KTOR-7949: Publish DevContainer image (#5048)

* Install Node.js using NVM
* Install Chrome and set CHROME_BIN env var
* Update Android build tools
* Enforce linux/amd64 platform
* Use .nvmrc to set Node.js version
* Publish devcontainer image to GHCR

Author: osipxd

.devcontainer/Dockerfile

@@ -1,13 +1,19 @@
 # syntax=docker/dockerfile:1
+# check=skip=FromPlatformFlagConstDisallowed
 
-FROM eclipse-temurin:21.0.7_6-jdk-noble AS dev
+# Enforce linux/amd64 platform because of two reasons:
+# 1. Chrome doesn't provide arm64 binaries for Linux (https://issues.chromium.org/issues/374811603)
+# 2. Kotlin/Native doesn't support linux/arm64 as a host platform (KT-36871)
+FROM --platform=linux/amd64 eclipse-temurin:21.0.8_9-jdk-noble AS dev
 
 ARG USERNAME=developer
 ARG USER_UID=1001
 ARG USER_GID=$USER_UID
 
 # Use Bash in "strict mode" to run scripts
-SHELL ["/bin/bash", "-euxo", "pipefail", "-c"]
+SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
+
+COPY chrome-dependencies.txt /tmp/chrome-dependencies.txt
 
 RUN <<EOT
   # Add Adoptium repository to download Eclipse Temurin JDK
@@ -22,18 +28,14 @@ RUN <<EOT
   apt-get install --yes --no-install-recommends \
     git util-linux openssh-server \
     ca-certificates curl fonts-liberation \
-    libasound2t64 libatk-bridge2.0-0 libatk1.0-0 libc6 libcairo2 libcups2 libcurl4 libcurl4-gnutls-dev \
-    libdbus-1-3 libexpat1 libfontconfig1 libgbm1 libgdk-pixbuf2.0-0 libglib2.0-0 libgtk-3-0 libncurses6 libnspr4 \
-    libnss3 libpango-1.0-0 libpangocairo-1.0-0 libstdc++6 libx11-6 libx11-xcb1 libxcb1 libxcomposite1 libxcursor1 \
-    libxdamage1 libxext6 libxfixes3 libxi6 libxrandr2 libxrender1 libxss1 libxtst6 lsb-release \
-    nodejs npm \
+    $(grep --invert-match '^#' /tmp/chrome-dependencies.txt | tr '\n' ' ') \
     temurin-8-jdk temurin-11-jdk temurin-17-jdk \
     zip unzip wget xdg-utils sudo
   apt-get clean
-  rm -rf /var/lib/apt/lists/*
+  rm -rf /var/lib/apt/lists/* /tmp/chrome-dependencies.txt
 EOT
 
-# Create non-root user
+# Create a non-root user
 RUN <<EOT
   groupadd --gid $USER_GID $USERNAME
   useradd --uid $USER_UID --gid $USER_GID --create-home $USERNAME
@@ -47,6 +49,50 @@ ENV HOME=/home/$USERNAME \
     SHELL=/bin/bash
 WORKDIR $HOME
 
+# Common variables
+ENV KTOR_DEV="true"
+ARG local_bin="$HOME/.local/bin"
+ENV PATH="$local_bin:$PATH"
+
+# Install Node.js
+ARG node_version="22"
+ARG nvm_version="0.40.3"
+ENV NVM_DIR="$HOME/.nvm"
+
+RUN <<EOT
+  # Install NVM
+  curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v$nvm_version/install.sh | bash
+  source $NVM_DIR/nvm.sh
+
+  # Install Node and Yarn Classic
+  nvm install "$node_version"
+  npm install -g yarn
+
+  # Make Node.js binaries available without "source $NVM_DIR/nvm.sh"
+  # This should be done *after* installation of Yarn
+  mkdir --parents "$local_bin"
+  ln -s "$NVM_BIN"/* "$local_bin"
+
+  # Print versions
+  echo "Node $(node --version)"
+  echo "NPM $(npm --version)"
+  echo "Yarn $(yarn --version)"
+EOT
+
+# Install Chrome
+ENV CHROME_BIN="$local_bin/chrome"
+
+RUN <<EOT
+  source $NVM_DIR/nvm.sh
+  browsers_dir="$HOME/.cache/browsers"
+
+  npx @puppeteer/browsers install chrome@stable --path "$browsers_dir"
+
+  # Make Chrome binary visible for Karma
+  chrome_bin_path=$(npx @puppeteer/browsers list --path "$browsers_dir" | head -n1 | sed 's/.* //')
+  ln -s "$chrome_bin_path" "$CHROME_BIN"
+EOT
+
 # Change shell back to bash from jshell
 CMD ["/bin/bash"]
 
