v0.1.0
Initial public release. A programmatic Go runtime for Dev Containers — resolve, build, up, exec, lifecycle, down — embeddable into Go applications without shelling out to @devcontainers/cli.
Install
go get github.com/crunchloop/devcontainer@v0.1.0Requires Go 1.25+, a Docker daemon socket, and (for compose sources) Docker Compose v2.
Highlights
- Sources —
image,build(Dockerfile + args/target/cacheFrom),dockerComposeFilewith override-file generation. - Features — OCI / HTTPS / local resolvers, content-addressed cache, DAG ordering (
dependsOn/installsAfter/overrideFeatureInstallOrder), pre-baked-image hot path via thedevcontainer.metadatalabel. - Container config —
mounts,runArgs,containerEnv,remoteEnv,containerUser,remoteUser,updateRemoteUserUID(portable: Debian + Alpine),userEnvProbe(all four modes),init,privileged,capAdd,securityOpt,overrideCommand,shutdownAction. - Lifecycle — all six phases (
initializeCommand,onCreateCommand,updateContentCommand,postCreateCommand,postStartCommand,postAttachCommand) withwaitFor, parallel command form, versioned idempotency markers; host-sideinitializeCommand/secretsCommandrun via an opt-inHostExecutor. - Substitution — full two-pass:
${localWorkspaceFolder[Basename]},${containerWorkspaceFolder[Basename]},${localEnv:VAR[:default]},${containerEnv:VAR[:default]},${devcontainerId}. - Image metadata —
devcontainer.metadatalabel written on build and merged on subsequentUp/Attach(last-write-wins scalars, union+dedup slices, per-phase append for lifecycle hooks). - Events — experimental
eventspackage withEventmarker interface, monotonicSeq()+Time(), 21 concrete types across config / feature / build / container / lifecycle / exec / engine groups. - Customizations —
customizations.<tool>pass-through asmap[string]json.RawMessage.
Known limitations
forwardPorts/portsAttributesare parsed and surfaced but not actuated.- No
devcontainer-lock.jsonproduced or honored. - No SSH / GPG agent forwarding by default.
- The
eventspackage is experimental until v1.0.0; type shapes may evolve without a SemVer-major bump.
Changelog
See CHANGELOG.md.
Security
Report vulnerabilities privately via GitHub security advisories. See SECURITY.md for details.