菜单
Bring the devcontainer up/down/build, run tier 1-3 smoke checks, and respect the thin host-user overlay invariant. Use when working with .devcontainer/, mise tasks, or the @devcontainers/cli.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Prepare for a /clear: bring all documentation up to date with this session's changes, persist recovery context (memory + handoff), and emit a copy-paste resume prompt so the next session begins the next task with zero context loss. Invoke explicitly as /clear-prep [next-task].
Use when adding or modifying a devcontainer feature in devcontainer.json - fetch its devcontainer-feature.json schema first and verify every option key exists, because features silently drop unknown options.
Use when creating branches, commits, pushes, or PRs with plain git. Branch BEFORE committing — never commit directly onto the default branch. Avoids virtual-branch composition bugs where commits silently depend on other applied branches.
Write a CROSS-SURFACE session handoff to a tracked path and push it, so a session on another surface (web, desktop, or CLI) can continue with zero context loss. Use when ending a session whose work must be picked up on a DIFFERENT machine/surface. For same-machine /clear continuity use /clear-prep instead. Invoke as /handoff [next-task].
Use when running parallel-scientist research - ALWAYS follow with an opus verification stage that re-probes load-bearing claims and surfaces gaps. Skipping the verifier almost shipped a wrong recommendation in session 2026-04-07e.
Use when sharing a single `~/.ssh/config` across macOS + Linux - apply OpenSSH `IgnoreUnknown` to tolerate macOS-only directives (`UseKeychain`, `AddKeysToAgent`) on Linux where they would otherwise be fatal.
| name | devcontainer-workflow |
| description | Bring the devcontainer up/down/build, run tier 1-3 smoke checks, and respect the thin host-user overlay invariant. Use when working with .devcontainer/, mise tasks, or the @devcontainers/cli. |
The dotfiles devcontainer has two layers:
ghcr.io/ray-manaloto/dotfiles-devcontainer:dev) — built by
CI from .devcontainer/Dockerfile + .devcontainer/mise-system.toml.
Ships every tool needed inside the container at image-build time..devcontainer/Dockerfile.host-user) — adds the host
user (UID/GID/name) on top of the base image. Must stay ≤ 89 lines
(baseline 79 + 10 cap, enforced by hk step dockerfile_host_user_thin_overlay).The user-facing workflow is mise run up → work inside → mise run down.
mise run build # docker buildx bake dev-load (build base image locally)
mise run up # devcontainer up --workspace-folder . (CLI pinned in mise.toml)
mise run down # alias of `mise run stop` — tears the container down
mise run stop # docker rm -f filtered on devcontainer.local_folder=$PWD
# (the devcontainer CLI has no `down` verb)
mise run test # uv run --project python pytest tests/ -x -q (HOST tests)
mise run pre-commit # hk run pre-commit --all
scripts/devcontainer-smoke.sh # tiers 1-3 (assumes already up)
scripts/devcontainer-smoke.sh --include-up # also runs `devcontainer up` first
Tiers:
mise ls, which clang++ python uv hk, hk run pre-commit --allpytest 190/190, stat ~/.ssh ~/.claude /workspaces/dotfilesclang++ -fsanitize=address,undefined hello.cc && ./helloTier 4 (CLion remote toolchain) is manual.
mise run smoke-exec is a complementary containerized real-toolchain
exec gate (tests/test_image_smoke_exec.py, marked image_exec): it runs
the python-generated tier-1/tier-3 smoke cores against the local :dev
image and asserts both the happy path and a tampered FAIL. It's deselected
from the default mise run test (root pytest.ini) and needs Docker + a
current :dev (mise run sync).
Never grow Dockerfile.host-user beyond 89 lines. Add capabilities via
Devcontainer Features or devcontainer.json mounts, never new RUN steps.
The hk step dockerfile_host_user_thin_overlay will block the commit.
Never render the chezmoi mise overlay on the Mac host.
home/dot_config/mise/config.toml.tmpl is gated by home/.chezmoiignore
on the built-in chezmoi.os fact: {{ if ne .chezmoi.os "linux" }}.
This is the canonical chezmoi pattern for multi-machine differences (see
.claude/rules/use-tool-builtins.md). Do not reintroduce a custom
is_container data variable or env-var detection — that was reverted in
the C10 refactor. The CI lint job has an "Assert chezmoiignore mise
overlay hard gate" step that machine-checks this on every PR — do not
weaken it. Belt-and-suspenders: .claude/settings.json blocks
chezmoi apply/chezmoi update on the host until Mac integration ships.
See memory feedback_devcontainer_only_mise_overlay.md.
Tool installs go in .devcontainer/mise-system.toml (image build) only.
home/.chezmoiscripts/ was deleted in the devcontainer-build refactor —
chezmoi scripts must never install tools. See memory
feedback_chezmoi_scripts_no_tool_install.md.
Chezmoi bootstrap lives at onCreateCommand.
.devcontainer/scripts/on-create.sh runs chezmoi init --apply from the
workspace bind-mount (it replaced the old install.sh postCreate
bootstrap). postCreateCommand handles the SSH agent-socket chown +
authorized keys + smoke — keep the chezmoi step at onCreate.
The async image-analysis.yml workflow (triggered on CI success via
workflow_run) emits artifacts/build/devcontainer-metrics.json (benchmark
fields; compressed size now read from the registry manifest, not
docker save | gzip). The PR-blocking smoke-test job runs only smoke +
Dive and no longer emits metrics.
mise.toml — [tasks.up], [tasks.stop], [tasks.build], alias downhk.pkl — dockerfile_host_user_thin_overlay step.github/workflows/ci.yml — hard-gate assertion (lint job) + tier 1-3 smoke + Dive (smoke-test job).github/workflows/image-analysis.yml — async benchmark + Trivy (on CI success)home/.chezmoiignore — the gate itselfscripts/devcontainer-smoke.sh — shared tier runner