1
0
mirror of synced 2026-01-08 21:02:10 -05:00

translation batch 1632491035 (#21717)

This commit is contained in:
Marcelo Jacobus
2021-09-30 08:53:04 -03:00
committed by GitHub
parent e031e75622
commit aed6c1654f
16702 changed files with 420299 additions and 77868 deletions

View File

@@ -0,0 +1,52 @@
---
title: Allowing your codespace to access a private image registry
intro: 'You can use secrets to allow {% data variables.product.prodname_codespaces %} to access a private image registry'
versions:
fpt: '*'
topics:
- Codespaces
product: '{% data reusables.gated-features.codespaces %}'
shortTitle: Private image registry
---
## About private image registries and {% data variables.product.prodname_codespaces %}
A registry is a secure space for storing and managing private container images, such as Azure Container Registry or DockerHub. You can create secrets in GitHub to store the access details for a private registry and use them to give your codespace access to images stored in the registry.
When you launch a codespace, {% data variables.product.prodname_codespaces %} checks for three secrets, which define the server name, username, and personal access token (PAT) for a container registry. If these secrets are found, {% data variables.product.prodname_codespaces %} will make the registry available inside your codespace.
- `<*>_CONTAINER_REGISTRY_SERVER`
- `<*>_CONTAINER_REGISTRY_USER`
- `<*>_CONTAINER_REGISTRY_PASSWORD`
You can store secrets at the user, repository, or organization-level, allowing you to share them securely between different codespaces. When you create a set of secrets for a private image registry, you need to replace the “<*>” in the name with a consistent identifier. For more information, see "[Managing encrypted secrets for your codespaces](/codespaces/managing-your-codespaces/managing-encrypted-secrets-for-your-codespaces)" and "[Managing encrypted secrets for your repository and organization for Codespaces](/codespaces/managing-codespaces-for-your-organization/managing-encrypted-secrets-for-your-repository-and-organization-for-codespaces)."
If you are setting the secrets at the user or organization level, make sure to assign those secrets to the repository you'll be creating the codespace in by choosing an access policy from the dropdown list.
![Image registry secret example](/assets/images/help/codespaces/secret-repository-access.png)
## Example secrets
For a private image registry in Azure, you could create the following secrets:
```
ACR_CONTAINER_REGISTRY_SERVER = mycompany.azurecr.io
ACR_CONTAINER_REGISTRY_USER = acr-user-here
ACR_CONTAINER_REGISTRY_PASSWORD = <PAT>
```
For information on common image registries, see "[Common image registry servers](#common-image-registry-servers)."
![Image registry secret example](/assets/images/help/settings/codespaces-image-registry-secret-example.png)
Once you've added the secrets, you may need to stop and then start the codespace you are in for the new environment variables to be passed into the container. For more information, see "[Suspending or stopping a codespace](/codespaces/codespaces-reference/using-the-command-palette-in-codespaces#suspending-or-stopping-a-codespace)."
## Common image registry servers
Some of the common image registry servers are listed below:
- [DockerHub](https://docs.docker.com/engine/reference/commandline/info/) - `https://index.docker.io/v1/`
- [GitHub Container Registry](/packages/working-with-a-github-packages-registry/working-with-the-container-registry) - `ghcr.io`
- [Azure Container Registry](https://docs.microsoft.com/azure/container-registry/) - `<registry name>.azurecr.io`
- [Amazon Elastic Container Registry](https://docs.aws.amazon.com/AmazonECR/latest/userguide/Registries.html) - `<aws_account_id>.dkr.ecr.<region>.amazonaws.com`
- [Google Cloud Container Registry](https://cloud.google.com/container-registry/docs/overview#registries) - `gcr.io` (US), `eu.gcr.io` (EU), `asia.gcr.io` (Asia)

