microsoft / microsoft/vscode-remote-release

Remote Containers: Design Bug or missdocumented feature: lack of affinity.

Open
#2,856 2 comments 0 reactions 1 assignee View on GitHub

@chrmarti is already working on this.

Since Apr 28, 2020.

containers feature-request plan-review
Dominant language
Dockerfile
Stars
4.2k
Forks
470
Avg merge
1d 1h
Merged PRs (30d)
1

Description

When Remote Container is created by VSCode it doesn't establish the affinity with the remote container.Affinity is the known pattern that must be implemented in any case when the client creates remote object managed by a separate orchestration mechanism like Docker daemon. The client which owns the remote object can be able to monitor, inspect, and manage his objects, i.e. container but only his objects. Docker run command intentionally speels ID of every created container into PID file when --PID option is provided. This PID must be used for all further interactions with container.
The knowledge of PID makes the client the exclusive owner of the container.
The PID can be achieved also via docker --last/latest ps
Any attempt of access to the container should be blocked unless container is in running state
This is also a good practice to check the remote status periodically and restore it if it went down. Other non-desktop IDEs do such polling with teeth greeting with interval defined by the container only to keep connection with remote container alive.

  • VSCode Version: 2.44.2
  • Local OS Version: Windows 10 Pro 2004 dev preview
  • Remote OS Version: Same machine
  • Remote WSL / Docker Desktop 2.2.3
    Steps to Reproduce:
  1. Install Stack like at my machine
  2. Install corresponding VSCode version
  3. Start VSCode Remote Dev container
  4. Check your container status if you know how
  5. Inspect tour Container if you know how
  6. Restart your container if you know how

Does this issue occur when you try this locally?: Yes, on local Docker engine
Does this issue occur when you try this locally and all extensions are disabled?: Extension specific
P.S. Lack of backward Affinity is a security issue - the container must reject all attempts to attach/ssh if the Client is not the owner.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.