Bring fork up-to-date

.devcontainer/devcontainer-lock.json

@@ -6,4 +6,4 @@
       "integrity": "sha256:ce078b7bf7d9ef3bcb9813b32103795d8d72172446890b64772cbe1dec6baafd"
     }
   }
-}
+}

.github/workflows/dev-containers.yml

@@ -61,10 +61,11 @@ jobs:
           "src/test/cli.podman.test.ts",
           "src/test/cli.test.ts",
           "src/test/cli.up.test.ts",
+          "src/test/httpOCIRegistry.test.ts",
           "src/test/imageMetadata.test.ts",
           "src/test/container-features/containerFeaturesOCIPush.test.ts",
           # Run all except the above:
-          "--exclude src/test/container-features/containerFeaturesOrder.test.ts --exclude src/test/container-features/registryCompatibilityOCI.test.ts --exclude src/test/container-features/containerFeaturesOCIPush.test.ts --exclude src/test/container-features/e2e.test.ts --exclude src/test/container-features/featuresCLICommands.test.ts --exclude src/test/cli.build.test.ts --exclude src/test/cli.exec.buildKit.1.test.ts --exclude src/test/cli.exec.buildKit.2.test.ts --exclude src/test/cli.exec.nonBuildKit.1.test.ts --exclude src/test/cli.exec.nonBuildKit.2.test.ts --exclude src/test/cli.podman.test.ts --exclude src/test/cli.test.ts --exclude src/test/cli.up.test.ts --exclude src/test/imageMetadata.test.ts 'src/test/**/*.test.ts'",
+          "--exclude src/test/container-features/containerFeaturesOrder.test.ts --exclude src/test/container-features/registryCompatibilityOCI.test.ts --exclude src/test/container-features/containerFeaturesOCIPush.test.ts --exclude src/test/container-features/e2e.test.ts --exclude src/test/container-features/featuresCLICommands.test.ts --exclude src/test/cli.build.test.ts --exclude src/test/cli.exec.buildKit.1.test.ts --exclude src/test/cli.exec.buildKit.2.test.ts --exclude src/test/cli.exec.nonBuildKit.1.test.ts --exclude src/test/cli.exec.nonBuildKit.2.test.ts --exclude src/test/cli.podman.test.ts --exclude src/test/cli.test.ts --exclude src/test/cli.up.test.ts --exclude src/test/httpOCIRegistry.test.ts --exclude src/test/imageMetadata.test.ts 'src/test/**/*.test.ts'",
         ]
     steps:
     - name: Checkout
@@ -89,6 +90,19 @@ jobs:
         fi
         cat "$DAEMON_JSON"
         sudo systemctl restart docker
+    - name: Install Podman 5.5.2
+      if: matrix.mocha-args == 'src/test/cli.podman.test.ts'
+      run: |
+        docker build \
+          --build-arg PODMAN_VERSION=v5.5.2 \
+          --target podman \
+          --tag podman-5.5.2-builder \
+          'https://github.com/mgoltzsche/podman-static.git#9ccf992536ecf0a4a3b82ac27fc708f00ab141ab'
+        container_id=$(docker create podman-5.5.2-builder)
+        docker cp "${container_id}:/usr/local/bin/podman" podman
+        docker rm "${container_id}"
+        sudo install -m 0755 podman /usr/local/bin/podman
+        podman --version
     - name: Tools Info
       run: |
         docker info

.github/workflows/publish-dev-containers.yml

@@ -8,6 +8,7 @@ on:
 permissions:
   contents: read
   actions: read
+  id-token: write
 
 jobs:
   main:
@@ -18,7 +19,7 @@ jobs:
     - name: Setup Node.js
       uses: actions/setup-node@v5
       with:
-        node-version: '20.x'
+        node-version: '24.x'
         registry-url: 'https://registry.npmjs.org'
         scope: '@devcontainers'
     - name: Verify Versions
@@ -46,5 +47,3 @@ jobs:
         path: .
     - name: Publish TGZ
       run: npm publish ${TGZ} --access public
-      env:
-        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/test-windows.yml

