Skip to content

feat: add image version tracking to DevContainer #472

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
keito4 merged 1 commit into from
Feb 12, 2026
Merged

feat: add image version tracking to DevContainer #472

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion .devcontainer/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,15 @@
FROM mcr.microsoft.com/devcontainers/base:ubuntu

# Build arguments for Claude Code authentication
# Build arguments
ARG CLAUDE_CODE_OAUTH_TOKEN

Check warning on line 4 in .devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / Generate SBOM

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "CLAUDE_CODE_OAUTH_TOKEN")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 4 in .devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / Trivy Container Scan

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "CLAUDE_CODE_OAUTH_TOKEN")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ARG ANTHROPIC_API_KEY

Check warning on line 5 in .devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / Generate SBOM

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "ANTHROPIC_API_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 5 in .devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / Trivy Container Scan

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "ANTHROPIC_API_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ARG IMAGE_VERSION="dev"

# OCI Image Labels for version tracking
LABEL org.opencontainers.image.version="${IMAGE_VERSION}" \
org.opencontainers.image.source="https://github.com/keito4/config" \
org.opencontainers.image.title="config-base" \
org.opencontainers.image.description="DevContainer base image with Claude Code, Codex, and development tools"
Comment on lines +3 to +12

@coderabbitai coderabbitai Bot Feb 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Moving LABEL to the end of the Dockerfile would preserve layer caching.

The LABEL on line 9 references ${IMAGE_VERSION}, so every time the version changes, Docker invalidates this layer and all subsequent layers — forcing a full rebuild of the heavy apt-get, Node.js, Rust, npm install steps, etc. This negates registry cache benefits.

Move the LABEL block down next to the version-file write (around line 164) so that only the final layers are invalidated when the version changes.

Proposed fix 
 # Build arguments
 ARG CLAUDE_CODE_OAUTH_TOKEN
 ARG ANTHROPIC_API_KEY
 ARG IMAGE_VERSION="dev"
-
-# OCI Image Labels for version tracking
-LABEL org.opencontainers.image.version="${IMAGE_VERSION}" \
-      org.opencontainers.image.source="https://github.com/keito4/config" \
-      org.opencontainers.image.title="config-base" \
-      org.opencontainers.image.description="DevContainer base image with Claude Code, Codex, and development tools"

Then near the end of the Dockerfile (after line 162):

 # Write version file for easy version checking
 RUN echo "${IMAGE_VERSION}" > /etc/config-base-version \
  && chmod 644 /etc/config-base-version
+
+# OCI Image Labels for version tracking (placed late to preserve layer cache)
+LABEL org.opencontainers.image.version="${IMAGE_VERSION}" \
+      org.opencontainers.image.source="https://github.com/keito4/config" \
+      org.opencontainers.image.title="config-base" \
+      org.opencontainers.image.description="DevContainer base image with Claude Code, Codex, and development tools"
🤖 Prompt for AI Agents 
In @.devcontainer/Dockerfile around lines 3 - 12, The LABEL block that
references ARG IMAGE_VERSION should be moved from its current position to the
end of the Dockerfile (near the version-file write step) so changes to
IMAGE_VERSION only invalidate the final image layer; locate the existing LABEL
lines declaring org.opencontainers.image.version, source, title, and description
and cut them out of their current position, then paste them after the
version-file write step (around the end of the file) so only the final metadata
layer is rebuilt when IMAGE_VERSION changes.


# Install dependencies and Node.js using official binaries
RUN apt-get update && apt-get install -y \
Expand Down Expand Up @@ -154,6 +161,10 @@
RUN echo 'source ~/.bashrc' >> /home/vscode/.bash_profile \
&& chown vscode:vscode /home/vscode/.bash_profile

# Write version file for easy version checking
RUN echo "${IMAGE_VERSION}" > /etc/config-base-version \
&& chmod 644 /etc/config-base-version

COPY package.json package-lock.json /tmp/
COPY .husky /tmp/.husky/
COPY git/commitlint.config.js /tmp/commitlint.config.js
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/docker-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,6 +177,7 @@ jobs:
cache-from: type=registry,ref=ghcr.io/${{ github.repository_owner }}/config-base:cache
cache-to: type=registry,ref=ghcr.io/${{ github.repository_owner }}/config-base:cache,mode=max
build-args: |
IMAGE_VERSION=${{ steps.release.outputs.version }}
CLAUDE_CODE_OAUTH_TOKEN=${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
secrets: |
claude_credentials=${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
Expand Down
26 changes: 20 additions & 6 deletions script/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,13 @@ This directory contains utility scripts for managing configuration, credentials,

## Quick Reference

| Script | Purpose | Used By |
| --------------------- | -------------------------------- | ---------------------- |
| `setup-claude.sh` | Claude Code CLI setup | Makefile, DevContainer |
| `credentials.sh` | 1Password credential management | Makefile |
| `update-libraries.sh` | Library updates for Codex/Claude | package.json |
| `version.sh` | Semantic versioning | Makefile |
| Script | Purpose | Used By |
| ------------------------ | -------------------------------- | ---------------------- |
| `setup-claude.sh` | Claude Code CLI setup | Makefile, DevContainer |
| `credentials.sh` | 1Password credential management | Makefile |
| `update-libraries.sh` | Library updates for Codex/Claude | package.json |
| `version.sh` | Semantic versioning | Makefile |
| `check-image-version.sh` | Show DevContainer image version | Manual |

## Configuration Management

Expand Down Expand Up @@ -247,6 +248,19 @@ Comprehensive DevContainer health check.

**Claude command**: `/container-health`

### check-image-version.sh

Displays the config-base DevContainer image version.

**Usage**:

```bash
./script/check-image-version.sh # Show version
./script/check-image-version.sh -v # Show version with additional info
```

**Note**: Version tracking was added in v1.64.0. Older images will show "unknown".

### install-npm-globals.sh

Installs global npm packages defined in `npm/global.json`.
Expand Down
36 changes: 36 additions & 0 deletions script/check-image-version.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
#!/usr/bin/env bash
#
# check-image-version.sh - DevContainer イメージのバージョン情報を表示
#

set -euo pipefail

VERSION_FILE="/etc/config-base-version"

# バージョンファイルの確認
if [ -f "$VERSION_FILE" ]; then
VERSION=$(cat "$VERSION_FILE")
echo "config-base version: $VERSION"
else
echo "config-base version: unknown (version file not found)"
echo ""
echo "Note: Version tracking was added in v1.64.0"
echo "Consider updating to the latest image: ghcr.io/keito4/config-base:latest"
exit 1
fi

# オプション: 詳細表示
if [ "${1:-}" = "-v" ] || [ "${1:-}" = "--verbose" ]; then
echo ""
echo "Additional info:"
echo " Image source: https://github.com/keito4/config"
echo " Releases: https://github.com/keito4/config/releases"

# Docker ラベルから追加情報を取得（コンテナ外で実行時）
if command -v docker &> /dev/null; then
CURRENT_IMAGE=$(docker inspect --format '{{.Config.Image}}' "$(hostname)" 2>/dev/null || echo "")
if [ -n "$CURRENT_IMAGE" ]; then
echo " Current image: $CURRENT_IMAGE"
fi
fi
fi
Loading