baredevcontainer/zig repository overview

⁠zig

Dev container image with the Zig compiler installed, built on the debian⁠ base image.

Like every image in this repository, it is minimal, built only from upstreams verified at build time, and published with SLSA provenance, a GitHub artifact attestation, and an SBOM; it runs as the non-root user dev. Why these images⁠ explains the reasoning, and Verifying the image⁠ below shows how to check a build.

⁠Image

ghcr.io/bare-devcontainer/zig:<tag>

Reference it from .devcontainer/devcontainer.json, pinning the digest as well as the tag:

{
  "image": "ghcr.io/bare-devcontainer/zig:0.16@sha256:<digest>"
}

⁠Dev Container Template

A ready-to-use Dev Container template for this image is available at bare-devcontainer/templates⁠. It provides the recommended configuration for this image, including security hardening and volume mounts that persist cache directories for faster rebuilds.

⁠Tags

Tags are also published with a date suffix on each build (e.g., 0.16.0-trixie-<YYYYMMDD>).

Besides the release tags, the master tags carry the master builds Zig publishes, refreshed daily.

⁠Installed software

Everything from the debian⁠ base image, plus:

• Zig bundle⁠
• ZLS⁠
• ziglang/shell-completions⁠

~/.cache/zig holds the build and package cache; persisting it as a volume keeps builds warm across container rebuilds.

⁠Not installed

• No adjacent Zig tooling. zig fmt and ZLS are the whole toolbox here; anything else is left to the project.

⁠Supply chain

The Zig tarball is downloaded from a community mirror⁠ with ziglang.org as the fallback, then verified with a minisign signature against Zig's public key (zig/zig-minisign.pub); the signature's trusted comment is checked to name the requested file, so a valid signature for a different release cannot be substituted. ZLS is verified the same way against its own key (zig/zls-minisign.pub). Both keys are committed to this repository and reviewed like any other change.

Shell completions are fetched from ziglang/shell-completions⁠ with git at a pinned commit hash rather than by raw file URL, so the content is cryptographically bound to the reviewed commit instead of trusting the server to serve honest content for it.

⁠Verifying the image

Every build is published with SLSA provenance, a GitHub artifact attestation, and an SBOM. The attestation confirms that an image was built by the release workflow of this repository and has not been altered since:

gh attestation verify oci://ghcr.io/bare-devcontainer/zig:<tag>@sha256:<digest> \
  --owner bare-devcontainer

The Docker Hub mirror carries the same digests, so the same command verifies an image pulled from docker.io/baredevcontainer/zig. Verifying Published Images⁠ covers inspecting the provenance and the SBOM as well.