Fix Codespaces prebuild failure due to Yarn GPG key expiration

[mitchdenny]

Problem

The Codespaces prebuild CI will fail on the next run with:

E: The repository 'https://dl.yarnpkg.com/debian stable InRelease' is not signed.
ERROR: Feature "Docker (Docker-in-Docker)" (ghcr.io/devcontainers/features/docker-in-docker) failed to install!

The last successful prebuild was on December 10, 2025 — before the Yarn GPG key expired in January 2026.

Root Cause

The base image mcr.microsoft.com/devcontainers/dotnet:dev-10.0-noble includes a Yarn apt repository with an expired/rotated GPG key (NO_PUBKEY 62D54FD4003F6525). When the Docker-in-Docker feature runs apt-get update, the invalid signature causes the entire build to fail.

Why We Need Our Own Dockerfile

1. We don't use Yarn - This devcontainer is for .NET Aspire development. Node.js is provided via the ghcr.io/devcontainers/features/node:1 feature which includes npm. Yarn is not needed.

2. Yarn v1 is no longer actively developed - Per the Yarn maintainers: "Development of Yarn v1 is finished now (no new work is planned)." The GPG key was extended to 2030, but there's discussion about removing the apt repository from base images entirely.

3. This has happened before - The Yarn GPG key expiration issue previously occurred in 2023 (Yarn GPG key expiry prevents running apt devcontainers/images#370). Using a Dockerfile to remove the unused repository protects us from future key rotations.

4. No ETA on upstream fix - The issue is tracked at GPG key for Yarn has expired, devcontainers/images#1752 (opened Jan 23, 2026). While maintainers have patched some images, the dotnet:dev-10.0-noble image hasn't been rebuilt yet. There's no committed timeline for when all images will be updated.

5. The fix runs too late otherwise - Using onCreateCommand to remove the repository doesn't work because devcontainer features (like Docker-in-Docker) are installed before onCreateCommand runs. A Dockerfile is the only way to fix apt before feature installation.

Changes

• Added .devcontainer/Dockerfile that removes /etc/apt/sources.list.d/yarn.list
• Updated .devcontainer/devcontainer.json to use the Dockerfile instead of direct image reference

References

• Upstream issue: GPG key for Yarn has expired, devcontainers/images#1752
• Yarn GPG key issue: Expired gpg signature yarnpkg/yarn#9216
• Previous occurrence: Yarn GPG key expiry prevents running apt devcontainers/images#370
• Same fix applied to aspire-devcontainer-nightly: Fix Codespaces prebuild failure due to Yarn GPG key expiration aspire-devcontainer-nightly#6