Device Protection in Dev Containers

Add Device Protection to a Dev Container as a Feature, so any devcontainer.json can add it to any base image without a custom Dockerfile.

Read Device Protection in Containers first. The Feature installs the same package in the same --container mode, so the entrypoint, the Aikido CA variables, and the token rules all work the same way.

Add the Feature

Create this alongside your project, for example at .devcontainer/features/device-protection/:

.devcontainer/features/device-protection/devcontainer-feature.json

{
  "id": "device-protection",
  "version": "1.0.0",
  "name": "Aikido Device Protection",
  "description": "Installs Aikido Device Protection in --container mode so package manager traffic inside the container is inspected for malware.",
  "entrypoint": "aikido-endpoint-protection-container-entrypoint"
}

entrypoint runs the agent's supervisor alongside the image's own entrypoint, instead of replacing it.

.devcontainer/features/device-protection/install.sh

#!/usr/bin/env bash
set -euo pipefail

case "$(uname -m)" in
  x86_64) ARCH=amd64 ;;
  aarch64) ARCH=arm64 ;;
  *) echo "Aikido Device Protection: unsupported architecture $(uname -m)" >&2; exit 1 ;;
esac

if command -v apt-get >/dev/null 2>&1; then
  apt-get update
  apt-get install -y --no-install-recommends curl ca-certificates
  curl -fLO "https://github.com/AikidoSec/safechain-internals/releases/latest/download/EndpointProtection-${ARCH}.deb"
  AIKIDO_CONTAINER=1 AIKIDO_CI_CD=1 apt-get install -y --no-install-recommends "./EndpointProtection-${ARCH}.deb"
  rm -f "EndpointProtection-${ARCH}.deb"
  rm -rf /var/lib/apt/lists/*
elif command -v dnf >/dev/null 2>&1; then
  . /etc/os-release
  EL="el${VERSION_ID%%.*}"
  dnf install -y --setopt=install_weak_deps=False curl ca-certificates
  curl -fLO "https://github.com/AikidoSec/safechain-internals/releases/latest/download/EndpointProtection-${ARCH}.${EL}.rpm"
  AIKIDO_CONTAINER=1 AIKIDO_CI_CD=1 dnf install -y --setopt=install_weak_deps=False "./EndpointProtection-${ARCH}.${EL}.rpm"
  rm -f "EndpointProtection-${ARCH}.${EL}.rpm"
else
  echo "Aikido Device Protection: no apt-get or dnf found, unsupported base image" >&2
  exit 1
fi

This is the package-file flavor from Device Protection in Containers, so no token is baked into the image. It picks the .deb or .rpm that matches the base image's package manager and architecture, the same files the manual Linux install uses.

Don't add token as a Feature option. Options are written into a devcontainer-features.env file that install scripts source during the image build, which means a token passed that way can end up in a build layer. Pass AIKIDO_TOKEN at container start instead, through containerEnv below.

Wire it up in devcontainer.json

.devcontainer/devcontainer.json

{
  "name": "my-app",
  "image": "mcr.microsoft.com/devcontainers/javascript-node:20",
  "features": {
    "./features/device-protection": {}
  },
  "containerEnv": {
    "AIKIDO_TOKEN": "${localEnv:AIKIDO_TOKEN}"
  },
  "postCreateCommand": "echo 'for f in /etc/profile.d/aikido-*.sh; do [ -e \"$f\" ] && . \"$f\"; done' >> ~/.bashrc"
}

• features references the Feature by its local path, relative to devcontainer.json.

• containerEnv passes the token when the container starts. Set AIKIDO_TOKEN in your shell (or a Codespaces secret) before opening the Dev Container.

• postCreateCommand appends the CA sourcing to ~/.bashrc, so terminals opened later inside the container (VS Code's integrated terminal, Codespaces) pick up the Aikido CA instead of failing installs with SELF_SIGNED_CERT_IN_CHAIN.

If your Dev Container's default shell is zsh instead of bash, append to ~/.zshrc instead:

bash

"postCreateCommand": "echo 'for f in /etc/profile.d/aikido-*.sh; do [ -e \"$f\" ] && . \"$f\"; done' >> ~/.bashrc"

zsh

"postCreateCommand": "echo 'for f in /etc/profile.d/aikido-*.sh; do [ -e \"$f\" ] && . \"$f\"; done' >> ~/.zshrc"

If you already build a custom Dockerfile for other reasons, features still applies on top of it. You no longer need to add the agent's install or ENTRYPOINT lines to that Dockerfile yourself, the Feature does it.

To reuse the Feature across repositories instead of vendoring the folder into each one, publish it once to a registry your team controls with devcontainer features publish, then reference it as ghcr.io/<your-org>/devcontainer-features/device-protection:1 instead of by path. See the Dev Containers CLI docs for the publish command.

GitHub Codespaces secrets

For Codespaces, add AIKIDO_TOKEN as a repository or organization Codespaces secret rather than committing it. ${localEnv:AIKIDO_TOKEN} picks up a secret exposed as an environment variable the same way it picks up a local shell variable.

Verify it works

Open a new terminal in the Dev Container (a fresh one, so it picks up the postCreateCommand change) and run:

curl -sS -o /dev/null -w "%{http_code}\n" --max-time 15 https://registry.npmjs.org/safe-chain-test/-/safe-chain-test-0.0.1-security.tgz
aikidoctl version

The curl prints 403, the agent refusing the malware test package, and aikidoctl version reports the installed version and the agent's state.

Troubleshooting

The entrypoint and install steps are the same as any Linux container, so start with the troubleshooting table on Device Protection in Containers. Two additions specific to Dev Containers:

Problem	Fix
Package installs fail with SELF_SIGNED_CERT_IN_CHAIN in the integrated terminal, but work when run through postCreateCommand	The terminal was open before postCreateCommand finished, or it's a different shell than the one it appended to. Open a new terminal, and check ~/.bashrc (or ~/.zshrc) for the aikido-*.sh sourcing line
no apt-get or dnf found, unsupported base image	The base image uses a package manager the Feature doesn't handle yet, for example Alpine's apk. Add a branch for it or install the agent manually as shown on Device Protection in Containers