View File

@@ -0,0 +1,50 @@
---
title: Disaster recovery for Codespaces
intro: 'This article describes guidance for a disaster recovery scenario, when a whole region experiences an outage due to major natural disaster or widespread service interruption.'
versions:
free-pro-team: '*'
product: '{% data reusables.gated-features.codespaces %}'
topics:
- Codespaces
shortTitle: Disaster recovery
---
We work hard to make sure that {% data variables.product.prodname_codespaces %} is always available to you. However, forces beyond our control sometimes impact the service in ways that can cause unplanned service disruptions.
Although disaster recovery scenarios are rare occurrences, we recommend that you prepare for the possibility that there is an outage of an entire region. If an entire region experiences a service disruption, the locally redundant copies of your data would be temporarily unavailable.
The following guidance provides options on how to handle service disruption to the entire region where your codespace is deployed.
{% note %}
**Note:** You can reduce the potential impact of service-wide outages by pushing to remote repositories frequently.
{% endnote %}
## Option 1: Create a new codespace in another region
In the case of a regional outage, we suggest you recreate your codespace in an unaffected region to continue working. This new codespace will have all of the changes as of your last push to {% data variables.product.prodname_dotcom %}. For information on manaully setting another region, see "[Setting your default region for Codespaces](/codespaces/managing-your-codespaces/setting-your-default-region-for-codespaces)."
You can optimize recovery time by configuring a `devcontainer.json` in the project's repository, which allows you to define the tools, runtimes, frameworks, editor settings, extensions, and other configuration necessary to restore the development environment automatically. For more information, see "[Configuring Codespaces for your project](/codespaces/setting-up-your-codespace/configuring-codespaces-for-your-project)."
## Option 2: Wait for recovery
In this case, no action on your part is required. Know that we are working diligently to restore service availability.
You can check the current service status on the [Status Dashboard](https://www.githubstatus.com/).
## Option 3: Clone the repository locally or edit in the browser
While {% data variables.product.prodname_codespaces %} provides the benefit of a pre-configured developer environmnent, your source code should always be accessible through the repository hosted on {% data variables.product.prodname_dotcom_the_website %}. In the event of a {% data variables.product.prodname_codespaces %} outage, you can still clone the repository locally or edit files in the {% data variables.product.company_short %} browser editor. For more information, see "[Editing files](/repositories/working-with-files/managing-files/editing-files)."
While this option does not configure a development environment for you, it will allow you to make changes to your source code as needed while you wait for the service disruption to resolve.
## Option 4: Use Remote-Containers and Docker for a local containerized environment
If your repository has a `devcontainer.json`, consider using the [Remote-Containers extension](https://code.visualstudio.com/docs/remote/containers#_quick-start-open-a-git-repository-or-github-pr-in-an-isolated-container-volume) in Visual Studio Code to build and attach to a local development container for your repository. The setup time for this option will vary depending on your local specifications and the complexity of your dev container setup.
{% note %}
**Note:** Be sure your local setup meets the [minimum requirements](https://code.visualstudio.com/docs/remote/containers#_system-requirements) before attempting this option.
{% endnote %}

View File

@@ -0,0 +1,14 @@
---
title: Reference
intro: 'This section contains references that will allow you to be successful with {% data variables.product.prodname_codespaces %}'
versions:
fpt: '*'
product: '{% data reusables.gated-features.codespaces %}'
children:
- /understanding-billing-for-codespaces
- /allowing-your-codespace-to-access-a-private-image-registry
- /using-the-command-palette-in-codespaces
- /security-in-codespaces
- /disaster-recovery-for-codespaces
---

