Merge pull request #1278 from devcontainers/copilot/secure-oci-auth

Harden OCI registry authentication

Author: chrmarti

.github/workflows/dev-containers.yml

@@ -61,10 +61,11 @@ jobs:
           "src/test/cli.podman.test.ts",
           "src/test/cli.test.ts",
           "src/test/cli.up.test.ts",
+          "src/test/httpOCIRegistry.test.ts",
           "src/test/imageMetadata.test.ts",
           "src/test/container-features/containerFeaturesOCIPush.test.ts",
           # Run all except the above:
-          "--exclude src/test/container-features/containerFeaturesOrder.test.ts --exclude src/test/container-features/registryCompatibilityOCI.test.ts --exclude src/test/container-features/containerFeaturesOCIPush.test.ts --exclude src/test/container-features/e2e.test.ts --exclude src/test/container-features/featuresCLICommands.test.ts --exclude src/test/cli.build.test.ts --exclude src/test/cli.exec.buildKit.1.test.ts --exclude src/test/cli.exec.buildKit.2.test.ts --exclude src/test/cli.exec.nonBuildKit.1.test.ts --exclude src/test/cli.exec.nonBuildKit.2.test.ts --exclude src/test/cli.podman.test.ts --exclude src/test/cli.test.ts --exclude src/test/cli.up.test.ts --exclude src/test/imageMetadata.test.ts 'src/test/**/*.test.ts'",
+          "--exclude src/test/container-features/containerFeaturesOrder.test.ts --exclude src/test/container-features/registryCompatibilityOCI.test.ts --exclude src/test/container-features/containerFeaturesOCIPush.test.ts --exclude src/test/container-features/e2e.test.ts --exclude src/test/container-features/featuresCLICommands.test.ts --exclude src/test/cli.build.test.ts --exclude src/test/cli.exec.buildKit.1.test.ts --exclude src/test/cli.exec.buildKit.2.test.ts --exclude src/test/cli.exec.nonBuildKit.1.test.ts --exclude src/test/cli.exec.nonBuildKit.2.test.ts --exclude src/test/cli.podman.test.ts --exclude src/test/cli.test.ts --exclude src/test/cli.up.test.ts --exclude src/test/httpOCIRegistry.test.ts --exclude src/test/imageMetadata.test.ts 'src/test/**/*.test.ts'",
         ]
     steps:
     - name: Checkout

.gitignore

@@ -16,3 +16,5 @@ src/test/container-features/configs/temp_lifecycle-hooks-alternative-order
 test-secrets-temp.json
 src/test/container-*/**/src/**/README.md
 !src/test/container-features/assets/*.tgz
+src/test/fixtures/localhost-cert.pem
+src/test/fixtures/localhost-key.pem

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 Notable changes.
 
+## August 2026
+
+### [0.89.0]
+- Add opt-in OCI authentication hardening with `--oci-auth-hardening`, trusted cross-origin authentication host mappings, and diagnostics for measuring compatibility impact. (https://github.com/devcontainers/cli/pull/1278)
+
 ## June 2026
 
 ### [0.88.0]

package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@devcontainers/cli",
 	"description": "Dev Containers CLI",
-	"version": "0.88.0",
+	"version": "0.89.0",
 	"bin": {
 		"devcontainer": "devcontainer.js"
 	},

src/spec-common/injectHeadless.ts

@@ -13,6 +13,7 @@ import { launch, ShellServer } from './shellServer';
 import { ExecFunction, CLIHost, PtyExecFunction, isFile, Exec, PtyExec, getEntPasswdShellCommand } from './commonUtils';
 import { Disposable, Event, NodeEventEmitter } from '../spec-utils/event';
 import { PackageConfiguration } from '../spec-utils/product';
+import { OCIAuthDiagnostics } from './ociAuth';
 import { URI } from 'vscode-uri';
 import { containerSubstitute } from './variableSubstitution';
 import { delay } from './async';
@@ -69,6 +70,9 @@ export interface ResolverParameters {
 	omitConfigRemotEnvFromMetadata?: boolean;
 	secretsP?: Promise<Record<string, string>>;
 	omitSyntaxDirective?: boolean;
+	allowedCrossOriginAuthHosts?: string[];
+	ociAuthHardening?: boolean;
+	ociAuthDiagnostics: OCIAuthDiagnostics;
 }
 
