diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
new file mode 100644
index 000000000..7ca38f86d
--- /dev/null
+++ b/.devcontainer/Dockerfile
@@ -0,0 +1,30 @@
+FROM mcr.microsoft.com/devcontainers/base:ubuntu-24.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    bash \
+    build-essential \
+    ca-certificates \
+    curl \
+    dbus-x11 \
+    git \
+    gnome-keyring \
+    jq \
+    less \
+    openssh-client \
+    pkg-config \
+    shellcheck \
+    sudo \
+    tmux \
+    unzip \
+    xz-utils \
+    zip \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN curl -fsSL https://mise.run | MISE_INSTALL_PATH=/usr/local/bin/mise sh
+
+ENV MISE_DATA_DIR=/home/vscode/.local/share/mise
+ENV PATH=/home/vscode/.local/share/mise/shims:/home/vscode/.local/bin:/home/vscode/go/bin:${PATH}
+
+USER vscode
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
new file mode 100644
index 000000000..3da960fa3
--- /dev/null
+++ b/.devcontainer/devcontainer.json
@@ -0,0 +1,25 @@
+{
+  "name": "Entire CLI",
+  "build": {
+    "dockerfile": "Dockerfile",
+    "context": ".."
+  },
+  "remoteUser": "vscode",
+  "postCreateCommand": "bash .devcontainer/post-create.sh",
+  "customizations": {
+    "vscode": {
+      "settings": {
+        "gopls": {
+          "build.buildFlags": [
+            "-tags=e2e,integration"
+          ]
+        },
+        "go.testTags": "e2e,integration"
+      },
+      "extensions": [
+        "golang.Go",
+        "timonwong.shellcheck"
+      ]
+    }
+  }
+}
diff --git a/.devcontainer/post-create.sh b/.devcontainer/post-create.sh
new file mode 100755
index 000000000..023a8e5c5
--- /dev/null
+++ b/.devcontainer/post-create.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd -- "${SCRIPT_DIR}/.." && pwd)"
+
+cd "${REPO_ROOT}"
+
+mise trust --yes
+mise install
diff --git a/.devcontainer/run-with-keyring.sh b/.devcontainer/run-with-keyring.sh
new file mode 100755
index 000000000..cf6e00ccf
--- /dev/null
+++ b/.devcontainer/run-with-keyring.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "$#" -eq 0 ]; then
+  set -- mise run test:ci
+fi
+
+if [ -z "${ENTIRE_DEVCONTAINER_KEYRING_PASSWORD:-}" ]; then
+  ENTIRE_DEVCONTAINER_KEYRING_PASSWORD="$(openssl rand -hex 16)"
+fi
+export ENTIRE_DEVCONTAINER_KEYRING_PASSWORD
+
+exec dbus-run-session -- bash -lc '
+  set -euo pipefail
+  printf "%s" "$ENTIRE_DEVCONTAINER_KEYRING_PASSWORD" | gnome-keyring-daemon --unlock >/dev/null
+  exec "$@"
+' bash "$@"
diff --git a/README.md b/README.md
index 962ee3a77..5d27380a7 100644
--- a/README.md
+++ b/README.md
@@ -462,6 +462,21 @@ mise trust
 mise run build
 ```
 
+### Dev Container
+
+The repo includes a `.devcontainer/` configuration that installs the system packages used by local development and CI (`git`, `tmux`, `gnome-keyring`, etc) and then bootstraps the repo's `mise` toolchain.
+
+Open the folder in a Dev Container, or start it from the `devcontainer` CLI as follows:
+
+```bash
+devcontainer up --workspace-folder .
+devcontainer exec --workspace-folder . bash -lc '.devcontainer/run-with-keyring.sh'
+```
+
+The container's `postCreateCommand` runs `mise trust --yes && mise install`, so Go, `golangci-lint`, `gotestsum`, `shellcheck`, and the canary E2E helper binaries are ready after creation. Use `.devcontainer/run-with-keyring.sh <command>` for commands that touch the Linux keyring, including `mise run test:ci`.
+
+If `ENTIRE_DEVCONTAINER_KEYRING_PASSWORD` is set in the environment, `.devcontainer/run-with-keyring.sh` uses that value to unlock the keyring non-interactively. If it is unset, the script generates a random password for the session automatically.
+
 ### Common Tasks
 
 ```