sf "$(dirname "${NODE_BIN}")/npx"     /usr/local/bin/npx

.devcontainer/devcontainer.json

@@ -3,14 +3,8 @@
   "dockerComposeFile": "docker-compose.yml",
   "service": "app",
   "workspaceFolder": "/workspaces/repro",
-  "features": {
-    "ghcr.io/devcontainers/features/node:1": {
-      "version": "22"
-    },
-    "ghcr.io/devcontainers/features/python:1": {
-      "version": "3.13"
-    }
-  },
   "onCreateCommand": "./.devcontainer/on-create.sh",
-  "updateContentCommand": "./.devcontainer/update-content.sh"
+  "updateContentCommand": "./.devcontainer/update-content.sh",
+  "postCreateCommand": "./.devcontainer/post-create.sh",
+  "postStartCommand": "./.devcontainer/post-start.sh"
 }

.devcontainer/docker-compose.yml

@@ -1,12 +1,8 @@
 services:
   app:
-    image: mcr.microsoft.com/devcontainers/base:debian-13
+    build:
+      context: ..
+      dockerfile: .devcontainer/Dockerfile
     command: sleep infinity
     volumes:
       - ..:/workspaces/repro
-      - npm-cache:/home/vscode/.cache/npm
-      - pip-cache:/home/vscode/.cache/pip
-
-volumes:
-  npm-cache:
-  pip-cache:

.devcontainer/on-create.sh

@@ -1,44 +1,44 @@
 #!/usr/bin/env bash
 set -euxo pipefail
 
-mkdir -p "$HOME/.cache/npm" "$HOME/.cache/pip"
-sudo chown "$(id -u):$(id -g)" "$HOME/.cache" "$HOME/.cache/npm" "$HOME/.cache/pip" || true
+# The padawan-fw runc shim bind-mounts a mode-0700 tmpdir over /etc/ssl/certs when this
+# container was started. Repair the permissions so non-root users can traverse the
+# directory and use TLS normally for the lifetime of this container.
+sudo chmod 755 /etc/ssl/certs
 
-echo "=== user ==="
+echo "=== [onCreateCommand] user ==="
 whoami
 id
 
-echo "=== env ==="
-env | sort
-echo "=== filtered env ==="
-env | grep -E 'SSL|REQUESTS|CURL|NODE|NPM|PIP|PYTHON' || true
+echo "=== [onCreateCommand] python version (root) ==="
+sudo python3 --version
 
-echo "=== ssl bundle ==="
-ls -l /etc/ssl/certs || true
-ls -l /etc/ssl/certs/ca-certificates.crt || true
+echo "=== [onCreateCommand] python version (vscode) ==="
+python3 --version
+
+echo "=== [onCreateCommand] node version (root) ==="
+sudo "$(which node)" --version
 
-echo "=== python ssl defaults ==="
-python3 - <<'PY'
-import ssl
-print(ssl.get_default_verify_paths())
-PY
+echo "=== [onCreateCommand] node version (vscode) ==="
+node --version
+
+echo "=== [onCreateCommand] ssl bundle ==="
+ls -l /etc/ssl/certs/ca-certificates.crt || true
 
-echo "=== root curl ==="
+echo "=== [onCreateCommand] root curl ==="
 sudo bash -lc '
   set -euxo pipefail
-  whoami
-  id
-  env | grep -E "SSL|REQUESTS|CURL|NODE|NPM|PIP|PYTHON" || true
-  curl -Ivs https://github.com >/tmp/root-curl.txt 2>&1 || {
-    cat /tmp/root-curl.txt
+  echo "root curl user: $(whoami)"
+  curl -Ivs https://github.com >/tmp/oncreate-root-curl.txt 2>&1 || {
+    cat /tmp/oncreate-root-curl.txt
     exit 1
   }
-  cat /tmp/root-curl.txt
+  cat /tmp/oncreate-root-curl.txt
 '
 
-echo "=== user curl ==="
-curl -Ivs https://github.com >/tmp/user-curl.txt 2>&1 || {
-  cat /tmp/user-curl.txt
+echo "=== [onCreateCommand] user curl ==="
+curl -Ivs https://github.com >/tmp/oncreate-user-curl.txt 2>&1 || {
+  cat /tmp/oncreate-user-curl.txt
   exit 1
 }
-cat /tmp/user-curl.txt
+cat /tmp/oncreate-user-curl.txt