View File

@@ -0,0 +1,105 @@
---
title: Security in Codespaces
intro: 'Overview of the {% data variables.product.prodname_codespaces %} security architecture, with guidelines to help you maintain security and minimize the risk of attack.'
miniTocMaxHeadingLevel: 3
versions:
fpt: '*'
topics:
- Codespaces
- Security
type: reference
shortTitle: Security in Codespaces
---
## Overview of codespace security
{% data variables.product.prodname_codespaces %} is designed to be security hardened by default. Consequently, you will need to ensure that your software development practices do not risk reducing the security posture of your codespace.
This guide describes the way Codespaces keeps your development environment secure and provides some of the good practices that will help maintain your security as you work. As with any development tool, remember that you should only open and work within repositories you know and trust.
### Environment isolation
{% data variables.product.prodname_codespaces %} is designed to keep your codespaces separate from each other, with each using its own virtual machine and network.
#### Isolated virtual machines
Each codespace is hosted on its own newly-built virtual machine (VM). Two codespaces are never co-located on the same VM.
Every time you restart a codespace, it's deployed to a new VM with the latest available security updates.
#### Isolated networking
Each codespace has its own isolated virtual network. We use firewalls to block incoming connections from the internet and to prevent codespaces from communicating with each other on internal networks. By default, codespaces are allowed to make outbound connections to the internet.
### Authentication
You can connect to a codespace using a web browser or from Visual Studio Code. If you connect from Visual Studio Code, you are prompted to authenticate with {% data variables.product.product_name %}.
Every time a codespace is created or restarted, it's assigned a new {% data variables.product.company_short %} token with an automatic expiry period. This period allows you to work in the codespace without needing to reauthenticate during a typical working day, but reduces the chance that you will leave a connection open when you stop using the codespace.
The token's scope will vary depending on the access you have to the repository where the codespace was created:
- **If you have write access to the repository**: The token will be scoped for read/write access to the repository.
- **If you only have read access to the repository**: The token will only allow the code to be cloned from the source repository. If you attempt to push to a private repo where you only have read access, {% data variables.product.prodname_codespaces %} will prompt you to create a personal fork of the repository. The token will then be updated to have read/write access to the new personal fork.
- **If you've enabled your codespace to access other repositories**: When a codespace has been granted [access to other repositories](/codespaces/managing-codespaces-for-your-organization/managing-access-and-security-for-your-organizations-codespaces), any codespace created from that repository will have read/write tokens scoped to the source repository. In addition, the tokens will also receive read access to other repositories indicated by the user or organization.
An organization's administrators specify which repositories should be considered trusted. An admin can [choose to trust](/codespaces/managing-codespaces-for-your-organization/managing-access-and-security-for-your-organizations-codespaces) none, all, or some of the organization's repositories. A codespace can't have greater permissions to access resources than the person who created it, even if the organization administrator has granted access to all users and all repositories.
### Codespace connections
You can connect to your codespace using the TLS encrypted tunnel provided by the {% data variables.product.prodname_codespaces %} service. Only the creator of a codespace can connect to a codespace. Connections are authenticated with {% data variables.product.product_name %}.
If you need to allow external access to services running on a codespace, you can enable port forwarding for private or public access.
### Port forwarding
If you need to connect to a service (such as a development web server) running within your codespace, you can configure port forwarding to make the service available on the internet.
**Privately forwarded ports**: Are accessible on the internet, but only the codespace creator can access them, after authenticating to {% data variables.product.product_name %}.
**Publicly forwarded ports**: Are accessible on the internet, and anyone on the internet can access them. No authentication is needed to access public forwarded ports.
All forwarded ports are private by default, which means that you will need to authenticate before you can access the port. Access to a codespace's private forwarded ports is controlled by authentication cookies with a 3-hour expiry period. When the cookie expires, you will need to reauthenticate.
A public forwarded port will automatically revert back to private when you remove and re-add the port, or if you restart the codespace.
You can use the "Ports" panel to configure a port for public or private access, and can stop port forwarding when it's no longer required. For more information, see "[Forwarding ports in your codespace](/codespaces/developing-in-codespaces/forwarding-ports-in-your-codespace)."
## Good security practices for your codespaces
Codespaces are designed to be security hardened by default. To help maintain this posture, we recommend that you follow good security practices during your development procedures:
- As with any development tool, remember that you should only open and work within repositories you know and trust.
- Before you add new dependencies to the codespace, check whether they are well-maintained, and if they release updates to fix any security vulnerabilities found in their code.
### Using secrets to access sensitive information
Always use encrypted secrets when you want to use sensitive information (such as access tokens) in a codespace. You can access your secrets as environment variables in the codespace, including from the terminal. For example, you can launch a terminal within your codespace and use `echo $SECRET_NAME` to see the value of a secret.
The secret values are copied to environment variables whenever the codespace is resumed or created, so if you update a secret value while the codespace is running, youll need to suspend and resume to pick up the updated value.
For more information on secrets, see:
- "[Managing encrypted secrets for your codespaces](/codespaces/managing-your-codespaces/managing-encrypted-secrets-for-your-codespaces)"
- "[Managing encrypted secrets for your repository and organization for Codespaces](/codespaces/managing-codespaces-for-your-organization/managing-encrypted-secrets-for-your-repository-and-organization-for-codespaces)"
### Working with other people's contributions and repositories
When you create a codespace from a PR branch from a fork, the token in the codespace will vary depending on whether the repository is public or private:
- For a private repository, the codespace is granted access to both the fork and parent.
- For a public repository, the codespace will only have access to the fork and opening PRs on the parent.
### Additional good practices
There are some additional good practices and risks that you should be aware of when using {% data variables.product.prodname_codespaces %}.
#### Understanding a repository's devcontainer.json file
When creating a codespace, the [devcontainer.json](https://code.visualstudio.com/docs/remote/devcontainerjson-reference) is parsed and applied from the source repo, if one exists. The devcontainer contains powerful features, such as installing third-party extensions and running arbitrary code through a supplied `postCreateCommand`.
#### Granting access through features
Certain development features can potentially add risk to your environment. For example, commit signing, secrets injected into environment variables, authenticated registry access, and packages access can all present potential security issues. We recommend that you only grant access to those who need it and adopt a policy of being as restrictive as possible.
#### Using extensions
Any additional {% data variables.product.prodname_vscode %} extensions that you've installed can potentially introduce more risk. To help mitigate this risk, ensure that the you only install trusted extensions, and that they are always kept up to date.

