The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The devcontainer is granted NET_ADMIN and NET_RAW capabilities. These are explicitly documented as being used to support network isolation tools (iptables, ipset) and security testing within the sandboxed environment.
[PRIVILEGE_ESCALATION]: The post_install.py script uses sudo to perform directory ownership fixes on mounted volumes. This ensures that the non-root vscode user can correctly access persistent data shared between the host and the container.
[EXTERNAL_DOWNLOADS]: The build process retrieves essential tooling from well-known and trusted sources, including Anthropic (Claude Code), Vercel (Fast Node Manager), and official GitHub releases for tools like fzf and git-delta. The Dockerfile uses SHA256 digests for base images to ensure supply chain integrity.
[COMMAND_EXECUTION]: The skill uses a postCreateCommand to run a configuration script (post_install.py). This script automates environment setup, such as configuring tmux, zsh aliases, and bypassing the Claude Code onboarding process when an OAuth token is available in the environment.
[COMMAND_EXECUTION]: The install.sh helper script (the devc command) facilitates container management on the host. It includes functions for rebuilding, stopping, and syncing session data, with explicit security checks such as ensuring SYS_ADMIN privileges are not inadvertently added to the configuration.

devcontainer-setup