@@ -18,7 +18,7 @@ permissions:
 jobs:
  tests-matrix:
     name: Tests Matrix (Windows)
-    runs-on: windows-latest
+    runs-on: windows-2022
     timeout-minutes: 15
     strategy:
       fail-fast: false

.gitignore

@@ -16,3 +16,5 @@ src/test/container-features/configs/temp_lifecycle-hooks-alternative-order
 test-secrets-temp.json
 src/test/container-*/**/src/**/README.md
 !src/test/container-features/assets/*.tgz
+src/test/fixtures/localhost-cert.pem
+src/test/fixtures/localhost-key.pem

CHANGELOG.md

@@ -2,6 +2,16 @@
 
 Notable changes.
 
+## August 2026
+
+### [0.89.0]
+- Add opt-in OCI authentication hardening with `--oci-auth-hardening`, trusted cross-origin authentication host mappings, and diagnostics for measuring compatibility impact. (https://github.com/devcontainers/cli/pull/1278)
+
+## June 2026
+
+### [0.88.0]
+- Add WSLc support (https://github.com/devcontainers/cli/pull/1249)
+
 ## May 2026
 
 ### [0.87.0]

package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@devcontainers/cli",
 	"description": "Dev Containers CLI",
-	"version": "0.87.0",
+	"version": "0.89.0",
 	"bin": {
 		"devcontainer": "devcontainer.js"
 	},
@@ -71,7 +71,7 @@
 		"@typescript-eslint/parser": "^8.56.1",
 		"chai": "^4.5.0",
 		"copyfiles": "^2.4.1",
-		"esbuild": "^0.27.3",
+		"esbuild": "^0.28.1",
 		"eslint": "^10.0.2",
 		"event-stream": "^4.0.1",
 		"minimatch": "^10.2.4",

scripts/updateUID.Dockerfile

@@ -1,6 +1,6 @@
 #  Copyright (c) Microsoft Corporation. All rights reserved.
 #  Licensed under the MIT License. See License.txt in the project root for license information.
-ARG BASE_IMAGE
+ARG BASE_IMAGE=placeholder
 FROM $BASE_IMAGE
 
 USER root

src/spec-common/injectHeadless.ts

@@ -13,6 +13,7 @@ import { launch, ShellServer } from './shellServer';
 import { ExecFunction, CLIHost, PtyExecFunction, isFile, Exec, PtyExec, getEntPasswdShellCommand } from './commonUtils';
 import { Disposable, Event, NodeEventEmitter } from '../spec-utils/event';
 import { PackageConfiguration } from '../spec-utils/product';
+import { OCIAuthDiagnostics } from './ociAuth';
 import { URI } from 'vscode-uri';
 import { containerSubstitute } from './variableSubstitution';
 import { delay } from './async';
@@ -69,6 +70,9 @@ export interface ResolverParameters {
 	omitConfigRemotEnvFromMetadata?: boolean;
 	secretsP?: Promise<Record<string, string>>;
 	omitSyntaxDirective?: boolean;
+	allowedCrossOriginAuthHosts?: string[];
+	ociAuthHardening?: boolean;
+	ociAuthDiagnostics: OCIAuthDiagnostics;
 }
 
 export interface LifecycleHook {

src/spec-common/ociAuth.ts

@@ -0,0 +1,18 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+export interface OCIAuthDiagnostics {
+	authLookupWouldBeBlocked: boolean;
+	registryRedirectWouldPreventCredentialForwarding: boolean;
+	authServerRedirect: boolean;
+}
+
+export function createOCIAuthDiagnostics(): OCIAuthDiagnostics {
+	return {
+		authLookupWouldBeBlocked: false,
+		registryRedirectWouldPreventCredentialForwarding: false,
+		authServerRedirect: false,
+	};
+}

