What is devcontainer-setup?

A setup tool for devcontainers, which are isolated development environments defined by project configuration files. It provides language-specific tools for Python, Node, Rust, or Go and can keep selected data in persistent volumes.

Use it to add development-container support, detect a project's language, generate configuration, and write the files into .devcontainer/.

It reduces differences between developers' machines and gives a project a repeatable development environment without changing its production deployment.

devcontainer-setup — Skill by RedHatProductSecurity

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/redhatproductsecurity/prodsec-skills/devcontainer-setup

Any agent

npx skills add RedHatProductSecurity/prodsec-skills --skill devcontainer-setup

Clone the repo

git clone --depth 1 https://github.com/RedHatProductSecurity/prodsec-skills

Made for: Claude Code, Codex.

Or install prodsec-skills, the plugin that ships this one along with the rest of its 44 skills.

Per session 41 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,822 The whole file, excluding the scripts and references it only reads on demand.

Security scan E 3 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00041	$0.02822
Opus 5	$0.00020	$0.01411
Sonnet 5	$0.00008	$0.00564
Haiku 4.5	$0.00004	$0.00282

Measured 3d ago against content hash cd0d63d512b9, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade E, and why

devcontainer-setup scanned grade E with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

RUN set -o pipefail && curl -fsSL https://example.com/install.sh | bash

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

rm -rf .venv && uv sync

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl \

module/skills/devcontainer-setup/SKILL.md · 428 lines

How it starts

The opening of the file, as written. The whole thing — 428 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Devcontainer Setup Skill

Creates a pre-configured devcontainer with language-specific tooling.

When to Use

User asks to "set up a devcontainer" or "add devcontainer support"
User needs isolated development environments with persistent configuration

When NOT to Use

User already has a devcontainer configuration and just needs modifications
User is asking about general Docker or container questions
User wants to deploy production containers (this is for development only)

Workflow

flowchart TB
    start([User requests devcontainer])
    recon[1. Project Reconnaissance]
    detect[2. Detect Languages]
    generate[3. Generate Configuration]
    write[4. Write files to .devcontainer/]
    done([Done])

    start --> recon
    recon --> detect
    detect --> generate
    generate --> write
    write --> done

Phase 1: Project Reconnaissance

Infer Project Name

Check in order (use first match):

package.json → name field
pyproject.toml → project.name
Cargo.toml → package.name
go.mod → module path (last segment after /)
Directory name as fallback

Convert to slug: lowercase, replace spaces/underscores with hyphens.

Detect Language Stack

Language	Detection Files
Python	`pyproject.toml`, `*.py`
Node/TypeScript	`package.json`, `tsconfig.json`
Rust	`Cargo.toml`
Go	`go.mod`, `go.sum`

Multi-Language Projects

If multiple languages are detected, configure all of them in the following priority order:

Python - Primary language, uses Dockerfile for uv + Python installation
Node/TypeScript - Uses devcontainer feature
Rust - Uses devcontainer feature
Go - Uses devcontainer feature

For multi-language postCreateCommand, chain all setup commands:

uv sync && npm ci

Extensions and settings from all detected languages should be merged into the configuration.

Phase 2: Generate Configuration

Start with base templates from the upstream plugin resources/ directory. (see upstream Trail of Bits prodsec-skills for companion files) Substitute:

Read the full file on GitHub · 428 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

3d ago First seen · 428 lines · 41 tokens per session scan E cd0d63d512b9

Subscribe to this mod's changes

devcontainer-setup is a skill published in the GitHub repository RedHatProductSecurity/prodsec-skills (52 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 41 tokens to every session and 2,822 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it E with 3 findings (downloads and executes remote code, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Containers DevOps and cloud developer_tooling

deploy-docker-compose

Run the Omnigent server as a Docker compose stack (server + Postgres) on any Docker host — your laptop, a VPS, EC2 by hand, or as the base layer of any container-platform deploy. Invoke when the user wants to build the image, bring up the compose stack, debug the stack on a host they already have, or extend the stack…

omnigent-ai/omnigent · 84 tokens

reproduce-issue

The single skill for reproducing an nx issue. Given a GitHub issue number (human entry) OR explicit repro parameters (agent entry), it runs the reproduction ENTIRELY inside an isolated Docker sandbox — gVisor on Linux, the Docker VM on macOS — so the untrusted repro's install scripts and commands never execute on the…

nrwl/nx · 91 tokens

timoni

Use when deploying applications to Kubernetes with Timoni. Covers installing and upgrading module instances from OCI registries, composing multi-app deployments with bundles, injecting values from clusters or CI with runtimes, targeting multiple clusters, and authoring, testing, signing and publishing modules with CUE.

stefanprodan/timoni · 59 tokens

devcontainer-setup