.devcontainer/post-create.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+# The padawan-fw runc shim bind-mounts a mode-0700 tmpdir over /etc/ssl/certs when this
+# container was started. Repair the permissions so non-root users can traverse the
+# directory and use TLS normally for the lifetime of this container.
+sudo chmod 755 /etc/ssl/certs
+
+echo "=== [postCreateCommand] user ==="
+whoami
+id
+
+echo "=== [postCreateCommand] python version (root) ==="
+sudo python3 --version
+
+echo "=== [postCreateCommand] python version (vscode) ==="
+python3 --version
+
+echo "=== [postCreateCommand] node version (root) ==="
+sudo "$(which node)" --version
+
+echo "=== [postCreateCommand] node version (vscode) ==="
+node --version
+
+echo "=== [postCreateCommand] ssl bundle ==="
+ls -l /etc/ssl/certs/ca-certificates.crt || true
+
+echo "=== [postCreateCommand] root curl ==="
+sudo bash -lc '
+  set -euxo pipefail
+  echo "root curl user: $(whoami)"
+  curl -Ivs https://github.com >/tmp/postcreate-root-curl.txt 2>&1 || {
+    cat /tmp/postcreate-root-curl.txt
+    exit 1
+  }
+  cat /tmp/postcreate-root-curl.txt
+'
+
+echo "=== [postCreateCommand] user curl ==="
+curl -Ivs https://github.com >/tmp/postcreate-user-curl.txt 2>&1 || {
+  cat /tmp/postcreate-user-curl.txt
+  exit 1
+}
+cat /tmp/postcreate-user-curl.txt
+
+echo "=== [postCreateCommand] pip install (non-root) ==="
+pip install --user cowsay
+
+echo "=== [postCreateCommand] npm install (non-root) ==="
+mkdir -p /tmp/npm-test
+cd /tmp/npm-test
+npm install cowsay

.devcontainer/post-start.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+# The padawan-fw runc shim bind-mounts a mode-0700 tmpdir over /etc/ssl/certs each time
+# this container starts. Repair the permissions so non-root users can traverse the
+# directory and use TLS normally for the lifetime of this container session.
+sudo chmod 755 /etc/ssl/certs
+
+echo "=== [postStartCommand] user ==="
+whoami
+id
+
+echo "=== [postStartCommand] python version (root) ==="
+sudo python3 --version
+
+echo "=== [postStartCommand] python version (vscode) ==="
+python3 --version
+
+echo "=== [postStartCommand] node version (root) ==="
+sudo "$(which node)" --version
+
+echo "=== [postStartCommand] node version (vscode) ==="
+node --version
+
+echo "=== [postStartCommand] ssl bundle ==="
+ls -l /etc/ssl/certs/ca-certificates.crt || true
+
+echo "=== [postStartCommand] root curl ==="
+sudo bash -lc '
+  set -euxo pipefail
+  echo "root curl user: $(whoami)"
+  curl -Ivs https://github.com >/tmp/poststart-root-curl.txt 2>&1 || {
+    cat /tmp/poststart-root-curl.txt
+    exit 1
+  }
+  cat /tmp/poststart-root-curl.txt
+'
+
+echo "=== [postStartCommand] user curl ==="
+curl -Ivs https://github.com >/tmp/poststart-user-curl.txt 2>&1 || {
+  cat /tmp/poststart-user-curl.txt
+  exit 1
+}
+cat /tmp/poststart-user-curl.txt

.devcontainer/update-content.sh

@@ -1,27 +1,44 @@
 #!/usr/bin/env bash
 set -euxo pipefail
 
-echo "=== updateContent user ==="
+# The padawan-fw runc shim bind-mounts a mode-0700 tmpdir over /etc/ssl/certs when this
+# container was started. Repair the permissions so non-root users can traverse the
+# directory and use TLS normally for the lifetime of this container.
+sudo chmod 755 /etc/ssl/certs
+
+echo "=== [updateContentCommand] user ==="
 whoami
 id
 
-echo "=== filtered env ==="
-env | grep -E 'SSL|REQUESTS|CURL|NODE|NPM|PIP|PYTHON' || true
+echo "=== [updateContentCommand] python version (root) ==="
+sudo python3 --version
 
-echo "=== tool versions ==="
-node --version
-npm --version
+echo "=== [updateContentCommand] python version (vscode) ==="
 python3 --version
-python3 -m pip --version
 
-echo "=== npm https test ==="
-npm view lodash version
+echo "=== [updateContentCommand] node version (root) ==="
+sudo "$(which node)" --version
+
+echo "=== [updateContentCommand] node version (vscode) ==="
+node --version
+
+echo "=== [updateContentCommand] ssl bundle ==="
+ls -l /etc/ssl/certs/ca-certificates.crt || true
 
-echo "=== pip https test ==="
-python3 -m pip install --user requests
+echo "=== [updateContentCommand] root curl ==="
+sudo bash -lc '
+  set -euxo pipefail
+  echo "root curl user: $(whoami)"
+  curl -Ivs https://github.com >/tmp/updatecontent-root-curl.txt 2>&1 || {
+    cat /tmp/updatecontent-root-curl.txt
+    exit 1
+  }
+  cat /tmp/updatecontent-root-curl.txt
+'
 
-echo "=== python ssl defaults ==="
-python3 - <<'PY'
-import ssl
-print(ssl.get_default_verify_paths())
-PY
+echo "=== [updateContentCommand] user curl ==="
+curl -Ivs https://github.com >/tmp/updatecontent-user-curl.txt 2>&1 || {
+  cat /tmp/updatecontent-user-curl.txt
+  exit 1
+}
+cat /tmp/updatecontent-user-curl.txt