Devcontainer Setup
Trail of BitsOfficialPublished by Trail of Bits
- Skill
- Workflow
- Cloud and DevOps
- CC-BY-SA-4.0
- Medium risk
- Has scripts
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
The devcontainer-setup skill provides a structured workflow for generating isolated, reproducible development environments. It automatically detects the project's language stack (Python, Node/TypeScript, Rust, or Go) and generates a complete .devcontainer configuration. This includes a pre-configured Dockerfile, VS Code settings, persistent volumes for build caches, and integrated tooling like Claude Code, ast-grep, and various CLI utilities. The setup emphasizes security through network isolation, read-only mounts, and token forwarding, ensuring a consistent and secure workspace for developers.
What it does
- Detects project languages and dependencies automatically.
- Generates a .devcontainer directory with Dockerfile and configuration files.
- Configures Claude Code and essential CLI tools within the container.
- Sets up persistent volumes for language-specific build caches.
- Merges language-specific extensions and settings into the configuration.
- Provides a helper script for managing the container lifecycle.
When to use it
- When initializing a new project and requiring a standardized development environment.
- When you need to add devcontainer support to an existing codebase.
- When creating a sandboxed workspace for Claude Code.
- When you require isolated environments with persistent configuration across sessions.
Advantages
- Ensures consistent development environments across team members.
- Automates complex configuration tasks for multi-language projects.
- Enhances security with built-in isolation and read-only mounts.
- Optimizes build times using persistent volumes for language caches.
- Includes modern, pre-configured CLI tools for improved productivity.
Usage examples
- “Set up a devcontainer for this project.”
- The agent analyzes the project files, detects the language stack, and generates the necessary .devcontainer configuration files.
- “Add devcontainer support to my Python project.”
- The agent creates a Python-optimized devcontainer with uv, Ruff, and Pylance, including a postCreateCommand to sync dependencies.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/trailofbits/devcontainer-setup/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip devcontainer-setup.zip -d .agents/skills
Documentation by Trail of Bits
Devcontainer Setup Skill
Creates a pre-configured devcontainer with Claude Code and language-specific tooling.
When to Use
User asks to "set up a devcontainer" or "add devcontainer support"
User wants a sandboxed Claude Code development environment
User needs isolated development environments with persistent configuration
When NOT to Use
User already has a devcontainer configuration and just needs modifications
User is asking about general Docker or container questions
User wants to deploy production containers (this is for development only)
Workflow
flowchart TB
start([User requests devcontainer])
recon[1. Project Reconnaissance]
detect[2. Detect Languages]
generate[3. Generate Configuration]
write[4. Write files to .devcontainer/]
done([Done])
start --> recon
recon --> detect
detect --> generate
generate --> write
write --> donePhase 1: Project Reconnaissance
Infer Project Name
Check in order (use first match):
package.json→namefieldpyproject.toml→project.nameCargo.toml→package.namego.mod→ module path (last segment after/)Directory name as fallback
Convert to slug: lowercase, replace spaces/underscores with hyphens.
Detect Language Stack
| Language | Detection Files |
|---|---|
| Python | pyproject.toml, *.py |
| Node/TypeScript | package.json, tsconfig.json |
| Rust | Cargo.toml |
| Go | go.mod, go.sum |
Multi-Language Projects
If multiple languages are detected, configure all of them in the following priority order:
Python - Primary language, uses Dockerfile for uv + Python installation
Node/TypeScript - Uses devcontainer feature
Rust - Uses devcontainer feature
Go - Uses devcontainer feature
For multi-language postCreateCommand, chain all setup commands:
uv run /opt/post_install.py && uv sync && npm ciExtensions and settings from all detected languages should be merged into the configuration.
Phase 2: Generate Configuration
Start with base templates from resources/ directory. Substitute:
{{PROJECT_NAME}}→ Human-readable name (e.g., "My Project"){{PROJECT_SLUG}}→ Slug for volumes (e.g., "my-project")
Then apply language-specific modifications below.
