Adding container definition fails

[rzhao271]

• VSCode Version: 1.74.0-insider
• Local OS Version: Windows 11
• Remote OS Version: Not sure, see steps
• Remote Extension/Connection Type: Containers
• Logs: Not sure where to find them.

Steps to Reproduce:

1. Run the "Add Dev Container Configuration Files..." command.
2. Pick Node & TypeScript and keep pressing enter after that to pick the default options.
3. 🐛 A dialog pops up.

Error message:

DialogService#show Command 'Dev Containers: Add Dev Container Configuration Files...' resulted in an error (Command failed: C:\Users\raymondzhao\AppData\Local\Programs\Microsoft VS Code Insiders\Code - Insiders.exe --ms-enable-electron-run-as-node c:\Users\raymondzhao\.vscode-insiders\extensions\ms-vscode-remote.remote-containers-0.266.0\dist\spec-node\devContainersSpecCLI.js templates apply --workspace-folder C:\Users\RAYMON~1\AppData\Local\Temp\tmp-output-dir-1670371163686 --template-id ghcr.io/devcontainers/templates/typescript-node:latest --template-args {"imageVariant":"16-bullseye"} --features [] --tmp-dir C:\Users\RAYMON~1\AppData\Local\Temp\tmp-dir-1670371163686)

Does this issue occur when you try this locally?: N/A
Does this issue occur when you try this locally and all extensions are disabled?: N/A

[chrmarti]

Could you append the container log when this fails? (F1 > Dev Containers: Show Container Log)

[rzhao271]

So that's where the logs are 🎉
There's a 403 error

[35671 ms] Dev Containers 0.266.0 in VS Code 1.74.0-insider (5235c6bb189b60b01b1f49062f4ffa42384f8c91).
[35669 ms]  -- CREATEDEVCONTAINER v2
[42400 ms] Start: Run: C:\Users\raymondzhao\AppData\Local\Programs\Microsoft VS Code Insiders\Code - Insiders.exe --ms-enable-electron-run-as-node c:\Users\raymondzhao\.vscode-insiders\extensions\ms-vscode-remote.remote-containers-0.266.0\dist\spec-node\devContainersSpecCLI.js templates apply --workspace-folder C:\Users\RAYMON~1\AppData\Local\Temp\tmp-output-dir-1670432717135 --template-id ghcr.io/devcontainers/templates/typescript-node:latest --template-args {"imageVariant":"16-bullseye"} --features [] --tmp-dir C:\Users\RAYMON~1\AppData\Local\Temp\tmp-dir-1670432717135
[43193 ms] [2022-12-07T17:05:17.987Z] @devcontainers/cli 0.25.2. Node.js v16.14.2. win32 10.0.22621 x64.
[43223 ms] (node:14936) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
[43224 ms] (Use `Code - Insiders --trace-deprecation ...` to show where the warning was created)
[45625 ms] [2022-12-07T17:05:20.419Z] HTTP request failed with status code 403: : Forbidden
[45627 ms] [2022-12-07T17:05:20.421Z] Failed to get registry auth token with error: Error: HTTP 403: Forbidden
[45751 ms] [2022-12-07T17:05:20.545Z] Failed to fetch template manifest for ghcr.io/devcontainers/templates/typescript-node:latest
[45753 ms] [2022-12-07T17:05:20.546Z] Failed to fetch template 'ghcr.io/devcontainers/templates/typescript-node:latest'.
[45791 ms] Exit code 1

[Supportic]

I have the same issue. It's happening in WSL2 and on Windows. I updated from extension version 0.262.3 to 0.266.1.
Switching back to the older version fixed it.
I tried to create config files from my docker-compose file and got stuck with this menu without notifications.

