Customization

Apply these from outside the cage, on your Docker host. Inside, the repo is mounted read-only.

Allowlist

(Host) One table per host: the ports the firewall permits outbound and, optionally, the secret the proxy injects.

nano .devcontainer/config.toml

Apply, both because they share a network namespace:

docker compose [-f .devcontainer/compose.yaml] restart gateway proxy

Features

(Host) The tools layered onto the base image. Add, remove, or version them in the features block:

nano .devcontainer/devcontainer.json

(VSCode) Then rebuild:

Dev Containers: Rebuild and Reopen in Container

See also: Hansehart features, Official devcontainers features, Full community index

Git identity

(Host) The Dev Containers extension forwards your ~/.gitconfig into the container. Make sure it exists:

git config --global user.name "Your Name"
git config --global user.email "your@email.com"

Resource limits

(Host) Set the cage's memory and cpus under deploy.resources.limits:

nano .devcontainer/compose.yaml

deploy:
  resources:
    limits:
      memory: 8G
      cpus: 4

(VSCode) Then rebuild:

Dev Containers: Rebuild and Reopen in Container

Secrets

(Host) Real tokens stay on your Docker host. Every secret that .devcontainer/config.toml declares gets an empty slot on start; fill in the value:

nano ~/.config/o3s/secrets.env

ANTHROPIC_API_KEY=...
OPENAI_API_KEY=...

Save, and the proxy picks it up: it reloads the file when it changes, and swaps the token in on egress. Keep your own values here, as .devcontainer/.env is regenerated on every start.

Workspace

(Host) Add each project you clone into ~/projects to the folders array, to work on them side by side:

nano .devcontainer/o3s.code-workspace

{
    "name": "myproject",
    "path": "../../projects/myproject"
}