build(devcontainer): switch to .docker images and Linux-only devcontainer

.devcontainer/devcontainer.json

@@ -1,16 +1,21 @@
 {
     "name": "flutter_docker",
     "context": "..",
-    "dockerFile": "Dockerfile",
+    "dockerFile": "../.docker/komodo-wallet-android.dockerfile",
     "remoteUser": "komodo",
     "workspaceFolder": "/workspaces/komodo-wallet",
-    "postCreateCommand": "sudo chown -R komodo:komodo /workspaces/komodo-wallet",
-    "postAttachCommand": "flutter pub get",
-    "runArgs": [
-        "--privileged",
-        "-v",
-        "/dev/bus/usb:/dev/bus/usb"
-    ],
+    "initializeCommand": "docker build -t komodo/android-sdk:35 -f ${localWorkspaceFolder}/.docker/android-sdk.dockerfile ${localWorkspaceFolder}",
+    "postCreateCommand": "bash -lc '.devcontainer/postCreate.sh'",
+    "postAttachCommand": "flutter pub get --enforce-lockfile",
+    // Security Note: The following runArgs are commented out for security reasons.
+    // Uncomment these lines only when you need to debug Android apps via USB connection
+    // through the dev container. The --privileged flag grants extended privileges to
+    // the container, and USB device mounting allows direct hardware access.
+    // "runArgs": [
+    //     "--privileged",
+    //     "-v",
+    //     "/dev/bus/usb:/dev/bus/usb"
+    // ],
     "forwardPorts": [
         8081,
         5037

.devcontainer/postCreate.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Initialize and pin submodules to the recorded commits
+git submodule sync --recursive
+git submodule update --init --recursive --checkout
+
+# Recommended git settings for submodules
+git config fetch.recurseSubmodules on-demand
+git config submodule.sdk.ignore dirty
+
+echo "postCreate: completed submodule initialization and permissions setup"

.gitignore

@@ -33,7 +33,7 @@
 .packages
 .pub-cache/
 .pub/
-/build/
+**/build/
 contrib/coins_config.json
 devtools_options.yaml
 

.gitmodules

@@ -4,3 +4,4 @@
 	branch = dev
 	update = checkout
 	fetchRecurseSubmodules = on-demand
+	ignore = dirty