Opinionated dev container configurations built on Bare Dev Container Images, combining hardened defaults, persistent toolchain caches, and stack-specific editor integration.
Development containers are part of the trusted development environment, yet unverified base images, excessive privileges, and costly rebuilds can expand both software supply-chain and runtime risk—and delay the adoption of security updates. These templates are designed so that projects can rebuild frequently, and pick up security updates promptly, without sacrificing day-to-day usability.
Goals
- Supply-chain security — built on Bare Dev Container Images, which limit trusted upstreams to official sources to minimize supply-chain risk.
- Security hardening — each template follows container security best practices such as running as a non-root user and restricting container privileges, minimizing the attack surface of the development environment.
- Fast, frequent rebuilds — each toolchain's primary cache directories are persisted as volumes, so rebuilding to pick up security updates doesn't require re-downloading or recompiling dependencies.
- Out-of-the-box editor support — compilers/toolchains are paired with the relevant LSP and official VS Code extensions/settings, so the environment is ready to use immediately.
Templates
Each template targets a single toolchain and corresponds to one ghcr.io/bare-devcontainer/<image> base image. If your stack isn't listed — or you prefer to compose your own with Dev Container Features — start with Debian.
| Template | Registry | Description |
|---|---|---|
| Bun | ghcr.io/bare-devcontainer/templates/bun |
Security-focused Bun dev container for JS/TS with hardened defaults and cached installs. |
| Debian | ghcr.io/bare-devcontainer/templates/debian |
Security-focused minimal Debian base for any stack, with hardened, non-root defaults. |
| Deno | ghcr.io/bare-devcontainer/templates/deno |
Security-focused Deno dev container for JS/TS with hardened defaults and cached modules. |
| Go | ghcr.io/bare-devcontainer/templates/golang |
Security-focused Go dev container with hardened defaults and rebuild-friendly caches. |
| mise | ghcr.io/bare-devcontainer/templates/mise |
Security-focused mise dev container for multiple runtimes, with cached tool installs. |
| Node.js | ghcr.io/bare-devcontainer/templates/node |
Security-focused Node.js dev container for JS/TS with non-root defaults and Corepack. |
| OpenTofu | ghcr.io/bare-devcontainer/templates/opentofu |
Security-focused OpenTofu dev container with tofu-ls and a plugin cache volume. |
| Rust | ghcr.io/bare-devcontainer/templates/rustup |
Security-focused Rust dev container with rust-analyzer and persistent Cargo caches. |
| Terraform | ghcr.io/bare-devcontainer/templates/terraform |
Security-focused Terraform dev container with terraform-ls and a plugin cache volume. |
| Python (uv) | ghcr.io/bare-devcontainer/templates/uv |
Security-focused Python dev container with uv, hardened defaults, and cached packages. |
| Zig | ghcr.io/bare-devcontainer/templates/zig |
Security-focused Zig dev container with zls integration and a persistent build cache. |
Each template page documents its options, security defaults, persisted caches, and editor integration.
Getting Started
These templates follow the Dev Container specification, so they can be applied and opened with any tool that supports dev containers. Two common ways to apply one:
VS Code
Open the Command Palette (F1) and run Dev Containers: Add Dev Container Configuration Files.... Choose Show All Definitions..., then search for Bare Dev Container to browse the available templates.
Once the configuration files are added, run Dev Containers: Reopen in Container to build and start the container.