Base Template Features
The base template includes:
Claude Code with marketplace plugins (anthropics/skills, trailofbits/skills, trailofbits/skills-curated)
Sandboxing via bubblewrap and socat
Python 3.13 via uv (fast binary download)
Node 22 via fnm (Fast Node Manager)
ast-grep for AST-based code search
Network isolation tools (iptables, ipset) with NET_ADMIN capability
Security mounts:
.devcontainer/mounted read-only to prevent container escapeToken forwarding:
CLAUDE_CODE_OAUTH_TOKENandANTHROPIC_API_KEYviaremoteEnvModern CLI tools: ripgrep, fd, fzf, tmux, git-delta
Language-Specific Sections
Python Projects
Detection: pyproject.toml, requirements.txt, setup.py, or *.py files
Dockerfile additions:
The base Dockerfile already includes Python 3.13 via uv. If a different version is required (detected from pyproject.toml), modify the Python installation:
# Install Python via uv (fast binary download, not source compilation)
RUN uv python install <version> --defaultdevcontainer.json extensions:
Add to customizations.vscode.extensions:
"ms-python.python",
"ms-python.vscode-pylance",
"charliermarsh.ruff"Add to customizations.vscode.settings:
"python.defaultInterpreterPath": ".venv/bin/python",
"[python]": {
"editor.defaultFormatter": "charliermarsh.ruff",
"editor.codeActionsOnSave": {
"source.organizeImports": "explicit"
}
}postCreateCommand:
If pyproject.toml exists, chain commands:
rm -rf .venv && uv sync && uv run /opt/post_install.pyNode/TypeScript Projects
Detection: package.json or tsconfig.json
No Dockerfile additions needed: The base template includes Node 22 via fnm (Fast Node Manager).
devcontainer.json extensions:
Add to customizations.vscode.extensions:
"dbaeumer.vscode-eslint",
"esbenp.prettier-vscode"Add to customizations.vscode.settings:
"editor.defaultFormatter": "esbenp.prettier-vscode",
"editor.codeActionsOnSave": {
"source.fixAll.eslint": "explicit"
}postCreateCommand: Detect package manager from lockfile and chain with base command:
pnpm-lock.yaml→uv run /opt/post_install.py && pnpm install --frozen-lockfileyarn.lock→uv run /opt/post_install.py && yarn install --frozen-lockfilepackage-lock.json→uv run /opt/post_install.py && npm ciNo lockfile →
uv run /opt/post_install.py && npm install
Rust Projects
Detection: Cargo.toml
Features to add:
"ghcr.io/devcontainers/features/rust:1": {}devcontainer.json extensions:
Add to customizations.vscode.extensions:
"rust-lang.rust-analyzer",
"tamasfe.even-better-toml"Add to customizations.vscode.settings:
"[rust]": {
"editor.defaultFormatter": "rust-lang.rust-analyzer"
}postCreateCommand:
If Cargo.lock exists, use locked builds:
uv run /opt/post_install.py && cargo build --lockedIf no lockfile, use standard build:
uv run /opt/post_install.py && cargo buildGo Projects
Detection: go.mod
Features to add:
"ghcr.io/devcontainers/features/go:1": {
"version": "latest"
}devcontainer.json extensions:
Add to customizations.vscode.extensions:
"golang.go"Add to customizations.vscode.settings:
"[go]": {
"editor.defaultFormatter": "golang.go"
},
"go.useLanguageServer": truepostCreateCommand:
uv run /opt/post_install.py && go mod downloadReference Material
For additional guidance, see:
references/dockerfile-best-practices.md- Layer optimization, multi-stage builds, architecture supportreferences/features-vs-dockerfile.md- When to use devcontainer features vs custom Dockerfile
Adding Persistent Volumes
Pattern for new mounts in devcontainer.json:
"mounts": [
"source={{PROJECT_SLUG}}-<purpose>-${devcontainerId},target=<container-path>,type=volume"
]Common additions:
source={{PROJECT_SLUG}}-cargo-${devcontainerId},target=/home/vscode/.cargo,type=volume(Rust)source={{PROJECT_SLUG}}-go-${devcontainerId},target=/home/vscode/go,type=volume(Go)
Output Files
Generate these files in the project's .devcontainer/ directory:
Dockerfile- Container build instructionsdevcontainer.json- VS Code/devcontainer configurationpost_install.py- Post-creation setup script.zshrc- Shell configurationinstall.sh- CLI helper for managing the devcontainer (devccommand)
Validation Checklist
Before presenting files to the user, verify:
