Add renovate.json with a custom regex manager that picks up
`# renovate:` comment directives on ARG lines. This covers:
- Docker base images (handled natively by Renovate's dockerfile manager)
- git-delta, fzf, and zsh-in-docker versions via github-releases
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix search path for .claude.json to account for CLAUDE_CONFIG_DIR
When `CLAUDE_CONFIG_DIR` is set, as is done in `devcontainer.json`, `claude` looks
for `.claude.json` in that folder; otherwise, `~` is used.
Learned through observation, not claude documentation :old-man-yells-at-cloud:
* add more words to the lookup behavior description
* Apply suggestion from @DarkaMaul
---------
Co-authored-by: dm <darkamaul@hotmail.fr>
* feat: add non-interactive auth via CLAUDE_CODE_OAUTH_TOKEN
Bypass the interactive onboarding wizard when CLAUDE_CODE_OAUTH_TOKEN is
set. On container create, post_install.py runs `claude -p` to populate
auth state and sets hasCompletedOnboarding so the TUI starts without the
login wizard.
Workaround for https://github.com/anthropics/claude-code/issues/8938.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: use remoteEnv instead of containerEnv for secrets
containerEnv bakes values into the image as ENV instructions, visible
in docker inspect/history. remoteEnv is set at runtime only.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: improve error handling in onboarding bypass
- Handle timeout as expected (claude -p writes config before API call)
- Catch FileNotFoundError/OSError if claude is not installed
- Check returncode explicitly instead of dead CalledProcessError catch
- Guard on ~/.claude.json existence before writing onboarding flag
- Replace contextlib.suppress with explicit try/except that logs
- Update module docstring and README wording
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Add `devc destroy [-f]` to cleanly remove all Docker resources
(container, volumes, images) for a project. Includes resource
discovery via container inspection, itemized pre-deletion summary,
y/N confirmation prompt with --force bypass, running container
warning, and idempotent no-op when no resources exist.
Rename volume prefix from claude-code-* to devc-* and include
workspace folder name for self-identifying volumes
(e.g., devc-myproject-config-{devcontainerId}).
Co-authored-by: Disconnect3d <dominik.b.czarnota@gmail.com>
* Add `devc sync` to copy devcontainer sessions to host for /insights
Claude Code's /insights reads sessions from ~/.claude/projects/ on
the host, but devcontainer sessions live inside container volumes.
This adds a `devc sync [project]` command that copies them over so
/insights can analyze devcontainer work alongside local sessions.
- Auto-discovers devcontainers via devcontainer.local_folder label
- Works on both running and stopped containers (docker cp only)
- Reads CLAUDE_CONFIG_DIR from container env for non-standard paths
- Incremental: only copies new/updated files
- Optional project name filter (case-insensitive substring)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Add devc sync to README
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Add safety prompt to `devc sync` before copying from containers
Warns users that sync copies files from devcontainers to the host
filesystem. Adds --trusted flag to skip the prompt for automation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
When the host configures `gpg.ssh.program` to use 1Password's
`op-ssh-sign` binary, commit signing fails inside the container
because that macOS-specific binary doesn't exist.
DevContainers automatically forward SSH_AUTH_SOCK from the host,
so the SSH agent (including 1Password's) is already available.
By overriding `gpg.ssh.program` to `/usr/bin/ssh-keygen` in the
container's local gitconfig (which is included after the host
config), signing uses the standard ssh-keygen against the
forwarded agent instead of the missing 1Password binary.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Add CODEOWNERS file
Require review from @dguido, @computerality, and @DarkaMaul for all
changes in the repository.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Apply suggestion from @disconnect3d
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Disconnect3d <dominik.b.czarnota@gmail.com>
Enables ad-hoc file extraction from a running devcontainer using
`docker cp`, without requiring a mount or container rebuild.
Usage: devc cp <container_path> <host_path>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Docker bind mounts require the source file to exist. Users without
~/.gitconfig (fresh machines, XDG-based config, system-only config)
hit a container start failure.
Add initializeCommand to create an empty ~/.gitconfig on the host
before the container starts. An empty gitconfig is valid and has no
side effects — git treats it as having no settings.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Add File Sharing section covering VS Code drag-and-drop and devc mount.
Add exec, upgrade, and mount to the CLI commands table. Expand the
Container Details table with volume mount paths and host mounts.
Closes#10
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
- Default timezone to UTC instead of America/New_York
- Add shellcheck shell=bash directive to .zshrc
- Extract docker filter label into local variable in cmd_down
- Clarify mount filter comment (target paths immune to project name changes)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
A process inside the container could modify .devcontainer/devcontainer.json
to inject malicious mounts or initializeCommand entries that execute on the
host during the next rebuild. Bind-mounting .devcontainer/ as read-only
blocks this privilege escalation vector.
Uses startswith() for the jq filter to be precise and consistent with
other mount filters, and documents the SYS_ADMIN guard requirement.
Based on PR #12 with review feedback from @dguido addressed.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Add exec, upgrade, and mount commands to devc CLI
- exec: Run arbitrary commands in the container
- upgrade: Update Claude Code to latest version
- mount: Add bind mounts to devcontainer.json (recreates container)
Also preserves custom mounts when template command overwrites
existing devcontainer configuration.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Address PR review comments
- Replace `npm install -g @anthropic-ai/claude-code@latest` with
`claude update` since Claude Code now uses native installer
- Remove `[--]` from exec command help/examples (not required)
- Replace embedded Python with jq for devcontainer.json manipulation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
These packages are required for Claude Code's native sandboxing on Linux:
- bubblewrap: Provides filesystem isolation via Linux namespaces
- socat: Enables the network proxy for domain filtering
Without these, the /sandbox command shows installation instructions
instead of enabling sandbox mode.
Ref: https://code.claude.com/docs/en/sandboxing
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
dm