Devbox anywhere

Produce a devbox/ for the project you are standing in: one container, three ways in, carrying the toolchain this repository actually needs.

Every tool in the image must be justified by a file in the repo. If you cannot point at the manifest, lockfile, config, or script that needs it, it does not go in. An image full of speculative tooling is slow to build, expensive to maintain, and hides what the project really depends on.

Never forward a host secret into the container. Read references/security.md before writing any compose file. This is not negotiable and the convenient shortcut is the wrong answer.

Workflow

Copy this checklist and check off each step: