Docker bind mounts require the source file to exist. Users without
~/.gitconfig (fresh machines, XDG-based config, system-only config)
hit a container start failure.
Add initializeCommand to create an empty ~/.gitconfig on the host
before the container starts. An empty gitconfig is valid and has no
side effects — git treats it as having no settings.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
- Default timezone to UTC instead of America/New_York
- Add shellcheck shell=bash directive to .zshrc
- Extract docker filter label into local variable in cmd_down
- Clarify mount filter comment (target paths immune to project name changes)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
A process inside the container could modify .devcontainer/devcontainer.json
to inject malicious mounts or initializeCommand entries that execute on the
host during the next rebuild. Bind-mounting .devcontainer/ as read-only
blocks this privilege escalation vector.
Uses startswith() for the jq filter to be precise and consistent with
other mount filters, and documents the SYS_ADMIN guard requirement.
Based on PR #12 with review feedback from @dguido addressed.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Dan Guido