Building devcontainer with --ssh key for GitHub repository in build process fails on VS Code for ARM Mac

Question

We are trying to run a python application using a devcontainer.json with VS Code. The Dockerfile includes the installation of GitHub repositories with pip that require an ssh key. To build the images, we usually use the --ssh flag to pass the required key. We then use this key to run pip inside the Dockerfile as follows: RUN --mount=type=ssh,id=ssh_key python3.9 -m pip install --no-cache-dir -r pip-requirements.txt

We now want to run a devcontainer.json inside VS Code. We have been trying many different ways.

1. Passing the --ssh key using the build arg variable:

Since you can not directly pass the --ssh key, we tried a workaround:

"args": {"kek":"kek --platform=linux/amd64 --ssh ssh_key=/Users/user/.ssh/id_rsa"}

This produces an OK looking build command that works in a normal terminal, but inside VS Code the key is not being passed and the build fails. (Both on Windows & Mac)

2. Putting an initial build command into the initializeCommand parameter and then a simple build command that should use the cached results:

We run a first build inside the initializeCommand parameter:

"initializeCommand": "docker buildx build --platform=linux/amd64 --ssh ssh_key=/Users/user/.ssh/id_rsa ."

and then we have a second build in the regular parameter:

"build": {
      "dockerfile": "../Dockerfile",
      "context": "..",
      "args": {"kek":"kek --platform=linux/amd64"}
  }

This solution is a nice workaround and works flawlessly on Windows. On the ARM Mac, however, only the initializeCommand build stage runs well, the actual build fails, as it does not use the cached version of the images. The crucial step when the --ssh key is used, fails just like described before.

We have no idea why the Mac VS Code ignores the already created images. In a regular terminal, again, the second build command generated by VS Code works flawlessly.

The problem is reproducible on different ARM Macs, and on different repositories.

Here is the entire devcontainer:

{
  "name": "Dockername",
  "build": {
      "dockerfile": "../Dockerfile",
      "context": "..",
      "args": {"kek":"kek --platform=linux/amd64"}
  },
  "initializeCommand": "docker buildx build --platform=linux/amd64 --ssh ssh_key=/Users/user/.ssh/id_rsa .",
  "runArgs": ["--env-file", "configuration.env", "-t"],
  "customizations": {
    "vscode": {
      "extensions": [
        "ms-python.python"
      ]
    }
  }
}

Answer 1

So, we finally found a work around:

1. We add a target to the initialize command:

"initializeCommand": "docker buildx build --platform=linux/amd64 --ssh ssh_key=/Users/user/.ssh/id_rsa -t dev-image ."

2. We create a new Dockerfile Dockerfile-devcontainer that only uses one line:

FROM --platform=linux/amd64 docker.io/library/dev-image:latest

3. In the build command of the devcontainer use that Dockerfile:

  "name": "Docker",
  "initializeCommand": "docker buildx build --platform=linux/amd64 --ssh ssh_key=/Users/user/.ssh/id_rsa -t dev-image:latest .",
  "build": {
      "dockerfile": "Dockerfile-devcontainer",
      "context": "..",
      "args": {"kek":"kek --platform=linux/amd64"}
  },
  "runArgs": ["--env-file", "configuration.env"],
  "customizations": {
    "vscode": {
      "extensions": [
        "ms-python.python"
      ]
    }
  }
}

In this way we can use the .ssh key and the docker image created in the initializeCommand (Tested on MacOS and Windows).