Reuse local credentials
Devsy will automatically make certain local credentials available inside of the development container through a credentials helper. This allows you to reuse existing local credentials in a safe manner within the development container without explicitly configuring them inside each workspace. Currently Devsy supports this feature for git credentials and docker credentials.
Only use with trusted repositories and reviewed configuration
Do not enable credential injection or SSH agent forwarding for untrusted repositories, or for any devcontainer.json you have not reviewed. Anything that runs inside the container — including lifecycle commands and features defined in devcontainer.json — can use the forwarded credentials.
SSH agent forwarding never exposes your private key to the container, but it is not a full sandbox boundary: anyone with access to the forwarded agent socket inside the container can request signatures, and therefore authenticate as you against any remote service the key is trusted by, for as long as the workspace runs. A malicious or compromised devcontainer.json can use this to push, pull, or otherwise act with your identity, even though it can never exfiltrate the key itself. The same caution applies to injected git/docker credentials: they let code in the container act with your access.
Git credentials
Devsy will make https credentials available inside the dev container through a git credentials helper. ssh credentials are available through agent-forwarding that will be configured automatically on the ssh configuration for the workspace.
If you don't want Devsy to inject the credentials, you can disable that via the following command for all workspaces:
devsy context set default -o SSH_INJECT_GIT_CREDENTIALS=falseDocker credentials
Devsy will make docker registry credentials available inside the dev container through a docker credentials helper. This allows you to pull and push images from and to private registries from within the dev container.
If you don't want Devsy to inject the credentials, you can disable that via the following command for all workspaces:
devsy context set default -o SSH_INJECT_DOCKER_CREDENTIALS=falseGPG credentials
Devsy will make gpg keys available inside the dev container through an ssh tunnel. This allows you to sign commits from inside the workspace.
To have Devsy inject the gpg keys, enable it via the following command for all workspaces:
devsy context set default -o GPG_AGENT_FORWARDING=trueOr when creating a workspace using:
devsy workspace up --ssh-gpg-forwarding my-workspace