src/spec-configuration/containerCollectionsOCI.ts

@@ -8,6 +8,7 @@ import { Log, LogLevel } from '../spec-utils/log';
 import { isLocalFile, mkdirpLocal, readLocalFile, writeLocalFile } from '../spec-utils/pfs';
 import { requestEnsureAuthenticated } from './httpOCIRegistry';
 import { GoARCH, GoOS, PlatformInfo } from '../spec-common/commonUtils';
+import { OCIAuthDiagnostics } from '../spec-common/ociAuth';
 
 export const DEVCONTAINER_MANIFEST_MEDIATYPE = 'application/vnd.devcontainers';
 export const DEVCONTAINER_TAR_LAYER_MEDIATYPE = 'application/vnd.devcontainers.layer.v1+tar';
@@ -18,13 +19,17 @@ export interface CommonParams {
 	env: NodeJS.ProcessEnv;
 	output: Log;
 	cachedAuthHeader?: Record<string, string>; // <registry, authHeader>
+	allowedCrossOriginAuthHosts?: string[];
+	ociAuthHardening?: boolean;
+	ociAuthDiagnostics: OCIAuthDiagnostics;
 }
 
 // Represents the unique OCI identifier for a Feature or Template.
 // eg:  ghcr.io/devcontainers/features/go:1.0.0
 // eg:  ghcr.io/devcontainers/features/go@sha256:fe73f123927bd9ed1abda190d3009c4d51d0e17499154423c5913cf344af15a3
 // Constructed by 'getRef()'
 export interface OCIRef {
+	scheme: 'http' | 'https';
 	registry: string; 		// 'ghcr.io'
 	owner: string;			// 'devcontainers'
 	namespace: string;		// 'devcontainers/features'
@@ -41,6 +46,7 @@ export interface OCIRef {
 // eg:  ghcr.io/devcontainers/features:latest
 // Constructed by 'getCollectionRef()'
 export interface OCICollectionRef {
+	scheme: 'http' | 'https';
 	registry: string;		// 'ghcr.io'
 	path: string;			// 'devcontainers/features'
 	resource: string;		// 'ghcr.io/devcontainers/features'
@@ -116,6 +122,10 @@ const regexForPath = /^[a-z0-9]+([._-][a-z0-9]+)*(\/[a-z0-9]+([._-][a-z0-9]+)*)*
 // MUST be at most 128 characters in length and MUST match the following regular expression:
 const regexForVersionOrDigest = /^[a-zA-Z0-9_][a-zA-Z0-9._-]{0,127}$/;
 
+function getRegistryScheme(registry: string): OCIRef['scheme'] {
+	return new URL(`https://${registry}`).hostname.toLowerCase() === 'localhost' ? 'http' : 'https';
+}
+
 // https://go.dev/doc/install/source#environment
 // Expected by OCI Spec as seen here: https://github.com/opencontainers/image-spec/blob/main/image-index.md#image-index-property-descriptions
 export function mapNodeArchitectureToGOARCH(arch: NodeJS.Architecture): GoARCH {
@@ -236,6 +246,7 @@ export function getRef(output: Log, input: string): OCIRef | undefined {
 	output.write(`> digest?: ${digest}`, LogLevel.Trace);
 
 	return {
+		scheme: getRegistryScheme(registry),
 		id,
 		owner,
 		namespace,
@@ -266,6 +277,7 @@ export function getCollectionRef(output: Log, registry: string, namespace: strin
 	}
 
 	return {
+		scheme: getRegistryScheme(registry),
 		registry,
 		path,
 		resource,
@@ -291,7 +303,7 @@ export async function fetchOCIManifestIfExists(params: CommonParams, ref: OCIRef
 	if (manifestDigest) {
 		reference = manifestDigest;
 	}
-	const manifestUrl = `https://${ref.registry}/v2/${ref.path}/manifests/${reference}`;
+	const manifestUrl = `${ref.scheme}://${ref.registry}/v2/${ref.path}/manifests/${reference}`;
 	output.write(`manifest url: ${manifestUrl}`, LogLevel.Trace);
 	const expectedDigest = manifestDigest || ('digest' in ref ? ref.digest : undefined);
 	const manifestContainer = await getManifest(params, manifestUrl, ref, undefined, expectedDigest);
@@ -467,7 +479,7 @@ export async function getVersionsStrictSorted(params: CommonParams, ref: OCIRef)
 export async function getPublishedTags(params: CommonParams, ref: OCIRef): Promise<string[] | undefined> {
 	const { output } = params;
 	try {
-		const url = `https://${ref.registry}/v2/${ref.namespace}/${ref.id}/tags/list`;
+		const url = `${ref.scheme}://${ref.registry}/v2/${ref.namespace}/${ref.id}/tags/list`;
 
