jfxs/devcontainer-uv repository overview

⁠devcontainer uv

A devcontainer⁠ Debian image⁠ with uv⁠ to develop in Python inside a container:

• multiarch with support of amd64 and arm64,
• automatically kept up to date by Renovate⁠ (base image, uv and task versions),
• image signed with Cosign⁠,
• a software bill of materials (SBOM) attestation added using Syft⁠,
• available on Docker Hub and Quay.io.

The main repository.

The Docker Hub registry.

The Quay.io registry.

This image offers an optimal experience for zsh shell users. The image also includes bash shell.

⁠Running with VScode

.devcontainer/devcontainer.json configuration to develop inside a container⁠:

{
  "image": "jfxs/devcontainer-uv",
...
}

⁠Running locally

docker run -it --rm -v $(pwd):/workdir -w /workdir --user vscode:vscode jfxs/devcontainer-uv /bin/zsh

⁠Task

This image includes task⁠ to run commands:

Example:

After installing Ruff dev dependency and adding those lines in your Taskfile.yml:

  lint:
    desc: "Python lint with Ruff."
    cmds:
      - uv run ruff check
    silent: true

  format:
    desc: "Python format with Ruff."
    cmds:
      - uv run ruff check --fix
      - uv run ruff format
    silent: true

You can run:

$ task lint
All checks passed!
$ task format
All checks passed!
1 file reformatted

⁠Built with

Docker latest tag is 0.12.21-002, 0.12, 0⁠.

The complete software bill of materials (SBOM) of each published image, with its known vulnerabilities, is collected in the sbom-docker⁠ repository, under the component devcontainer-uv.

Dockerhub Overview page⁠ has the details of the last published image.

⁠Versioning

Docker tag definition:

• the uv version used,
• a dash
• an increment to differentiate build with the same version starting at 001

<uv_version>-<increment>

Example: 0.12.21-001

⁠Signature and attestation

Cosign⁠ public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEa3yV6+yd/l4zh/tfT6Tx+zn0dhy3
BhFqSad1norLeKSCN2MILv4fZ9GA6ODOlJOw+7vzUvzZVr9IXnxEdjoWJw==
-----END PUBLIC KEY-----

The public key is also available online: https://gitlab.com/op_so/docker/cosign-public-key/-/raw/main/cosign.pub⁠.

To verify an image:

cosign verify --key cosign.pub $IMAGE_URI

To verify and get the software bill of materials (SBOM) attestation:

cosign verify-attestation --key cosign.pub --type spdxjson $IMAGE_URI | jq '.payload | @base64d | fromjson | .predicate'

⁠Authors

• FX Soubirou - Initial work - GitLab repositories⁠

⁠License

This program is free software: you can redistribute it and/or modify it under the terms of the MIT License (MIT). See the LICENSE⁠ for details.