theredguild / devcontainer

The Red Guild's devcontainer focused in web3 and security.

The Red Guild's devcontainer exploration

Requirements

1. Visual Studio Code.
2. DevContainer extension by MS: ms-vscode-remote.remote-containers.
3. Must have installed on your local OS: docker and docker-buildx.

Kick-off

1. Start the docker service, and make sure your user is in the docker group. Otherwise, log in back again.
2. Clone this repo and open the folder with vscode how you like. Running code . works well.
3. Select "Reopen in Container" and wait. This will build the container volume.
4. If this is your first time, you'll be prompted to press enter on a console log that triggers the terminal.
5. If not you can go to the extensions section on your side, click the Remote Explorer tab and select the active devcontainer.

Usage

If you open the Command Palette (Ctrl+Shift+p or whatever your shortcut is) you can access several features:

• You can attach VS Code to a running container, where you can open any folder or Clone a repository.
• You can open new folders or workspaces of your liking inside the current volume.
• You can even clone a new repository in a new volume based on the same devcontainer.

What's in it?

• frameworks: foundry, hardhat (manual install)
• utilities: solc-select
• fuzzing: slither, medusa
• others: node, npm, pnpm, yarn, python, go
• terminal: zsh with Oh-My-ZSH
• extensions:
  • NomicFoundation.hardhat-solidity,
  • tintinweb.solidity-visual-auditor,
  • trailofbits.weaudit,
  • tintinweb.solidity-metrics

Useful resources

Install different node versions with nvm

# Install the latest version
nvm install --lts
# Install version 14
nvm install 14
# Use a specific version
nvm use 12.22.7
# List current installations
nvm ls

Install Hardhat

Hardhat does not come by default, since the official documentation states that you should install it locally on the working repository with npx.

If you wish to install hardhat globally, you can run: pnpm install hardhat wherever you want.

The other reason it does not come by default, it's because the nvm installation is not trivial at all, and working with its peculiarities inside a Dockerfile to install packages is not worth the mess.

Links

• Article (references this repo's branch article): Where do you run your code?
• Workshop: Come and build your own devContainer! @ the-mu

devcontainer's Issues

Is it possible to move features inside the Dockerfile, with FROM clauses for example?

There are a lot of dev-container features that solve many things, but since the Dockerfile runs first I need some of what those features install later earlier under the Dockerfile context.

Can I somehow get them to work with FROM clauses?

Extension Suggestions

Hey! Here are some suggestions that you may consider to add to the container, from a Security Researcher perspective:

• Solidity Metrics: Useful for a quick codebase analysis, calculate nSLOC, code complexity, and estimate times for a security review.
• Mark Files: Useful to keep track of reviewed files, or files in scope.
• Some alternative Solidity Language extension like the one from tintinweb, or the one from Nomic Foundation. I personally experienced CPU issues with the extension by Juan Blanco (although it might be an issue on my side)

Install yarn by default

Many projects use yarn instead of npm for package management. We should have yarn installed by default following https://yarnpkg.com/getting-started/install

Install nvm to be able to chane node's version on demand.

Check if it is possible to avoid installing node directly, replacing it for nvm, or additionally install nvm.

https://github.com/nvm-sh/nvm?tab=readme-ov-file#installing-and-updating

Use go's latest version.

aptitude's last version of go is outdated. Make it possible to install go's latest version upon deployment.