 export interface LifecycleHook {

src/spec-common/ociAuth.ts

@@ -0,0 +1,18 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+export interface OCIAuthDiagnostics {
+	authLookupWouldBeBlocked: boolean;
+	registryRedirectWouldPreventCredentialForwarding: boolean;
+	authServerRedirect: boolean;
+}
+
+export function createOCIAuthDiagnostics(): OCIAuthDiagnostics {
+	return {
+		authLookupWouldBeBlocked: false,
+		registryRedirectWouldPreventCredentialForwarding: false,
+		authServerRedirect: false,
+	};
+}

src/spec-configuration/containerCollectionsOCI.ts

@@ -8,6 +8,7 @@ import { Log, LogLevel } from '../spec-utils/log';
 import { isLocalFile, mkdirpLocal, readLocalFile, writeLocalFile } from '../spec-utils/pfs';
 import { requestEnsureAuthenticated } from './httpOCIRegistry';
 import { GoARCH, GoOS, PlatformInfo } from '../spec-common/commonUtils';
+import { OCIAuthDiagnostics } from '../spec-common/ociAuth';
 
 export const DEVCONTAINER_MANIFEST_MEDIATYPE = 'application/vnd.devcontainers';
 export const DEVCONTAINER_TAR_LAYER_MEDIATYPE = 'application/vnd.devcontainers.layer.v1+tar';
@@ -18,13 +19,17 @@ export interface CommonParams {
 	env: NodeJS.ProcessEnv;
 	output: Log;
 	cachedAuthHeader?: Record<string, string>; // <registry, authHeader>
+	allowedCrossOriginAuthHosts?: string[];
+	ociAuthHardening?: boolean;
+	ociAuthDiagnostics: OCIAuthDiagnostics;
 }
 
 // Represents the unique OCI identifier for a Feature or Template.
 // eg:  ghcr.io/devcontainers/features/go:1.0.0
 // eg:  ghcr.io/devcontainers/features/go@sha256:fe73f123927bd9ed1abda190d3009c4d51d0e17499154423c5913cf344af15a3
 // Constructed by 'getRef()'
 export interface OCIRef {
+	scheme: 'http' | 'https';
 	registry: string; 		// 'ghcr.io'
 	owner: string;			// 'devcontainers'
 	namespace: string;		// 'devcontainers/features'
@@ -41,6 +46,7 @@ export interface OCIRef {
 // eg:  ghcr.io/devcontainers/features:latest
 // Constructed by 'getCollectionRef()'
 export interface OCICollectionRef {
+	scheme: 'http' | 'https';
 	registry: string;		// 'ghcr.io'
 	path: string;			// 'devcontainers/features'
 	resource: string;		// 'ghcr.io/devcontainers/features'
@@ -116,6 +122,10 @@ const regexForPath = /^[a-z0-9]+([._-][a-z0-9]+)*(\/[a-z0-9]+([._-][a-z0-9]+)*)*
 // MUST be at most 128 characters in length and MUST match the following regular expression:
 const regexForVersionOrDigest = /^[a-zA-Z0-9_][a-zA-Z0-9._-]{0,127}$/;
 
