This patch prevents claude from manipulating `.git/hooks` or
`.git/config` which could result in unintended code execution outside
the devcontainer.
As an example, ask claude to create a git hook to print "Hello World" on
commit or push. Outside of the devcontainer, the git status is clean,
but running `git commit` or `git push` will result in printing "Hellow
World".
Credit for this disovery to @tillberg.
* feat: add non-interactive auth via CLAUDE_CODE_OAUTH_TOKEN
Bypass the interactive onboarding wizard when CLAUDE_CODE_OAUTH_TOKEN is
set. On container create, post_install.py runs `claude -p` to populate
auth state and sets hasCompletedOnboarding so the TUI starts without the
login wizard.
Workaround for https://github.com/anthropics/claude-code/issues/8938.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: use remoteEnv instead of containerEnv for secrets
containerEnv bakes values into the image as ENV instructions, visible
in docker inspect/history. remoteEnv is set at runtime only.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: improve error handling in onboarding bypass
- Handle timeout as expected (claude -p writes config before API call)
- Catch FileNotFoundError/OSError if claude is not installed
- Check returncode explicitly instead of dead CalledProcessError catch
- Guard on ~/.claude.json existence before writing onboarding flag
- Replace contextlib.suppress with explicit try/except that logs
- Update module docstring and README wording
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Add `devc destroy [-f]` to cleanly remove all Docker resources
(container, volumes, images) for a project. Includes resource
discovery via container inspection, itemized pre-deletion summary,
y/N confirmation prompt with --force bypass, running container
warning, and idempotent no-op when no resources exist.
Rename volume prefix from claude-code-* to devc-* and include
workspace folder name for self-identifying volumes
(e.g., devc-myproject-config-{devcontainerId}).
Co-authored-by: Disconnect3d <dominik.b.czarnota@gmail.com>
Docker bind mounts require the source file to exist. Users without
~/.gitconfig (fresh machines, XDG-based config, system-only config)
hit a container start failure.
Add initializeCommand to create an empty ~/.gitconfig on the host
before the container starts. An empty gitconfig is valid and has no
side effects — git treats it as having no settings.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
- Default timezone to UTC instead of America/New_York
- Add shellcheck shell=bash directive to .zshrc
- Extract docker filter label into local variable in cmd_down
- Clarify mount filter comment (target paths immune to project name changes)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
A process inside the container could modify .devcontainer/devcontainer.json
to inject malicious mounts or initializeCommand entries that execute on the
host during the next rebuild. Bind-mounting .devcontainer/ as read-only
blocks this privilege escalation vector.
Uses startswith() for the jq filter to be precise and consistent with
other mount filters, and documents the SYS_ADMIN guard requirement.
Based on PR #12 with review feedback from @dguido addressed.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Brad Lhotsky