View File

@@ -0,0 +1,55 @@
---
title: Understanding billing for Codespaces
intro: 'Learn how your {% data variables.product.prodname_codespaces %} usage is billed.'
versions:
fpt: '*'
redirect_from:
- /github/developing-online-with-codespaces/about-billing-for-codespaces
- /codespaces/getting-started-with-codespaces/about-billing-for-codespaces
- /codespaces/codespaces-reference/about-billing-for-codespaces
type: reference
topics:
- Codespaces
- Billing
product: '{% data reusables.gated-features.codespaces %}'
shortTitle: Understanding billing
---
This article explains how billing works for your codespaces, and explains how your organization's billing manager can help.
## Getting access to {% data variables.product.prodname_codespaces %}
Your organization's administrator might limit {% data variables.product.prodname_codespaces %} usage to only specific user accounts. To get access, you will need to contact your billing manager. For more information, see "[Managing access and security for your codespaces](/codespaces/managing-your-codespaces/managing-access-and-security-for-your-codespaces)."
## How much it costs to use {% data variables.product.prodname_codespaces %}
To see the pricing for {% data variables.product.prodname_codespaces %} usage, see "[{% data variables.product.prodname_codespaces %} pricing](/billing/managing-billing-for-github-codespaces/about-billing-for-codespaces#codespaces-pricing)."
## How your codespace usage is billed
Your codespace is billed for its compute minutes and for the amount of storage it uses on disk.
### Understanding what compute minutes are
Your codespace is billed for the number of minutes that it's active. If your codespaces window is left idle for 30 minutes, it will automatically shutdown, and compute billing for the codespace will end until you start the codespace again.
### Understanding how codespace storage is billed
For {% data variables.product.prodname_codespaces %}, storage is defined to include any files relating to your codespace, such as the cloned repository, configuration files, and extensions, among others. This storage is billed while your codespace is shutdown. The storage billing for a codespace ends when you manually delete it from https://github.com/codespaces.
## How spending limits work
Before your organization can use {% data variables.product.prodname_codespaces %}, your billing manager will need to set a spending limit. For more information, see "[Managing spending limits for {% data variables.product.prodname_codespaces %}](/billing/managing-billing-for-github-codespaces/managing-spending-limits-for-codespaces)."
## Exporting changes when you have reached your spending limit
{% data reusables.codespaces.exporting-changes %}
## Checking your current usage and limits
If you need to check your current usage or spending limit, contact your organization's billing manager. For more information, see "[Viewing your Codespaces usage](/billing/managing-billing-for-github-codespaces/viewing-your-codespaces-usage)."
## Codespaces can be automatically deleted
Your codespace will be automatically deleted when you are removed from an organization or repository.
## Deleting your unused codespaces
You can manually delete your codespaces in https://github.com/codespaces and from within {% data variables.product.prodname_vscode %}. To reduce the size of a codespace, you can manually delete files using the terminal or from within {% data variables.product.prodname_vscode %}.

