diff --git a/README.md b/README.md index 9c2887e..c07cb2f 100644 --- a/README.md +++ b/README.md @@ -47,7 +47,7 @@ If you use [Renovate](https://docs.renovatebot.com/) or Dependabot, they can aut | [Go](src/golang) | `ghcr.io/bare-devcontainer/templates/golang` | Security-focused Go dev container with hardened defaults and rebuild-friendly caches. | | [mise](src/mise) | `ghcr.io/bare-devcontainer/templates/mise` | Security-focused mise dev container for multiple runtimes, with rebuild-friendly caches. | | [Node.js](src/node) | `ghcr.io/bare-devcontainer/templates/node` | Security-focused Node.js dev container for JS/TS with hardened, non-root defaults. | -| [Rust](src/rust) | `ghcr.io/bare-devcontainer/templates/rust` | Security-focused Rust dev container with rust-analyzer and persistent Cargo caches. | +| [Rust](src/rustup) | `ghcr.io/bare-devcontainer/templates/rustup` | Security-focused Rust dev container with rust-analyzer and persistent Cargo caches. | | [Terraform](src/terraform) | `ghcr.io/bare-devcontainer/templates/terraform` | Security-focused Terraform dev container with terraform-ls and rebuild-friendly caching. | | [uv](src/uv) | `ghcr.io/bare-devcontainer/templates/uv` | Security-focused Python dev container with uv, hardened defaults, and cached packages. | | [Zig](src/zig) | `ghcr.io/bare-devcontainer/templates/zig` | Security-focused Zig dev container with zls integration and a persistent build cache. | diff --git a/src/rust/.devcontainer/devcontainer.json b/src/rustup/.devcontainer/devcontainer.json similarity index 86% rename from src/rust/.devcontainer/devcontainer.json rename to src/rustup/.devcontainer/devcontainer.json index 95deb6b..8abb050 100644 --- a/src/rust/.devcontainer/devcontainer.json +++ b/src/rustup/.devcontainer/devcontainer.json @@ -1,8 +1,8 @@ { "name": "Rust", - // Recommended: pin to a digest (e.g. "ghcr.io/bare-devcontainer/rust:trixie@sha256:"). + // Recommended: pin to a digest (e.g. "ghcr.io/bare-devcontainer/rustup:trixie@sha256:"). // See https://github.com/bare-devcontainer/templates#pinning-images-to-a-digest - "image": "ghcr.io/bare-devcontainer/rust:${templateOption:imageVariant}", + "image": "ghcr.io/bare-devcontainer/rustup:${templateOption:imageVariant}", "remoteUser": "dev", "runArgs": ["--cap-drop=ALL"], // Uncomment the following options to enable the debugger. @@ -20,13 +20,13 @@ // Persist the Cargo registry cache across rebuilds to avoid re-downloading crates. // Only registry/ and git/ are mounted; ~/.cargo/bin is intentionally left in the image layer. { - "source": "${devcontainerId}-rust-cargo-registry", + "source": "${devcontainerId}-rustup-cargo-registry", "target": "/home/dev/.cargo/registry", "type": "volume" }, // Persist Cargo's cache of git-sourced dependencies across rebuilds. { - "source": "${devcontainerId}-rust-cargo-git", + "source": "${devcontainerId}-rustup-cargo-git", "target": "/home/dev/.cargo/git", "type": "volume" } diff --git a/src/rust/NOTES.md b/src/rustup/NOTES.md similarity index 78% rename from src/rust/NOTES.md rename to src/rustup/NOTES.md index 120347d..3ba6ddd 100644 --- a/src/rust/NOTES.md +++ b/src/rustup/NOTES.md @@ -6,7 +6,7 @@ See [Getting Started](https://github.com/bare-devcontainer/templates#getting-sta This template applies the shared hardening defaults of Bare Dev Container Templates: -- Builds on `ghcr.io/bare-devcontainer/rust`, a minimal image from [bare-devcontainer/images](https://github.com/bare-devcontainer/images) with pinned digests, SLSA provenance, and an SPDX SBOM for supply-chain transparency. +- Builds on `ghcr.io/bare-devcontainer/rustup`, a minimal image from [bare-devcontainer/images](https://github.com/bare-devcontainer/images) with pinned digests, SLSA provenance, and an SPDX SBOM for supply-chain transparency. - Runs as the non-root `dev` user. - Drops all Linux capabilities (`--cap-drop=ALL`) and sets the `no-new-privileges` security option, so processes cannot gain elevated privileges inside the container. Remove `no-new-privileges` from `securityOpt` if you need `su`/`sudo`. - Starts an init process (`"init": true`) to reap zombie processes. @@ -19,8 +19,8 @@ Cargo's registry and git caches are persisted in named volumes, so rebuilding th | Volume | Mount path | Purpose | |--------|------------|---------| -| `${devcontainerId}-rust-cargo-registry` | `/home/dev/.cargo/registry` | Cargo registry cache | -| `${devcontainerId}-rust-cargo-git` | `/home/dev/.cargo/git` | Cargo's cache of git-sourced dependencies | +| `${devcontainerId}-rustup-cargo-registry` | `/home/dev/.cargo/registry` | Cargo registry cache | +| `${devcontainerId}-rustup-cargo-git` | `/home/dev/.cargo/git` | Cargo's cache of git-sourced dependencies | Only `registry/` and `git/` are mounted; `~/.cargo/bin` is intentionally left in the image layer so the toolchain binaries always come from the image. diff --git a/src/rust/README.md b/src/rustup/README.md similarity index 78% rename from src/rust/README.md rename to src/rustup/README.md index fad497e..e6b7636 100644 --- a/src/rust/README.md +++ b/src/rustup/README.md @@ -1,5 +1,5 @@ -# Rust (rust) +# Rust (rustup) Security-focused Rust dev container with rust-analyzer and persistent Cargo caches. @@ -17,7 +17,7 @@ See [Getting Started](https://github.com/bare-devcontainer/templates#getting-sta This template applies the shared hardening defaults of Bare Dev Container Templates: -- Builds on `ghcr.io/bare-devcontainer/rust`, a minimal image from [bare-devcontainer/images](https://github.com/bare-devcontainer/images) with pinned digests, SLSA provenance, and an SPDX SBOM for supply-chain transparency. +- Builds on `ghcr.io/bare-devcontainer/rustup`, a minimal image from [bare-devcontainer/images](https://github.com/bare-devcontainer/images) with pinned digests, SLSA provenance, and an SPDX SBOM for supply-chain transparency. - Runs as the non-root `dev` user. - Drops all Linux capabilities (`--cap-drop=ALL`) and sets the `no-new-privileges` security option, so processes cannot gain elevated privileges inside the container. Remove `no-new-privileges` from `securityOpt` if you need `su`/`sudo`. - Starts an init process (`"init": true`) to reap zombie processes. @@ -30,8 +30,8 @@ Cargo's registry and git caches are persisted in named volumes, so rebuilding th | Volume | Mount path | Purpose | |--------|------------|---------| -| `${devcontainerId}-rust-cargo-registry` | `/home/dev/.cargo/registry` | Cargo registry cache | -| `${devcontainerId}-rust-cargo-git` | `/home/dev/.cargo/git` | Cargo's cache of git-sourced dependencies | +| `${devcontainerId}-rustup-cargo-registry` | `/home/dev/.cargo/registry` | Cargo registry cache | +| `${devcontainerId}-rustup-cargo-git` | `/home/dev/.cargo/git` | Cargo's cache of git-sourced dependencies | Only `registry/` and `git/` are mounted; `~/.cargo/bin` is intentionally left in the image layer so the toolchain binaries always come from the image. @@ -47,4 +47,4 @@ Only `registry/` and `git/` are mounted; `~/.cargo/bin` is intentionally left in --- -_Note: This file was auto-generated from the [devcontainer-template.json](https://github.com/bare-devcontainer/templates/blob/main/src/rust/devcontainer-template.json). Add additional notes to a `NOTES.md`._ +_Note: This file was auto-generated from the [devcontainer-template.json](https://github.com/bare-devcontainer/templates/blob/main/src/rustup/devcontainer-template.json). Add additional notes to a `NOTES.md`._ diff --git a/src/rust/devcontainer-template.json b/src/rustup/devcontainer-template.json similarity index 89% rename from src/rust/devcontainer-template.json rename to src/rustup/devcontainer-template.json index a0a2281..8997358 100644 --- a/src/rust/devcontainer-template.json +++ b/src/rustup/devcontainer-template.json @@ -1,10 +1,10 @@ { - "id": "rust", - "version": "1.3.1", + "id": "rustup", + "version": "1.4.0", "name": "Rust", "description": "Security-focused Rust dev container with rust-analyzer and persistent Cargo caches.", "publisher": "Bare Dev Container Maintainers", - "documentationURL": "https://github.com/bare-devcontainer/templates/tree/main/src/rust", + "documentationURL": "https://github.com/bare-devcontainer/templates/tree/main/src/rustup", "licenseURL": "https://github.com/bare-devcontainer/templates/blob/main/LICENSE", "options": { "imageVariant": { diff --git a/test/rust/test.sh b/test/rustup/test.sh similarity index 85% rename from test/rust/test.sh rename to test/rustup/test.sh index 80d8ff2..cb04610 100755 --- a/test/rust/test.sh +++ b/test/rustup/test.sh @@ -1,7 +1,7 @@ #!/bin/sh . "$(dirname "$0")/../_global/common.sh" -# The bare rust image ships rustup only; users install their own toolchain. +# The bare rustup image ships rustup only; users install their own toolchain. rustup --version rustup toolchain list