@@ -57,7 +103,7 @@ FROM dev AS dev-android
 # Specify build tools version.
 # Use the latest available version by default.
 # https://developer.android.com/tools/releases/build-tools
-ARG build_tools="35.0.0"
+ARG build_tools="36.0.0"
 ENV ANDROID_BUILD_TOOLS_VERSION=$build_tools
 
 # Define Android environment variables
@@ -69,10 +115,10 @@ ENV PATH="$PATH:$ANDROID_HOME/cmdline-tools/latest/bin"
 ENV PATH="$PATH:$ANDROID_HOME/platform-tools"
 ENV PATH="$PATH:$ANDROID_HOME/build-tools/$ANDROID_BUILD_TOOLS_VERSION"
 
-# Commandline Tools revisions: https://dl.google.com/android/repository/repository2-3.xml
+# Commandline Tools revisions: https://dl.google.com/android/repository/repository2-3.xml (search for "cmdline-tools;latest")
 # NOTE: Remember to update cmdline-tools-package.xml on commandlinetools update.
-ARG commandlinetools_url=https://dl.google.com/android/repository/commandlinetools-linux-12266719_latest.zip
-ARG commandlinetools_sha1=47e61d3bb57b5e907a74f225a767a767a8b4d7a5
+ARG commandlinetools_url=https://dl.google.com/android/repository/commandlinetools-linux-13114758_latest.zip
+ARG commandlinetools_sha1=5fdcc763663eefb86a5b8879697aa6088b041e70
 
 WORKDIR $ANDROID_HOME
 RUN <<EOF

.devcontainer/chrome-dependencies.txt

@@ -0,0 +1,37 @@
+# Source: https://source.chromium.org/chromium/chromium/src/+/main:chrome/installer/linux/debian/dist_package_versions.json
+# Keep the list sorted.
+libasound2t64
+libatk-bridge2.0-0t64
+libatk1.0-0t64
+libatspi2.0-0t64
+libc6
+libcairo2
+libcups2t64
+libdbus-1-3
+libdrm2
+libexpat1
+libgbm1
+libglib2.0-0t64
+libnspr4
+libnss3
+libpango-1.0-0
+libpangocairo-1.0-0
+libstdc++6
+libudev1
+libuuid1
+libx11-6
+libx11-xcb1
+libxcb-dri3-0
+libxcb1
+libxcomposite1
+libxcursor1
+libxdamage1
+libxext6
+libxfixes3
+libxi6
+libxkbcommon0
+libxrandr2
+libxrender1
+libxshmfence1
+libxss1
+libxtst6

.devcontainer/cmdline-tools-package.xml

@@ -138,4 +138,4 @@ This is the Android Software Development Kit License Agreement
 14.7 The License Agreement, and your relationship with Google under the License Agreement, shall be governed by the laws of the State of California without regard to its conflict of laws provisions. You and Google agree to submit to the exclusive jurisdiction of the courts located within the county of Santa Clara, California to resolve any legal matter arising from the License Agreement. Notwithstanding this, you agree that Google shall still be allowed to apply for injunctive remedies (or an equivalent type of urgent legal relief) in any jurisdiction.
 
