Generated banner for Devcontainer Setup
Generated logo for Devcontainer Setup

Devcontainer Setup

Trail of BitsOfficialPublished by Trail of Bits

  • Skill
  • Workflow
  • Cloud and DevOps
  • CC-BY-SA-4.0
  • Medium risk
  • Has scripts

From the author

Creates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes. Use when adding devcontainer support to a project, setting up isolated development environments, or configuring sandboxed Claude Code workspaces.
— the description by Trail of Bits

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The devcontainer-setup skill provides a structured workflow for generating isolated, reproducible development environments. It automatically detects the project's language stack (Python, Node/TypeScript, Rust, or Go) and generates a complete .devcontainer configuration. This includes a pre-configured Dockerfile, VS Code settings, persistent volumes for build caches, and integrated tooling like Claude Code, ast-grep, and various CLI utilities. The setup emphasizes security through network isolation, read-only mounts, and token forwarding, ensuring a consistent and secure workspace for developers.

What it does

  • Detects project languages and dependencies automatically.
  • Generates a .devcontainer directory with Dockerfile and configuration files.
  • Configures Claude Code and essential CLI tools within the container.
  • Sets up persistent volumes for language-specific build caches.
  • Merges language-specific extensions and settings into the configuration.
  • Provides a helper script for managing the container lifecycle.

When to use it

  • When initializing a new project and requiring a standardized development environment.
  • When you need to add devcontainer support to an existing codebase.
  • When creating a sandboxed workspace for Claude Code.
  • When you require isolated environments with persistent configuration across sessions.

Advantages

  • Ensures consistent development environments across team members.
  • Automates complex configuration tasks for multi-language projects.
  • Enhances security with built-in isolation and read-only mounts.
  • Optimizes build times using persistent volumes for language caches.
  • Includes modern, pre-configured CLI tools for improved productivity.

Usage examples

“Set up a devcontainer for this project.”
The agent analyzes the project files, detects the language stack, and generates the necessary .devcontainer configuration files.
“Add devcontainer support to my Python project.”
The agent creates a Python-optimized devcontainer with uv, Ruff, and Pylance, including a postCreateCommand to sync dependencies.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/trailofbits/devcontainer-setup/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip devcontainer-setup.zip -d .agents/skills

Documentation by Trail of Bits

Devcontainer Setup Skill

Creates a pre-configured devcontainer with Claude Code and language-specific tooling.

When to Use

  • User asks to "set up a devcontainer" or "add devcontainer support"

  • User wants a sandboxed Claude Code development environment

  • User needs isolated development environments with persistent configuration

When NOT to Use

  • User already has a devcontainer configuration and just needs modifications

  • User is asking about general Docker or container questions

  • User wants to deploy production containers (this is for development only)

Workflow

flowchart TB
    start([User requests devcontainer])
    recon[1. Project Reconnaissance]
    detect[2. Detect Languages]
    generate[3. Generate Configuration]
    write[4. Write files to .devcontainer/]
    done([Done])

    start --> recon
    recon --> detect
    detect --> generate
    generate --> write
    write --> done

Phase 1: Project Reconnaissance

Infer Project Name

Check in order (use first match):

  1. package.json → name field

  2. pyproject.toml → project.name

  3. Cargo.toml → package.name

  4. go.mod → module path (last segment after /)

  5. Directory name as fallback

Convert to slug: lowercase, replace spaces/underscores with hyphens.

Detect Language Stack
LanguageDetection Files
Pythonpyproject.toml, *.py
Node/TypeScriptpackage.json, tsconfig.json
RustCargo.toml
Gogo.mod, go.sum
Multi-Language Projects

If multiple languages are detected, configure all of them in the following priority order:

  1. Python - Primary language, uses Dockerfile for uv + Python installation

  2. Node/TypeScript - Uses devcontainer feature

  3. Rust - Uses devcontainer feature

  4. Go - Uses devcontainer feature

For multi-language postCreateCommand, chain all setup commands:

uv run /opt/post_install.py && uv sync && npm ci

Extensions and settings from all detected languages should be merged into the configuration.

Phase 2: Generate Configuration

Start with base templates from resources/ directory. Substitute:

  • {{PROJECT_NAME}} → Human-readable name (e.g., "My Project")

  • {{PROJECT_SLUG}} → Slug for volumes (e.g., "my-project")

Then apply language-specific modifications below.