 		const headers = {
 			'Accept': 'application/json',

src/spec-configuration/containerCollectionsOCIPush.ts

@@ -167,7 +167,7 @@ async function putManifestWithTags(params: CommonParams, manifest: ManifestConta
 	const { manifestBuffer, contentDigest } = manifest;
 
 	for await (const tag of tags) {
-		const url = `https://${ociRef.registry}/v2/${ociRef.path}/manifests/${tag}`;
+		const url = `${ociRef.scheme}://${ociRef.registry}/v2/${ociRef.path}/manifests/${tag}`;
 		output.write(`PUT -> '${url}'`, LogLevel.Trace);
 
 		const httpOptions = {
@@ -232,7 +232,7 @@ async function putBlob(params: CommonParams, blobPutLocationUriPath: string, oci
 	if (blobPutLocationUriPath.startsWith('https://') || blobPutLocationUriPath.startsWith('http://')) {
 		url = blobPutLocationUriPath;
 	} else {
-		url = `https://${ociRef.registry}${blobPutLocationUriPath}`;
+		url = `${ociRef.scheme}://${ociRef.registry}${blobPutLocationUriPath}`;
 	}
 
 	// The <location> MAY contain critical query parameters.
@@ -332,7 +332,7 @@ export async function calculateDataLayer(output: Log, data: Buffer, basename: st
 export async function checkIfBlobExists(params: CommonParams, ociRef: OCIRef | OCICollectionRef, digest: string): Promise<boolean> {
 	const { output } = params;
 
-	const url = `https://${ociRef.registry}/v2/${ociRef.path}/blobs/${digest}`;
+	const url = `${ociRef.scheme}://${ociRef.registry}/v2/${ociRef.path}/blobs/${digest}`;
 	const res = await requestEnsureAuthenticated(params, { type: 'HEAD', url, headers: {} }, ociRef);
 	if (!res) {
 		output.write('Request failed', LogLevel.Error);
@@ -349,7 +349,7 @@ export async function checkIfBlobExists(params: CommonParams, ociRef: OCIRef | O
 async function postUploadSessionId(params: CommonParams, ociRef: OCIRef | OCICollectionRef): Promise<string | undefined> {
 	const { output } = params;
 
-	const url = `https://${ociRef.registry}/v2/${ociRef.path}/blobs/uploads/`;
+	const url = `${ociRef.scheme}://${ociRef.registry}/v2/${ociRef.path}/blobs/uploads/`;
 	output.write(`Generating Upload URL -> ${url}`, LogLevel.Trace);
 	const res = await requestEnsureAuthenticated(params, { type: 'POST', url, headers: {} }, ociRef);
 

src/spec-configuration/containerFeaturesConfiguration.ts

@@ -19,6 +19,7 @@ import { request } from '../spec-utils/httpRequest';
 import { fetchOCIFeature, tryGetOCIFeatureSet, fetchOCIFeatureManifestIfExistsFromUserIdentifier } from './containerFeaturesOCI';
 import { uriToFsPath } from './configurationCommonUtils';
 import { CommonParams, ManifestContainer, OCIManifest, OCIRef, getRef, getVersionsStrictSorted } from './containerCollectionsOCI';
+import { OCIAuthDiagnostics } from '../spec-common/ociAuth';
 import { Lockfile, generateLockfile, readLockfile, writeLockfile } from './lockfile';
 import { computeDependsOnInstallationOrder } from './containerFeaturesOrder';
 import { logFeatureAdvisories } from './featureAdvisories';
@@ -195,6 +196,9 @@ export interface ContainerFeatureInternalParams {
 	platform: NodeJS.Platform;
 	noLockfile?: boolean;
 	frozenLockfile?: boolean;
+	allowedCrossOriginAuthHosts?: string[];
+	ociAuthHardening?: boolean;
+	ociAuthDiagnostics: OCIAuthDiagnostics;
 }
 