+function getRegistryScheme(registry: string): OCIRef['scheme'] {
+	return new URL(`https://${registry}`).hostname.toLowerCase() === 'localhost' ? 'http' : 'https';
+}
+
 // https://go.dev/doc/install/source#environment
 // Expected by OCI Spec as seen here: https://github.com/opencontainers/image-spec/blob/main/image-index.md#image-index-property-descriptions
 export function mapNodeArchitectureToGOARCH(arch: NodeJS.Architecture): GoARCH {
@@ -236,6 +246,7 @@ export function getRef(output: Log, input: string): OCIRef | undefined {
 	output.write(`> digest?: ${digest}`, LogLevel.Trace);
 
 	return {
+		scheme: getRegistryScheme(registry),
 		id,
 		owner,
 		namespace,
@@ -266,6 +277,7 @@ export function getCollectionRef(output: Log, registry: string, namespace: strin
 	}
 
 	return {
+		scheme: getRegistryScheme(registry),
 		registry,
 		path,
 		resource,
@@ -291,7 +303,7 @@ export async function fetchOCIManifestIfExists(params: CommonParams, ref: OCIRef
 	if (manifestDigest) {
 		reference = manifestDigest;
 	}
-	const manifestUrl = `https://${ref.registry}/v2/${ref.path}/manifests/${reference}`;
+	const manifestUrl = `${ref.scheme}://${ref.registry}/v2/${ref.path}/manifests/${reference}`;
 	output.write(`manifest url: ${manifestUrl}`, LogLevel.Trace);
 	const expectedDigest = manifestDigest || ('digest' in ref ? ref.digest : undefined);
 	const manifestContainer = await getManifest(params, manifestUrl, ref, undefined, expectedDigest);
@@ -467,7 +479,7 @@ export async function getVersionsStrictSorted(params: CommonParams, ref: OCIRef)
 export async function getPublishedTags(params: CommonParams, ref: OCIRef): Promise<string[] | undefined> {
 	const { output } = params;
 	try {
-		const url = `https://${ref.registry}/v2/${ref.namespace}/${ref.id}/tags/list`;
+		const url = `${ref.scheme}://${ref.registry}/v2/${ref.namespace}/${ref.id}/tags/list`;
 
 		const headers = {
 			'Accept': 'application/json',

src/spec-configuration/containerCollectionsOCIPush.ts

@@ -167,7 +167,7 @@ async function putManifestWithTags(params: CommonParams, manifest: ManifestConta
 	const { manifestBuffer, contentDigest } = manifest;
 
 	for await (const tag of tags) {
-		const url = `https://${ociRef.registry}/v2/${ociRef.path}/manifests/${tag}`;
+		const url = `${ociRef.scheme}://${ociRef.registry}/v2/${ociRef.path}/manifests/${tag}`;
 		output.write(`PUT -> '${url}'`, LogLevel.Trace);
 
 		const httpOptions = {
@@ -232,7 +232,7 @@ async function putBlob(params: CommonParams, blobPutLocationUriPath: string, oci
 	if (blobPutLocationUriPath.startsWith('https://') || blobPutLocationUriPath.startsWith('http://')) {
 		url = blobPutLocationUriPath;
 	} else {
-		url = `https://${ociRef.registry}${blobPutLocationUriPath}`;
+		url = `${ociRef.scheme}://${ociRef.registry}${blobPutLocationUriPath}`;
 	}
 
 	// The <location> MAY contain critical query parameters.
@@ -332,7 +332,7 @@ export async function calculateDataLayer(output: Log, data: Buffer, basename: st
 export async function checkIfBlobExists(params: CommonParams, ociRef: OCIRef | OCICollectionRef, digest: string): Promise<boolean> {
 	const { output } = params;
 
-	const url = `https://${ociRef.registry}/v2/${ociRef.path}/blobs/${digest}`;
+	const url = `${ociRef.scheme}://${ociRef.registry}/v2/${ociRef.path}/blobs/${digest}`;
 	const res = await requestEnsureAuthenticated(params, { type: 'HEAD', url, headers: {} }, ociRef);
 	if (!res) {
 		output.write('Request failed', LogLevel.Error);
@@ -349,7 +349,7 @@ export async function checkIfBlobExists(params: CommonParams, ociRef: OCIRef | O
 async function postUploadSessionId(params: CommonParams, ociRef: OCIRef | OCICollectionRef): Promise<string | undefined> {
 	const { output } = params;
 
