devcontainer.json

{
    "name": "base-setup",
    "image": "mcr.microsoft.com/devcontainers/javascript-node:1-22-bookworm",
    "features": {
        "ghcr.io/devcontainers/features/common-utils:2": {
            "installOhMyZsh": true,
            "configureZshAsDefaultShell": true
        },
        "ghcr.io/devcontainers/features/docker-in-docker:2": {},
        "ghcr.io/devcontainers/features/sshd:1": {}
    },
    "workspaceMount": "source=/path/to/the/project/you/want/to/work/in/here,target=/workspace,type=bind",
    "workspaceFolder": "/workspace",
    "customizations": {
        "vscode": {
            "settings": {},
            "extensions": []
        }
    },
    "remoteUser": "node"
}

@w3cj Hi CJ! Found my way here via the Syntax video on Dev Containers, thanks for all the great work and contributions there.

I’m now using Dev Containers myself as a "glovebox" to stay safe from npm exploits, but I worry about "lab leaks"... i.e. accidentally running an install on my local instead of inside the container.

After some research (and a hand from Gemini), I found that mounting node_modules as a named volume keeps the host folder empty and the risk isolated:

// ISOLATION: node_modules stays in a Docker volume, not the host OS
"source=${localWorkspaceFolderBasename}-node_modules,target=${containerWorkspaceFolder}/node_modules,type=volume"

I'd appreciate your insights on this as a part of a security setup, is my understanding of volume mounting for isolation on the right track and/or are there other patterns or approaches you’d recommend instead? Thanks very much.