Ensuring repeatable devcontainer images in GitHub Codespaces

Goal

Build a devcontainer that remains identical across multiple Codespace creations, regardless of upstream image updates.

Constraints and Uncertainty

Codespaces builds containers from devcontainer.json and relies on Docker image tags (e.g., node:18). The caching mechanism uses layer hashes but does not expose a way to pin a specific image digest. If the upstream tag is updated on Docker Hub, subsequent Codespaces may pull a newer image, introducing subtle differences even though the configuration file is unchanged. No documented support exists for locking a digest within devcontainer.json, and it is unclear whether Codespaces offers any flag to disable or control this caching behavior.

Specific Questions

• Which approach can enforce a particular image digest in devcontainer.json to guarantee determinism?
• Does GitHub Codespaces provide a configuration option to disable or override the default image‑caching strategy?
• Can a Codespace be forced to rebuild its base image when the upstream tag changes, and if so, how?