MAINT: Optimize devcontainer Dockerfile

[spencrr]

Description

Optimizes the devcontainer Dockerfile to improve build speed, reduce image size, and tighten permissions.

Key changes:

Build performance

• Use BuildKit cache mounts (--mount=type=cache) for all apt-get layers instead of apt-get clean && rm -rf /var/lib/apt/lists/* — cached packages persist across local rebuilds, so subsequent builds skip re-downloading unchanged packages. Note: these mounts only benefit local builds; in CI, GHA layer caching (cache-from: type=gha) handles caching at the layer level.
• The apt-get clean && rm -rf /var/lib/apt/lists/* cleanup commands are removed because BuildKit cache mounts store apt data outside the image layer, so nothing needs to be cleaned up — the layer never contains it.
• Install uv via COPY --from=ghcr.io/astral-sh/uv:0.10.8 multi-stage copy instead of curl | sh — avoids a network round-trip, shell pipe execution, and the extra cleanup of /root/.local/bin.

Image size

• Apply --no-install-recommends consistently to all apt-get install invocations (previously only used on the Speech SDK block) — prevents pulling in unnecessary Recommends dependencies (e.g., X11 libs, man pages).

Reproducibility

• Pin base image to python:3.11-bookworm instead of python:3.11 — prevents silent shifts between Debian releases (e.g., Bookworm to Trixie) when the base image is updated. (and match existing bookworm apt repo call)
• Pin uv to a specific version (0.10.8) via multi-stage COPY --from — the previous curl | sh always fetched the latest release, making builds non-deterministic.
• Set DEBIAN_FRONTEND=noninteractive as a global ENV instead of inline per-command — prevents any apt-get invocation from prompting for interactive input.

Security hardening

• Change chmod 777 to chmod 755 for all cache directories (pip, pylance, venv, uv, mypy) — 777 is unnecessarily permissive in a single-user devcontainer where vscode owns these directories.
• Removed unecessary shebang from scripts that were always called with python script_name.py to avoid precommit complaint.

Dependency cleanup

• Drop redundant apt-transport-https from explicit install — this is a transitional no-op package on Debian Bookworm (HTTPS support is built into apt natively). The base image already includes it.
• Drop redundant lsb-release from explicit install — the base image already includes it
• Remove stale rm -rf /opt/venv and debug ls -la /opt/venv/bin/activate from the uv/venv setup step.

Node.js

• Bump to Node.js 24.x (LTS), move npm install -g @github/copilot to a devcontainer feature to remove unecessary tool from production builds.

Minor cleanup

• Fix trailing whitespace on chmod line and indentation on "Set cache directories" comment.

Tests and Documentation

• No code or API changes — this only affects the devcontainer build infrastructure.
• Verified the Dockerfile builds successfully.
• No JupyText changes needed.

[Copilot]

Pull request overview

This PR optimizes the development container and related tooling scripts to improve devcontainer build performance, reduce image size, and tighten default permissions while updating Node.js expectations.

Changes:

• Updated .devcontainer/Dockerfile to use a pinned Bookworm base image, BuildKit apt cache mounts, --no-install-recommends, multi-stage uv install, and Node.js 24.x.
• Tightened cache directory permissions (e.g., mypy cache, various .cache/* directories) from 777 to 755.
• Moved CLI installs into devcontainer features and updated packaging guidance to expect Node.js 24.x.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
.devcontainer/Dockerfile	BuildKit caching, pinned base image, uv multi-stage install, Node.js 24.x, and permission tightening.
.devcontainer/devcontainer.json	Adds devcontainer features (Azure CLI, Copilot CLI).
.devcontainer/devcontainer_setup.sh	Tightens mypy cache permissions and keeps devcontainer setup behavior.
build_scripts/prepare_package.py	Removes shebang and updates Node.js version guidance in error output.
docker/build_pyrit_docker.py	Removes shebang (script intended to be run via python ...).
docker/run_pyrit_docker.py	Removes shebang (script intended to be run via python ...).

---

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

---

You can also share your feedback on Copilot code review. Take the survey.