Devcontainer log just prints:

[424477 ms]  -- CREATEDEVCONTAINER v2
[429398 ms] Start: Run: C:\Users\<user>\AppData\Local\Programs\Microsoft VS Code\Code.exe --ms-enable-electron-run-as-node c:\Users\<user>\.vscode\extensions\ms-vscode-remote.remote-containers-0.266.1\dist\spec-node\devContainersSpecCLI.js templates apply --workspace-folder D:\Temp\tmp-output-dir-1670533304110 --template-id ghcr.io/devcontainers/templates/docker-existing-docker-compose:latest --template-args {} --features [] --tmp-dir D:\Temp\tmp-dir-1670533304110
[429732 ms] [2022-12-08T21:01:44.444Z] @devcontainers/cli 0.25.2. Node.js v16.14.2. win32 10.0.19045 x64.
[429763 ms] (node:30104) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
[429764 ms] (Use `Code --trace-deprecation ...` to show where the warning was created)

Also devcontainers should see the new recommended "compose.ya?ml" file [ref] and create configs from it.

[twsl]

Seems like it now fails if there is an issue with the network connection. In my case i think it's related to self signed certificates:

[79100 ms] Dev Containers 0.266.1 in VS Code 1.74.0 (5235c6bb189b60b01b1f49062f4ffa42384f8c91).
[79099 ms]  -- CREATEDEVCONTAINER v2
[97527 ms] Start: Run: C:\Program Files\Microsoft VS Code\Code.exe --ms-enable-electron-run-as-node c:\Users\twsl\.vscode\extensions\ms-vscode-remote.remote-containers-0.266.1\dist\spec-node\devContainersSpecCLI.js templates apply --workspace-folder C:\Users\twsl\AppData\Local\Temp\tmp-output-dir-1670575578114 --template-id ghcr.io/devcontainers/templates/dotnet:latest --template-args {"imageVariant":"7.0"} --features [{"id":"ghcr.io/devcontainers/features/node:1","options":{}},{"id":"ghcr.io/devcontainers/features/python:1","options":{}}] --tmp-dir C:\Users\twsl\AppData\Local\Temp\tmp-dir-1670575578114
[97887 ms] [2022-12-09T08:46:18.484Z] @devcontainers/cli 0.25.2. Node.js v16.14.2. win32 10.0.19042 x64.
[97911 ms] (node:9596) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
[97911 ms] (Use `Code --trace-deprecation ...` to show where the warning was created)
[98019 ms] [2022-12-09T08:46:18.616Z] Failed to get registry auth token with error: Error: self signed certificate in certificate chain
[98074 ms] [2022-12-09T08:46:18.672Z] Failed to fetch template manifest for ghcr.io/devcontainers/templates/dotnet:latest
[98077 ms] [2022-12-09T08:46:18.672Z] Failed to fetch template 'ghcr.io/devcontainers/templates/dotnet:latest'.
[98097 ms] Exit code 1

[combiz]

Also experiencing this, and also seems related to self signed certificates.

[260374 ms] Dev Containers 0.266.1 in VS Code 1.73.1 (6261075646f055b99068d3688932416f2346dd3b).
[260374 ms]  -- CREATEDEVCONTAINER v2
[337932 ms] Start: Run: C:\Program Files\Microsoft VS Code\Code.exe --ms-enable-electron-run-as-node c:\Users\combiz.k\.vscode\extensions\ms-vscode-remote.remote-containers-0.266.1\dist\spec-node\devContainersSpecCLI.js templates apply --workspace-folder C:\Users\COMBIZ~1.K\AppData\Local\Temp\tmp-output-dir-1670868037740 --template-id ghcr.io/devcontainers/templates/python:latest --template-args {"imageVariant":"3.11"} --features [{"id":"ghcr.io/devcontainers-contrib/features/black:1","options":{}},{"id":"ghcr.io/devcontainers-contrib/features/flake8:1","options":{}},{"id":"ghcr.io/devcontainers-contrib/features/isort:1","options":{}}] --tmp-dir C:\Users\COMBIZ~1.K\AppData\Local\Temp\tmp-dir-1670868037740
[338169 ms] [2022-12-12T18:00:37.983Z] @devcontainers/cli 0.25.2. Node.js v16.14.2. win32 10.0.22621 x64.
[338186 ms] (node:7684) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
[338187 ms] (Use `Code --trace-deprecation ...` to show where the warning was created)
[338262 ms] [2022-12-12T18:00:38.077Z] Failed to get registry auth token with error: Error: self signed certificate in certificate chain
[338313 ms] [2022-12-12T18:00:38.128Z] Failed to fetch template manifest for ghcr.io/devcontainers/templates/python:latest
[338314 ms] [2022-12-12T18:00:38.128Z] Failed to fetch template 'ghcr.io/devcontainers/templates/python:latest'.
[338327 ms] Exit code 1

[chrmarti]

@joshspicer @samruddhikhandale Something with the registry access seems off. Could you take a look? Also: Not all logs show the same error. Some are 403s while others are about self signed certificates.

