[aledbf]

--ca-bundle <file> on build, up and run-user-commands, plus the tests #50 asks for around secrets on tmpfs.

Closes #50

Builds

• Every Feature install RUN mounts the bundle as the BuildKit secret devcontainer-ca-bundle at /run/devcontainer/ca-bundle.crt. install.sh runs with SSL_CERT_FILE, NODE_EXTRA_CA_CERTS, REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE and GIT_SSL_CAINFO pointing at it, and the variables apply to that RUN only, never as an ENV.
• A user Dockerfile gets the same secret id (--secret id=devcontainer-ca-bundle,src=<file>) and opts in with RUN --mount=type=secret,.... This is documented in docs/go-only-features.md.
• Without buildx the bundle is left out of the build with a warning, as --secrets-file is. A Compose configuration's docker compose build takes no secrets, so it also gets a warning.

Container

• up bind-mounts the file read-only at the same path and sets the five variables over the configuration's containerEnv. This covers both single containers and Compose services.
• run-user-commands sets the variables for the lifecycle commands. A container created without the mount is refused, because a running container cannot take a new mount.

Never copied

• The e2e test scans the layers and config of the built image (history and labels included) for the CA's body and for the file. It finds neither.
• A rebuild with a different CA's bundle passes only from cache and produces the same layers.
• One thing does change: a build with the flag differs from one without it in the Feature RUN text (the secret mount and the variables), so those two builds don't share cache.

Also in this change

• up --secrets-file now reaches the user Dockerfile's RUNs. It reached only the Features' before, which contradicted the issue's item 3.
• Tests for DOCKER_CONFIG outside $HOME with a symlinked config.json, and for the bridged build auth being written under TMPDIR (documented).
• The flag is in the flag inventory and in DIVERGENCES.

Tests

• Unit: the generated Feature RUNs, buildx file secrets, flag validation (a file with no PEM certificate is refused), the env merge, the Compose override and its warning, DOCKER_CONFIG off $HOME.
• e2e, against a real TLS server container signed by a test CA:
  • TestE2E_CABundle: a Feature RUN and an opted-in Dockerfile RUN fail without the flag and pass with it. In the container, curl, node and postCreateCommand trust the server. The mount is read-only. run-user-commands is refused on a container without the bundle.
  • TestE2E_UpSecretsFile: the value reaches a Dockerfile RUN and postCreateCommand, and it is absent from the layers, docker history and the container's inspect.

🤖 Generated with Claude Code