 // TODO: Move to node layer.
@@ -203,6 +207,8 @@ export function getContainerFeaturesBaseDockerFile(contentSourceRootPath: string
 
 #{nonBuildKitFeatureContentFallback}
 
+ARG _DEV_CONTAINERS_BASE_IMAGE=scratch
+
 FROM $_DEV_CONTAINERS_BASE_IMAGE AS dev_containers_feature_content_normalize
 USER root
 COPY --from=dev_containers_feature_content_source ${path.posix.join(contentSourceRootPath, 'devcontainer-features.builtin.env')} /tmp/build-features/
@@ -389,7 +395,7 @@ const cleanupIterationFetchAndMerge = async (tempTarballPath: string, output: Lo
 	}
 };
 
-function getRequestHeaders(params: CommonParams, sourceInformation: SourceInformation) {
+function getRequestHeaders(params: { env: NodeJS.ProcessEnv; output: Log }, sourceInformation: SourceInformation) {
 	const { env, output } = params;
 	let headers: { 'user-agent': string; 'Authorization'?: string; 'Accept'?: string } = {
 		'user-agent': 'devcontainer'
@@ -955,7 +961,7 @@ export async function processFeatureIdentifier(params: CommonParams, configPath:
 	// throw new Error(`Unsupported feature source type: ${type}`);
 }
 
-async function fetchFeatures(params: { extensionPath: string; cwd: string; output: Log; env: NodeJS.ProcessEnv }, featuresConfig: FeaturesConfig, dstFolder: string, ociCacheDir: string, lockfile: Lockfile | undefined) {
+async function fetchFeatures(params: ContainerFeatureInternalParams, featuresConfig: FeaturesConfig, dstFolder: string, ociCacheDir: string, lockfile: Lockfile | undefined) {
 	const featureSets = featuresConfig.featureSets;
 	for (let idx = 0; idx < featureSets.length; idx++) { // Index represents the previously computed installation order.
 		const featureSet = featureSets[idx];

src/spec-configuration/containerFeaturesOCI.ts

@@ -61,7 +61,7 @@ export async function fetchOCIFeature(params: CommonParams, featureSet: FeatureS
 	const { featureRef } = featureSet.sourceInformation;
 
 	const layerDigest = featureSet.sourceInformation.manifest?.layers[0].digest;
-	const blobUrl = `https://${featureSet.sourceInformation.featureRef.registry}/v2/${featureSet.sourceInformation.featureRef.path}/blobs/${layerDigest}`;
+	const blobUrl = `${featureRef.scheme}://${featureRef.registry}/v2/${featureRef.path}/blobs/${layerDigest}`;
 	output.write(`blob url: ${blobUrl}`, LogLevel.Trace);
 
 	const blobResult = await getBlob(params, blobUrl, ociCacheDir, featCachePath, featureRef, layerDigest, undefined, metadataFile);

src/spec-configuration/containerTemplatesOCI.ts

@@ -43,7 +43,7 @@ export async function fetchTemplate(params: CommonParams, selectedTemplate: Sele
 		return;
 	}
 
-	const blobUrl = `https://${templateRef.registry}/v2/${templateRef.path}/blobs/${blobDigest}`;
+	const blobUrl = `${templateRef.scheme}://${templateRef.registry}/v2/${templateRef.path}/blobs/${blobDigest}`;
 	output.write(`blob url: ${blobUrl}`, LogLevel.Trace);
 
 	const tmpDir = userProvidedTmpDir || path.join(os.tmpdir(), 'vsch-template-temp', `${Date.now()}`);