[joshspicer]

I haven't been able to reproduce any of these instances yet. I have noticed that each instance of this was on 0.25.2, before significant changes to the OCI code was changed in 0.26.0.

This seems like it would be a limitation of our https library follow-redirects, although I am not yet sure how.

[markba]

I have the same certificate error using macOS 12.6.1 on an M1 with VS Code 1.74.2 and Dev Containers 0.266.1

Update: This issue was resolved by setting the Netskope certificate in Keychain to 'Always Trust'

[joshspicer]

Update: This issue was resolved by setting the Netskope certificate in Keychain to 'Always Trust'

What led you to make this change @markba ?

[markba]

The error indicated self-signed certificates being part of the problem, so I started with something I know that MITM's my connection @joshspicer

[wadebee]

Also experiencing this, and also seems related to self signed certificates.

I will add that I am experiencing the same. We are also using a self signed certificate:
[179793 ms] Dev Containers 0.266.1 in VS Code 1.74.2 (e8a3071ea4344d9d48ef8a4df2c097372b0c5161).
[179792 ms] -- CREATEDEVCONTAINER v2
[673740 ms] Start: Run: C:\Users\xxxx\AppData\Local\Programs\Microsoft VS Code\Code.exe --ms-enable-electron-run-as-node c:\Users\xxxx.vscode\extensions\ms-vscode-remote.remote-containers-0.266.1\dist\spec-node\devContainersSpecCLI.js templates apply --workspace-folder C:\Users\xxxx\AppData\Local\Temp\tmp-output-dir-1672323861533 --template-id ghcr.io/devcontainers/templates/dotnet:latest --template-args {"imageVariant":"6.0"} --features [] --tmp-dir C:\Users\xxxx\AppData\Local\Temp\tmp-dir-1672323861533
[674328 ms] [2022-12-29T14:24:22.140Z] @devcontainers/cli 0.25.2. Node.js v16.14.2. win32 10.0.19044 x64.
[674350 ms] (node:3004) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
[674350 ms] (Use Code --trace-deprecation ... to show where the warning was created)
[674535 ms] [2022-12-29T14:24:22.348Z] Failed to get registry auth token with error: Error: self signed certificate in certificate chain
[674637 ms] [2022-12-29T14:24:22.450Z] Failed to fetch template manifest for ghcr.io/devcontainers/templates/dotnet:latest
[674638 ms] [2022-12-29T14:24:22.450Z] Failed to fetch template 'ghcr.io/devcontainers/templates/dotnet:latest'.
[674651 ms] Exit code 1

[pearces]

I also had this problem (403 errors) with Dev Containers 0.266.1 in VS Code 1.74.2 so I went back 2 releases with the extension, created the container and then updated the extension to latest and it's working but it wasn't an obvious workaround.

[samruddhikhandale]

@wadebee does the solution mentioned in #7648 (comment) work for you?

[samruddhikhandale]

I am not able to reproduce the 403 errors.

I also had this problem (403 errors) with Dev Containers 0.266.1 in VS Code 1.74.2 so I went back 2 releases with the extension, created the container and then updated the extension to latest and it's working but it wasn't an obvious workaround.

I don't think we released v0.266.1, however, v0.266.0 is like a month old. @pearces does the issue still occur with the latest CLI?

