baredevcontainer/rustup repository overview

⁠rustup (rust)

Dev container image for Rust development, with rustup⁠ installed, built on the debian⁠ base image.

Like every image in this repository, it is minimal, built only from upstreams verified at build time, and published with SLSA provenance, a GitHub artifact attestation, and an SBOM; it runs as the non-root user dev. Why these images⁠ explains the reasoning, and Verifying the image⁠ below shows how to check a build.

⁠Image

ghcr.io/bare-devcontainer/rustup:<tag>

Reference it from .devcontainer/devcontainer.json, pinning the digest as well as the tag:

{
  "image": "ghcr.io/bare-devcontainer/rustup:1@sha256:<digest>"
}

⁠Dev Container Template

A ready-to-use Dev Container template for this image is available at bare-devcontainer/templates⁠. It provides the recommended configuration for this image, including security hardening and volume mounts that persist cache directories for faster rebuilds.

⁠Tags

Tags are also published with a date suffix on each build (e.g., 1.29.0-trixie-<YYYYMMDD>).

The version in these tags is the version of rustup itself, not of any Rust toolchain.

⁠Installed software

Everything from the debian⁠ base image, plus:

• rustup⁠

~/.cargo/bin is on PATH under a Dev Container client, so the rustup/cargo shims resolve once a toolchain is installed. Running the image without one (docker run, a CI job's container:) leaves the directory off PATH.

⁠Not installed

• No Rust toolchain. rustc, cargo, and the standard library arrive when rustup installs the toolchain the project asks for, so the version in use is the one the project declares rather than the one this image happens to ship.
• No toolchain components. clippy, rustfmt, and rust-analyzer ship with the toolchain, so they appear only after it is installed — add them with rustup component add clippy rustfmt rust-analyzer.
• No cargo subcommands. cargo-watch, cargo-nextest, and similar are installed per project with cargo install.

⁠Working with toolchains

A project that pins its toolchain in rust-toolchain.toml needs no setup: the first cargo or rustc invocation installs the pinned toolchain. To install it up front instead of on first use, run rustup toolchain install from a postCreateCommand; with no arguments it installs the toolchain the project pins. Without a rust-toolchain.toml, install a toolchain explicitly with rustup toolchain install stable.

Two directories are worth persisting across container rebuilds as volumes:

• ~/.rustup — the installed toolchains. Toolchains are re-downloaded on every rebuild unless this directory survives.
• ~/.cargo — the registry and git caches for downloaded crates.

⁠Supply chain

rustup is downloaded directly from the official rustup release archive⁠. rustup publishes no signature for rustup-init, so it is verified against a SHA-256 checksum file committed to this repository (rustup/rustup-init-<arch>.sha256) rather than one fetched from the same server as the binary. The committed checksum files are kept in sync with the pinned RUSTUP_VERSION by an automated workflow and reviewed like any other change, so later tampering with the download channel cannot affect builds.

Automatic self-update is disabled, so rustup update and rustup toolchain install keep this verified rustup. Running rustup self update replaces it with a download this image did not verify.

Note that this covers rustup itself. Toolchains it installs at runtime are downloaded from static.rust-lang.org outside this image's build pipeline; rustup checks them against SHA-256 hashes from the same server and verifies no signature.

⁠Verifying the image

Every build is published with SLSA provenance, a GitHub artifact attestation, and an SBOM. The attestation confirms that an image was built by the release workflow of this repository and has not been altered since:

gh attestation verify oci://ghcr.io/bare-devcontainer/rustup:<tag>@sha256:<digest> \
  --owner bare-devcontainer

The Docker Hub mirror carries the same digests, so the same command verifies an image pulled from docker.io/baredevcontainer/rustup. Verifying Published Images⁠ covers inspecting the provenance and the SBOM as well.