All
{{PROJECT_NAME}}placeholders are replaced with the human-readable nameAll
{{PROJECT_SLUG}}placeholders are replaced with the slugified nameJSON syntax is valid in
devcontainer.json(no trailing commas, proper nesting)Language-specific extensions are added for all detected languages
postCreateCommandincludes all required setup commands (chained with&&)
User Instructions
After generating, inform the user:
How to start: "Open in VS Code and select 'Reopen in Container'"
Alternative:
devcontainer up --workspace-folder .CLI helper: Run
.devcontainer/install.sh self-installto add thedevccommand to PATH
Files
- ATTRIBUTION.mdAdded by AutoGineer948 B
- LICENSELicence file added by AutoGineer19.7 KiB
- SKILL.md7.9 KiB
- agents/openai.yaml239 B
- assets/trail-of-bits-mark.svg3.0 KiB
- references/dockerfile-best-practices.md3.3 KiB
- references/features-vs-dockerfile.md675 B
- resources/.zshrc1.8 KiB
- resources/Dockerfile3.8 KiB
- resources/devcontainer.json2.5 KiB
- resources/install.shScript22.6 KiB
- resources/post_install.pyScript8.4 KiB
resources/devcontainer.json
{
"$schema": "https://raw.githubusercontent.com/devcontainers/spec/main/schemas/devContainer.schema.json",
"name": "{{PROJECT_NAME}}",
"build": {
"dockerfile": "Dockerfile",
"args": {
"TZ": "${localEnv:TZ:UTC}",
"GIT_DELTA_VERSION": "0.18.2",
"ZSH_IN_DOCKER_VERSION": "1.2.1"
}
},
"features": {
"ghcr.io/devcontainers/features/github-cli:1": {}
},
"runArgs": [
"--cap-add=NET_ADMIN",
"--cap-add=NET_RAW"
],
"init": true,
"updateRemoteUserUID": true,
"customizations": {
"vscode": {
"extensions": [
"anthropic.claude-code"
],
"settings": {
"terminal.integrated.defaultProfile.linux": "zsh",
"terminal.integrated.profiles.linux": {
"bash": {
"path": "bash",
"icon": "terminal-bash"
},
"zsh": {
"path": "zsh"
}
},
"files.trimTrailingWhitespace": true,
"files.insertFinalNewline": true,
"files.trimFinalNewlines": true
}
}
},
"remoteUser": "vscode",
"mounts": [
"source={{PROJECT_SLUG}}-bashhistory-${devcontainerId},target=/commandhistory,type=volume",
"source={{PROJECT_SLUG}}-config-${devcontainerId},target=/home/vscode/.claude,type=volume",
"source={{PROJECT_SLUG}}-gh-${devcontainerId},target=/home/vscode/.config/gh,type=volume",
"source=${localEnv:HOME}/.gitconfig,target=/home/vscode/.gitconfig,type=bind,readonly",
"source=${localWorkspaceFolder}/.devcontainer,target=/workspace/.devcontainer,type=bind,readonly"
],
"containerEnv": {
"NODE_OPTIONS": "--max-old-space-size=4096",
"CLAUDE_CONFIG_DIR": "/home/vscode/.claude",
"POWERLEVEL9K_DISABLE_GITSTATUS": "true",
"GIT_CONFIG_GLOBAL": "/home/vscode/.gitconfig.local",
"UV_LINK_MODE": "copy",
"NPM_CONFIG_IGNORE_SCRIPTS": "true",
"NPM_CONFIG_AUDIT": "true",
"NPM_CONFIG_FUND": "false",
"NPM_CONFIG_SAVE_EXACT": "true",
"NPM_CONFIG_UPDATE_NOTIFIER": "false",
"NPM_CONFIG_MINIMUM_RELEASE_AGE": "1440",
"PYTHONDONTWRITEBYTECODE": "1",
"PIP_DISABLE_PIP_VERSION_CHECK": "1"
},
"remoteEnv": {
"CLAUDE_CODE_OAUTH_TOKEN": "${localEnv:CLAUDE_CODE_OAUTH_TOKEN:}",
"ANTHROPIC_API_KEY": "${localEnv:ANTHROPIC_API_KEY:}"
},
"initializeCommand": "test -f \"$HOME/.gitconfig\" || touch \"$HOME/.gitconfig\"",
"workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind,consistency=delegated",
"workspaceFolder": "/workspace",
"postCreateCommand": "uv run --no-project /opt/post_install.py"
}
Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs an API key, Needs Python, Needs Node.js
Security
What our scanner noticed· Medium risk
- Instructions that use the network
- Downloads piped into a shell
- Scripts that your agent may run
This skill includes scripts that your agent may run. Read them before you use it.
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- Trail of Bits
- Publisher
- Trail of Bits (Official)
- Source
- trailofbits/skills · plugins/devcontainer-setup/skills/devcontainer-setup · commit e4dd0bb
- Licence
- Creative Commons Attribution-ShareAlike 4.0 International (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Trail of Bits or Trail of Bits.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download devcontainer-setup.zip