[pearces]

@samruddhikhandale I just checked the extension version again and it's correct and I can still reliably reproduce the problem. Here's the log from doing it again:

[20550 ms] Dev Containers 0.266.1 in VS Code 1.74.2 (e8a3071ea4344d9d48ef8a4df2c097372b0c5161).
[20548 ms]  -- CREATEDEVCONTAINER v2
[61364 ms] Start: Run: /Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper (Plugin).app/Contents/MacOS/Code Helper (Plugin) --ms-enable-electron-run-as-node /Users/spearce/.vscode/extensions/ms-vscode-remote.remote-containers-0.266.1/dist/spec-node/devContainersSpecCLI.js templates apply --workspace-folder /var/folders/6v/d3whwfb96d73ln9nh2lp8_c40000gn/T/tmp-output-dir-1672793579235 --template-id ghcr.io/devcontainers/templates/javascript-node:latest --template-args {"imageVariant":"16"} --features [{"id":"ghcr.io/guiyomh/features/vim:0","options":{}}] --tmp-dir /var/folders/6v/d3whwfb96d73ln9nh2lp8_c40000gn/T/tmp-dir-1672793579235
[61765 ms] [2023-01-04T00:52:59.665Z] @devcontainers/cli 0.25.2. Node.js v16.14.2. darwin 21.6.0 x64.
[61790 ms] (node:73402) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
[61791 ms] (Use `Code Helper (Plugin) --trace-deprecation ...` to show where the warning was created)
[61995 ms] [2023-01-04T00:52:59.896Z] HTTP request failed with status code 403: : Forbidden
[61998 ms] [2023-01-04T00:52:59.899Z] Failed to get registry auth token with error: Error: HTTP 403: Forbidden
[62101 ms] [2023-01-04T00:53:00.001Z] Failed to fetch template manifest for ghcr.io/devcontainers/templates/javascript-node:latest
[62101 ms] [2023-01-04T00:53:00.001Z] Failed to fetch template 'ghcr.io/devcontainers/templates/javascript-node:latest'.
[62115 ms] Exit code 1

[eitsupi]

I think this is duplicate of #7431

[pearces]

@eitsupi I agree, this happens to me both locally and over SSH

[chrmarti]

Dev Containers 0.270.0-pre-release comes with the auth improvements in devcontainers/cli#341 in case this makes a difference.

Not sure if the 403 is related to proxy support in #7431.

[jdwlynch]

For context - I'm having the Error: self signed certificate in certificate chain issue.

@chrmarti I upgraded to the 0.270.0-pre-release version of Dev Containers, and I'm still having the same issue.

I'm providing references to features in the OCI registry as suggested by #7150 but I'm still getting the error.

Below is a snippet from the feature definition of my devcontainer.json. I get the error when I uncomment this block:

    "features": {
        "ghcr.io/devcontainers/features/common-utils:2" {
            "install Zsh": "true",
            "username": "node"
            "upgradePackages": :true"
        }
    },

The error log features the following

Fetching scope token from: https://ghcr.io/token?scope=repository:devcontainers/features/common-utils:pull&serivice=ghcr.io
Not used a scoped token for ghcr.io: Error: self signed certificate in chain
Did not fetch mainfest: Error: self signed certificate in certificate chain

I have a near identical configuration to markba as described in his comment but unfortunately adding the certs as trusted didn't fix my issue.

I've hit a wall and tried all the suggestions I've found and then some. Really looking forward to someone getting to the bottom of this so I can start using it in my development and hopefully contributing.

[yogeshdhawale]

if you remove all the features from devcontainer's "features" set, then, it is able to launch the dev container successfully. This looks like issue which fetching images/packages for new features.

I used vscode-remote-try-rust to launch devcontainer and once it was successfully created and run, I added random feature to devcontainer and when I tried to rebuild the container it failed with timeout to fetch the newly added feature.

[yogeshdhawale]

By the way, I tried to launch devcontainer with feature using fedora wsl and it worked seamlessly, the same is still failing for ubuntu and ubuntu 22.04.

 cat /etc/os-release
NAME="Fedora Linux"
VERSION="38 (Container Image)"
ID=fedora

Various things updated in between, but, ubuntu still are not working. I think something specific is broken with wsl setting for ubuntu images.

[LTangaF]

I'm having this issue, too. Windows 10. Initially, I thought it was because I was doing it through SSH remoting, but I can reproduce this even if I'm just doing the create configuration option on a local empty folder. It complains about not being able to open the devcontainer.json. The directory is present, but the file is not.

It seems to be specific images, though. The Basic Node.js worked fine, but the Jupyter Data Science Notebooks seem to be failing.

This issue seems to have been around awhile, so it'd be nice if it got some attention.