 
-January 16, 2019</license><localPackage path="cmdline-tools;latest" obsolete="false"><type-details xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="ns5:genericDetailsType"/><revision><major>16</major><minor>0</minor></revision><display-name>Android SDK Command-line Tools (latest)</display-name><uses-license ref="android-sdk-license"/></localPackage></ns2:repository>
+January 16, 2019</license><localPackage path="cmdline-tools;latest" obsolete="false"><type-details xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="ns5:genericDetailsType"/><revision><major>19</major><minor>0</minor></revision><display-name>Android SDK Command-line Tools (latest)</display-name><uses-license ref="android-sdk-license"/></localPackage></ns2:repository>

.devcontainer/devcontainer.json

@@ -1,7 +1,9 @@
 {
-  "build": {
-    "dockerfile": "./Dockerfile"
-  },
+  "image": "ghcr.io/ktorio/devcontainer:latest",
+  "runArgs": [
+    // See an explanation for this option in the Dockerfile
+    "--platform=linux/amd64"
+  ],
   "postStartCommand": "git config --global --add safe.directory ${containerWorkspaceFolder}",
   // Set `remoteUser` to `root` to connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root
   "remoteUser": "developer"

.github/workflows/devcontainer.yml

@@ -0,0 +1,88 @@
+name: DevContainer
+on:
+  pull_request:
+    branches: [ main ]
+    paths:
+      - .devcontainer/**
+      - .github/workflows/devcontainer.yml
+      - .nvmrc
+
+  push:
+    branches: [ main ]
+    paths:
+      - .devcontainer/**
+      - .github/workflows/devcontainer.yml
+      - .nvmrc
+
+  schedule:
+    - cron: '0 0 * * 6' # Every Saturday at 00:00
+
+  # Allow running manually
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ktorio/devcontainer
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+
+    env:
+      # If the event is a "pull_request", just test the image builds successfully and do not push it
+      PUSH_IMAGE: ${{ github.event_name != 'pull_request' }}
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          platforms: linux/amd64
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            latest
+            {{date 'YYYYMMDD'}}
+
+      - name: Extract Node.js version
+        id: node-version
+        run: echo "result=$(cat .nvmrc)" >> $GITHUB_OUTPUT
+
+      - name: Build image
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          push: ${{ env.PUSH_IMAGE }}
+          context: .devcontainer
+          target: dev
+          build-args: |
+            node_version=${{ steps.node-version.outputs.result }}
+          platforms: linux/amd64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v2
+        if: ${{ env.PUSH_IMAGE == 'true' }}
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true

.nvmrc

@@ -0,0 +1 @@
+22.18.0

build-logic/src/main/kotlin/ktorbuild.kmp.gradle.kts

@@ -50,6 +50,8 @@ if (targets.hasWasmJs) configureWasmJs()
 if (targets.hasAndroidJvm && project.hasAndroidPlugin()) configureAndroidJvm()
 
 if (targets.hasJsOrWasmJs) {
+    configureNodeJs()
+
     tasks.configureEach {
         if (name == "compileJsAndWasmSharedMainKotlinMetadata") enabled = false
     }

build-logic/src/main/kotlin/ktorbuild/targets/JsConfig.kt

@@ -9,17 +9,23 @@ import ktorbuild.internal.gradle.maybeNamed
 import ktorbuild.internal.kotlin
 import ktorbuild.internal.libs
 import org.gradle.api.Project
+import org.gradle.api.provider.Provider
 import org.gradle.kotlin.dsl.assign
 import org.gradle.kotlin.dsl.invoke
 import org.gradle.kotlin.dsl.the
 import org.gradle.kotlin.dsl.withType
 import org.jetbrains.kotlin.gradle.plugin.KotlinPlatformType
 import org.jetbrains.kotlin.gradle.targets.js.dsl.KotlinJsSubTargetDsl
 import org.jetbrains.kotlin.gradle.targets.js.dsl.KotlinJsTargetDsl
+import org.jetbrains.kotlin.gradle.targets.js.nodejs.NodeJsEnvSpec
+import org.jetbrains.kotlin.gradle.targets.js.nodejs.NodeJsPlugin
 import org.jetbrains.kotlin.gradle.targets.js.yarn.YarnPlugin
 import org.jetbrains.kotlin.gradle.targets.js.yarn.YarnRootEnvSpec
+import org.jetbrains.kotlin.gradle.targets.wasm.nodejs.WasmNodeJsEnvSpec
+import org.jetbrains.kotlin.gradle.targets.wasm.nodejs.WasmNodeJsPlugin
 import org.jetbrains.kotlin.gradle.targets.wasm.yarn.WasmYarnPlugin
 import org.jetbrains.kotlin.gradle.targets.wasm.yarn.WasmYarnRootEnvSpec
+import org.jetbrains.kotlin.gradle.targets.web.nodejs.BaseNodeJsEnvSpec
 import org.jetbrains.kotlin.gradle.targets.web.yarn.BaseYarnRootEnvSpec
 
