chore(devcontainer): add SSH server to devcontainer base image (#2704)

Author: Rtosshy

.devcontainer/devcontainer.json

@@ -76,5 +76,8 @@
     "memory": "8gb",
     "storage": "32gb"
   },
+  // Start sshd at every container start so `gh codespace ssh` works without an editor attach
+  // (postAttachCommand only fires when an editor client attaches)
+  "postStartCommand": "bash .devcontainer/start-sshd.sh",
   "postAttachCommand": "bash .devcontainer/setup.sh"
 }

.devcontainer/start-sshd.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# Starts the SSH daemon so `gh codespace ssh` (and other SSH clients) can connect.
+#
+# The Dockerfile's own ENTRYPOINT (docker-init.sh) also starts sshd, but Codespaces/
+# devcontainer tooling overrides the container's entrypoint at container-start time,
+# so that logic never runs there. This script is wired to postStartCommand so sshd
+# comes up at every container start — with or without an editor attach.
+set -e
+
+if pgrep -x sshd > /dev/null; then
+    echo "✅ SSH daemon already running"
+    exit 0
+fi
+
+echo "🔑 Starting SSH daemon..."
+# Regenerate host keys if missing (never baked into the shared image)
+sudo ssh-keygen -A > /dev/null
+# Privilege-separation dir; /run can be tmpfs, wiping the build-time mkdir
+sudo mkdir -p /run/sshd
+sudo /usr/sbin/sshd
+echo "✅ SSH daemon started successfully"

.github/.devcontainer/Dockerfile

@@ -171,8 +171,37 @@ RUN ARCH=$(dpkg --print-architecture) \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
-# Create docker startup script
+# Install and configure OpenSSH server (replaces the ghcr.io/devcontainers/features/sshd feature).
+# Host keys must never be baked into this shared base image (every container/Codespace built
+# from it would otherwise share one static key pair), so they are stripped here and regenerated
+# fresh at container startup instead, by docker-init.sh via `ssh-keygen -A`.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends openssh-server openssh-sftp-server \
+    && mkdir -p /run/sshd \
+    && sed -i -E \
+        -e 's/^#?Port .*/Port 2222/' \
+        -e 's/^#?PasswordAuthentication .*/PasswordAuthentication no/' \
+        -e 's/^#?PubkeyAuthentication .*/PubkeyAuthentication yes/' \
+        -e 's/^#?UsePAM .*/UsePAM yes/' \
+        /etc/ssh/sshd_config \
+    && /usr/sbin/sshd -t \
+    && rm -f /etc/ssh/ssh_host_* \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create docker startup script.
+# NOTE: This script is the image's ENTRYPOINT, but Codespaces/devcontainer tooling
+# overrides the entrypoint at container start, so it never runs there — it only
+# runs under plain `docker run`. On Codespaces sshd is started by
+# .devcontainer/start-sshd.sh (postStartCommand) and dockerd by
+# .devcontainer/setup.sh (postAttachCommand) instead. Keep these in sync.
 RUN echo '#!/bin/bash\n\
+# Regenerate SSH host keys if missing (never baked into the shared image)\n\
+sudo ssh-keygen -A > /dev/null\n\
+# Privilege-separation dir; /run can be tmpfs, wiping the build-time mkdir\n\
+sudo mkdir -p /run/sshd\n\
+# Start the SSH daemon (self-daemonizes; do not add -D here)\n\
+sudo /usr/sbin/sshd\n\
 # Start docker daemon in background\n\
 sudo dockerd > /dev/null 2>&1 &\n\
 # Wait for docker to be ready\n\