-	const url = `https://${ociRef.registry}/v2/${ociRef.path}/blobs/uploads/`;
+	const url = `${ociRef.scheme}://${ociRef.registry}/v2/${ociRef.path}/blobs/uploads/`;
 	output.write(`Generating Upload URL -> ${url}`, LogLevel.Trace);
 	const res = await requestEnsureAuthenticated(params, { type: 'POST', url, headers: {} }, ociRef);
 

src/spec-configuration/containerFeaturesConfiguration.ts

@@ -19,6 +19,7 @@ import { request } from '../spec-utils/httpRequest';
 import { fetchOCIFeature, tryGetOCIFeatureSet, fetchOCIFeatureManifestIfExistsFromUserIdentifier } from './containerFeaturesOCI';
 import { uriToFsPath } from './configurationCommonUtils';
 import { CommonParams, ManifestContainer, OCIManifest, OCIRef, getRef, getVersionsStrictSorted } from './containerCollectionsOCI';
+import { OCIAuthDiagnostics } from '../spec-common/ociAuth';
 import { Lockfile, generateLockfile, readLockfile, writeLockfile } from './lockfile';
 import { computeDependsOnInstallationOrder } from './containerFeaturesOrder';
 import { logFeatureAdvisories } from './featureAdvisories';
@@ -195,6 +196,9 @@ export interface ContainerFeatureInternalParams {
 	platform: NodeJS.Platform;
 	noLockfile?: boolean;
 	frozenLockfile?: boolean;
+	allowedCrossOriginAuthHosts?: string[];
+	ociAuthHardening?: boolean;
+	ociAuthDiagnostics: OCIAuthDiagnostics;
 }
 
 // TODO: Move to node layer.
@@ -391,7 +395,7 @@ const cleanupIterationFetchAndMerge = async (tempTarballPath: string, output: Lo
 	}
 };
 
-function getRequestHeaders(params: CommonParams, sourceInformation: SourceInformation) {
+function getRequestHeaders(params: { env: NodeJS.ProcessEnv; output: Log }, sourceInformation: SourceInformation) {
 	const { env, output } = params;
 	let headers: { 'user-agent': string; 'Authorization'?: string; 'Accept'?: string } = {
 		'user-agent': 'devcontainer'
@@ -957,7 +961,7 @@ export async function processFeatureIdentifier(params: CommonParams, configPath:
 	// throw new Error(`Unsupported feature source type: ${type}`);
 }
 
-async function fetchFeatures(params: { extensionPath: string; cwd: string; output: Log; env: NodeJS.ProcessEnv }, featuresConfig: FeaturesConfig, dstFolder: string, ociCacheDir: string, lockfile: Lockfile | undefined) {
+async function fetchFeatures(params: ContainerFeatureInternalParams, featuresConfig: FeaturesConfig, dstFolder: string, ociCacheDir: string, lockfile: Lockfile | undefined) {
 	const featureSets = featuresConfig.featureSets;
 	for (let idx = 0; idx < featureSets.length; idx++) { // Index represents the previously computed installation order.
 		const featureSet = featureSets[idx];

src/spec-configuration/containerFeaturesOCI.ts

@@ -61,7 +61,7 @@ export async function fetchOCIFeature(params: CommonParams, featureSet: FeatureS
 	const { featureRef } = featureSet.sourceInformation;
 
 	const layerDigest = featureSet.sourceInformation.manifest?.layers[0].digest;
-	const blobUrl = `https://${featureSet.sourceInformation.featureRef.registry}/v2/${featureSet.sourceInformation.featureRef.path}/blobs/${layerDigest}`;
+	const blobUrl = `${featureRef.scheme}://${featureRef.registry}/v2/${featureRef.path}/blobs/${layerDigest}`;
 	output.write(`blob url: ${blobUrl}`, LogLevel.Trace);
 
 	const blobResult = await getBlob(params, blobUrl, ociCacheDir, featCachePath, featureRef, layerDigest, undefined, metadataFile);