 internal fun KotlinJsTargetDsl.addSubTargets(targets: KtorTargets) {
@@ -54,6 +60,7 @@ internal fun Project.configureJs() {
 
         sourceSets {
             jsTest.dependencies {
+                // Puppeteer is used to install Chrome for tests
                 implementation(npm("puppeteer", libs.versions.puppeteer.get()))
             }
         }
@@ -70,6 +77,7 @@ internal fun Project.configureWasmJs() {
                 implementation(libs.kotlinx.browser)
             }
             wasmJsTest.dependencies {
+                // Puppeteer is used to install Chrome for tests
                 implementation(npm("puppeteer", libs.versions.puppeteer.get()))
             }
         }
@@ -86,12 +94,36 @@ internal fun Project.configureJsTestTasks(target: String) {
     tasks.maybeNamed("${target}BrowserTest") { onlyIf { false } }
 }
 
+fun Project.configureNodeJs() {
+    @Suppress("UnstableApiUsage")
+    val nvmrc = project.layout.settingsDirectory.file(".nvmrc")
+    val nodeVersion = provider { nvmrc.asFile.readText().trim() }
+
+    plugins.withType<NodeJsPlugin> { the<NodeJsEnvSpec>().configure(nodeVersion) }
+    plugins.withType<WasmNodeJsPlugin> { the<WasmNodeJsEnvSpec>().configure(nodeVersion) }
+}
+
+private fun BaseNodeJsEnvSpec.configure(nodeVersion: Provider<String>) {
+    version = nodeVersion
+    if (isKtorDevEnvironment) download = false
+}
+
 fun Project.configureYarn() {
     plugins.withType<YarnPlugin> { the<YarnRootEnvSpec>().configure() }
     plugins.withType<WasmYarnPlugin> { the<WasmYarnRootEnvSpec>().configure() }
 }
 
 private fun BaseYarnRootEnvSpec.configure() {
-    // Don't ignore scripts as we want Chrome to be installed automatically with puppeteer.
-    ignoreScripts = false
+    if (isKtorDevEnvironment) download = false
+    // Don't ignore scripts if we want Chrome to be installed automatically with puppeteer.
+    if (shouldDownloadBrowser) ignoreScripts = false
 }
+
+// KTOR_DEV is set to `true` in the docker image used to build Ktor.
+// This image has Node.js and Yarn bundled so this flag disables downloading of them.
+private val isKtorDevEnvironment: Boolean
+    get() = System.getenv("KTOR_DEV") == "true"
+
+// If CHROME_BIN is undefined, puppeteer will install Chrome automatically
+private val shouldDownloadBrowser: Boolean
+    get() = System.getenv("CHROME_BIN") == null

build.gradle.kts

@@ -2,7 +2,7 @@
  * Copyright 2014-2025 JetBrains s.r.o and contributors. Use of this source code is governed by the Apache 2.0 license.
  */
 
-import ktorbuild.targets.configureYarn
+import ktorbuild.targets.*
 import ktorbuild.wirePackageJsonAggregationTasks
 
 plugins {
@@ -16,3 +16,4 @@ println("Kotlin version: ${libs.versions.kotlin.get()}")
 wirePackageJsonAggregationTasks()
 
 configureYarn()
+configureNodeJs()

karma/chrome_bin.js

@@ -27,4 +27,7 @@ config.set({
     }
 });
 
-process.env.CHROME_BIN = require('puppeteer').executablePath();
+// CHROME_BIN might be already defined, otherwise use puppeteer to get the path
+if (!process.env.CHROME_BIN) {
+    process.env.CHROME_BIN = require('puppeteer').executablePath();
+}