Persist Codex login across container rebuilds - #76
Merged
Conversation
AndreasBur
pushed a commit
that referenced
this pull request
Aug 25, 2026
Builds on #76, which persisted the Codex login by declaring its volume in each committed variant. Two things were left. gh was not covered, and has the same problem for the same reason: its configuration lives in the container's home, so every rebuild costs a fresh `gh auth login` - which is noticed one push later rather than at the rebuild. And the volume was declared twice, in linux/ and in wslg/, which is one place too many for a mount both variants want. It belongs where ~/.platformio already is: the shared feature, which every variant loads. That also covers a variant nobody had thought about - wslg had the same gap and was fixed by the same line. So the two per-variant declarations come out again; leaving them in would put two mounts on one target, which fails container creation rather than being ignored. The Dockerfile seeds ~/.config/gh beside ~/.codex, at 0700 for both: an empty named volume takes its ownership from the path it covers, and gh refuses to read a config directory others can enter. The README's two passages became one. #76 put its section high up, where somebody looking for it will find it, and that is where this stays - carrying both volumes now, the reason they are in the feature, and the seeding. Further down, the sentence #76 struck out is replaced rather than left as a gap: what must stay out of a committed variant is a secret or an internal address, and a mount line is neither. Not verified by a build. There is no Docker daemon in the container, so what was checked is that the JSON parses and that no variant now collides with the feature on a mount target. The test is two rebuilds of the Linux variant: the first creates the volumes, the second is the one that shows a login survived. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Opened for the branch as it stands, from 2026-08-23. It merges cleanly into
master.What it does
The Codex login lived in the container's home directory and was gone after every rebuild, so
it had to be entered again by hand. Both committed variants mount a named
wordclock-codexvolume at
/home/vscode/.codex, and theDockerfilecreates that path as the remote user atmode 0700 first — an empty named volume takes its ownership from the path it covers, which is
the same reason
~/.platformiois seeded a few lines above.It also drops the sentence in
.devcontainer/README.mdthat said credentials belong in alocal variant rather than a committed one, since this puts one in the committed ones, and adds
a short section saying the volume holds credentials and should not be shared or exported.
Its relation to #75
These two overlap, and it is worth being explicit about how, because merging both as they are
would break container creation.
linux/andwslg/, separatelyghloginDockerfile~/.codex~/.codexand~/.config/ghThey agree on the principle. This branch removed that rule sentence in August; #75 argues
the same conclusion from the other end — what must stay out of the repository is a secret or
an internal address, and a mount line is neither. That agreement was reached twice
independently, which is a decent sign it is right.
Where they collide:
git merge-treereports content conflicts in.devcontainer/Dockerfileand
.devcontainer/README.md. And if both were merged with the conflicts resolved naively,linux/andwslg/would declarewordclock-codexand inherit it from the feature — twomounts on one target, which fails container creation rather than being ignored.
So one of two orders
the two variant mounts come out again in favour of the feature's, and the README keeps the
narrowed rule. Two conflicts to resolve, both small.
ghplus the WSLg variant — and this PR closes as superseded, with the branch kept.Either is fine. What is not fine is merging both without resolving the duplicate mounts, so
whichever goes second needs the rebase.