View File

@@ -0,0 +1,64 @@
---
title: Using the Command Palette in Codespaces
intro: 'You can use the Command Palette feature of {% data variables.product.prodname_vscode %} to access many commands in Codespaces.'
versions:
fpt: '*'
type: reference
topics:
- Codespaces
- Visual Studio Code
product: '{% data reusables.gated-features.codespaces %}'
shortTitle: Command Palette
---
## About the Command Palette
The Command Palette is one of the focal features of {% data variables.product.prodname_vscode %} and is available for you to use in Codespaces. The Command Palette allows you to access many commands for {% data variables.product.prodname_codespaces %} and {% data variables.product.prodname_vscode %}. For more information on using the Command Palette, see "[User Interface](https://code.visualstudio.com/docs/getstarted/userinterface#_command-palette)" in the Visual Studio Code documentation.
## Accessing the Command Palette
You can access the Command Palette in a number of ways.
- `Shift + Command + P` (Mac) / `Ctrl + Shift + P` (Windows).
Note that this command is a reserved keyboard shortcut in Firefox.
- `F1`
- From the Application Menu, click **View > Command Palette…**.
![The application menu](/assets/images/help/codespaces/codespaces-view-menu.png)
## Commands for {% data variables.product.prodname_github_codespaces %}
To see all commands related to {% data variables.product.prodname_github_codespaces %} access the Command Palette, then start typing "Codespaces".
![A list of all commands that relate to Codespaces](/assets/images/help/codespaces/codespaces-command-palette.png)
### Suspending or stopping a codespace
If you add a new secret or change the machine type, you'll have to stop and restart the codespace for it to apply your changes.
To suspend or stop your codespace's container, access the Command Palette, then start typing "stop". Select **Codespaces: Stop Current Codespace**.
![Command to stop a codespace](/assets/images/help/codespaces/codespaces-stop.png)
### Adding a dev container from a template
To add a dev container from a template, access the Command Palette, then start typing "dev container". Select **Codespaces: Add Development Container Configuration Files...**
![Command to add a dev container](/assets/images/help/codespaces/add-prebuilt-container-command.png)
### Rebuilding a codespace
If you add a dev container or edit any of the configuration files (`devcontainer.json` and `Dockerfile`), you'll have to rebuild your codespace for it to apply your changes.
To rebuild your container, access the Command Palette, then start typing "rebuild". Select **Codespaces: Rebuild Container**.
![Command to rebuild a codespace](/assets/images/help/codespaces/codespaces-rebuild.png)
### Codespaces logs
You can use the Command Palette to access the codespace creation logs, or you can use it export all logs.
To retrieve the logs for Codespaces, access the Command Palette, then start typing "log". Select **Codespaces: Export Logs** to export all logs related to Codespaces or select **Codespaces: View Creation Logs** to view logs related to the setup.
![Command to access logs](/assets/images/help/codespaces/codespaces-logs.png)