github
Codespaces: Policies for Security/Compliance
Summary
Organizations need additional controls over how users can use codespaces. We've started providing policies for controlling costs, and this expands policies to include additional constraints that make codespaces more secure and complaint:
- Limiting what port forwarding visibility options can be used (e.g. "disallow public port forwarding")
- Limiting the base container images that a codespace can be created from (e.g. "only allow creation from approved container images")
Intended Outcome
As organizations start scaling with Codespaces, this enables organization admins to ensure codespaces are secure and compliant.
How will it work?
All of these policies build off our policy framework, as first implemented with the "allowed machine type" policy:
Allowed port visibility options
Codespaces allows developers to forward ports from their codespace, for instance forwarding a web server on port 3000 to test an API or view a website under development. This port can be forwarded privately (just to the developer), to every signed in user in the organization, or publicly to anyone with the URL.
This policy lets org admins restrict public and org visibility by disallowing those visibility options, making codespaces viewable only to authenticated users or only to the individual developer.
Allowed base container images
Codespaces currently lets developers pick any container image for their dev container (or GitHub provides a base image with lots of common tools built in), as specified in their devcontainer.json.
This policy lets org admins provide a set of allowed base images (e.g. only allow specific images the organization has created and stored in GitHub Container Registry) that can be used in Codespaces created in that org (or on a specific repo).
this has partially shipped: limiting what port forwarding visibility options can be used (e.g. "disallow public port forwarding") https://github.blog/changelog/2022-04-04-codespaces-now-offers-organization-policies-to-restrict-port-visibility-settings/
this has shipped to dotcom! https://github.blog/changelog/2022-10-20-codespaces-now-offers-an-organizational-policy-to-restrict-container-images closing out this issue