Base Template Features

The base template includes:

  • Claude Code with marketplace plugins (anthropics/skills, trailofbits/skills, trailofbits/skills-curated)

  • Sandboxing via bubblewrap and socat

  • Python 3.13 via uv (fast binary download)

  • Node 22 via fnm (Fast Node Manager)

  • ast-grep for AST-based code search

  • Network isolation tools (iptables, ipset) with NET_ADMIN capability

  • Security mounts: .devcontainer/ mounted read-only to prevent container escape

  • Token forwarding: CLAUDE_CODE_OAUTH_TOKEN and ANTHROPIC_API_KEY via remoteEnv

  • Modern CLI tools: ripgrep, fd, fzf, tmux, git-delta


Language-Specific Sections

Python Projects

Detection: pyproject.toml, requirements.txt, setup.py, or *.py files

Dockerfile additions:

The base Dockerfile already includes Python 3.13 via uv. If a different version is required (detected from pyproject.toml), modify the Python installation:

# Install Python via uv (fast binary download, not source compilation)
RUN uv python install <version> --default

devcontainer.json extensions:

Add to customizations.vscode.extensions:

"ms-python.python",
"ms-python.vscode-pylance",
"charliermarsh.ruff"

Add to customizations.vscode.settings:

"python.defaultInterpreterPath": ".venv/bin/python",
"[python]": {
  "editor.defaultFormatter": "charliermarsh.ruff",
  "editor.codeActionsOnSave": {
    "source.organizeImports": "explicit"
  }
}

postCreateCommand: If pyproject.toml exists, chain commands:

rm -rf .venv && uv sync && uv run /opt/post_install.py

Node/TypeScript Projects

Detection: package.json or tsconfig.json

No Dockerfile additions needed: The base template includes Node 22 via fnm (Fast Node Manager).

devcontainer.json extensions:

Add to customizations.vscode.extensions:

"dbaeumer.vscode-eslint",
"esbenp.prettier-vscode"

Add to customizations.vscode.settings:

"editor.defaultFormatter": "esbenp.prettier-vscode",
"editor.codeActionsOnSave": {
  "source.fixAll.eslint": "explicit"
}

postCreateCommand: Detect package manager from lockfile and chain with base command:

  • pnpm-lock.yaml → uv run /opt/post_install.py && pnpm install --frozen-lockfile

  • yarn.lock → uv run /opt/post_install.py && yarn install --frozen-lockfile

  • package-lock.json → uv run /opt/post_install.py && npm ci

  • No lockfile → uv run /opt/post_install.py && npm install


Rust Projects

Detection: Cargo.toml

Features to add:

"ghcr.io/devcontainers/features/rust:1": {}

devcontainer.json extensions:

Add to customizations.vscode.extensions:

"rust-lang.rust-analyzer",
"tamasfe.even-better-toml"

Add to customizations.vscode.settings:

"[rust]": {
  "editor.defaultFormatter": "rust-lang.rust-analyzer"
}

postCreateCommand: If Cargo.lock exists, use locked builds:

uv run /opt/post_install.py && cargo build --locked

If no lockfile, use standard build:

uv run /opt/post_install.py && cargo build

Go Projects

Detection: go.mod

Features to add:

"ghcr.io/devcontainers/features/go:1": {
  "version": "latest"
}

devcontainer.json extensions:

Add to customizations.vscode.extensions:

"golang.go"

Add to customizations.vscode.settings:

"[go]": {
  "editor.defaultFormatter": "golang.go"
},
"go.useLanguageServer": true

postCreateCommand:

uv run /opt/post_install.py && go mod download

Reference Material

For additional guidance, see:

  • references/dockerfile-best-practices.md - Layer optimization, multi-stage builds, architecture support

  • references/features-vs-dockerfile.md - When to use devcontainer features vs custom Dockerfile


Adding Persistent Volumes

Pattern for new mounts in devcontainer.json:

"mounts": [
  "source={{PROJECT_SLUG}}-<purpose>-${devcontainerId},target=<container-path>,type=volume"
]

Common additions:

  • source={{PROJECT_SLUG}}-cargo-${devcontainerId},target=/home/vscode/.cargo,type=volume (Rust)

  • source={{PROJECT_SLUG}}-go-${devcontainerId},target=/home/vscode/go,type=volume (Go)


Output Files

Generate these files in the project's .devcontainer/ directory:

  1. Dockerfile - Container build instructions

  2. devcontainer.json - VS Code/devcontainer configuration

  3. post_install.py - Post-creation setup script

  4. .zshrc - Shell configuration

  5. install.sh - CLI helper for managing the devcontainer (devc command)


Validation Checklist

Before presenting files to the user, verify:

  1. All {{PROJECT_NAME}} placeholders are replaced with the human-readable name

  2. All {{PROJECT_SLUG}} placeholders are replaced with the slugified name

  3. JSON syntax is valid in devcontainer.json (no trailing commas, proper nesting)

  4. Language-specific extensions are added for all detected languages

  5. postCreateCommand includes all required setup commands (chained with &&)


User Instructions

After generating, inform the user:

  1. How to start: "Open in VS Code and select 'Reopen in Container'"

  2. Alternative: devcontainer up --workspace-folder .

  3. CLI helper: Run .devcontainer/install.sh self-install to add the devc command to PATH

Files

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an API key, Needs Python, Needs Node.js

Security

What our scanner noticed· Medium risk

  • Instructions that use the network
  • Downloads piped into a shell
  • Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Trail of Bits
Publisher
Trail of Bits (Official)
Source
trailofbits/skills · plugins/devcontainer-setup/skills/devcontainer-setup · commit e4dd0bb
Licence
Creative Commons Attribution-ShareAlike 4.0 International (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Trail of Bits.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download devcontainer-setup.zip