Environment Variables
Variables reach the container two ways:
- Host-sourced — read from a host environment variable with a per-project
prefix (
MY_PROJECT_VARNAME) exported by .devcontainer/env.sh and mapped
in devcontainer.json via ${localEnv:MY_PROJECT_VARNAME}. Inside the
container they are available under their canonical names shown below. These
rows are marked env.sh in the Source column. .devcontainer/env.sh is safe
to commit and is tracked in git (it is not gitignored): it holds only
1Password op:// references, never raw secret values — secrets are resolved
by op read when you source the file and are never written into it.
- Set directly in
devcontainer.json — a fixed literal value or a
${containerWorkspaceFolder} / ${localWorkspaceFolderBasename} expansion,
with no host variable involved. These rows are marked devcontainer.json and
do not use the MY_PROJECT_ prefix.
The Required column uses — for variables that are always set automatically
(by devcontainer.json or the Dockerfile) and need no per-project input. Yes
means you must populate it for the container to work as intended; If <X> means
it is required only when using that platform/feature.
See Per-Project Variable Isolation
for how the prefix is derived and why it is required.
| Variable (in container) |
Required |
Purpose |
Source |
GIT_USER_NAME |
Yes |
Git commit author name |
env.sh |
GIT_USER_EMAIL |
Yes |
Git commit author email |
env.sh |
GIT_SIGNING_KEY |
No |
SSH key fingerprint for commit signing |
env.sh |
GIT_PLATFORM |
Yes |
Active git platform: github, gitea, or gitlab |
env.sh |
GIT_TERMINAL_PROMPT |
— |
Set to 0 in devcontainer.json — git fails fast instead of prompting |
devcontainer.json remoteEnv |
GITHUB_TOKEN |
If GitHub |
Fine-grained GitHub PAT — gh CLI + Renovate + HTTP credential helper |
env.sh |
GITHUB_COM_TOKEN |
— |
Mirrors GITHUB_TOKEN (set in devcontainer.json); used by Renovate dry-runs |
devcontainer.json remoteEnv |
GITEA_TOKEN |
If Gitea |
Gitea personal access token — HTTP credential helper; never written to disk |
env.sh |
GITEA_URL |
If Gitea |
Gitea instance URL (e.g. https://gitea.example.com) |
env.sh |
GITLAB_TOKEN |
If GitLab |
GitLab personal access token — HTTP credential helper; never written to disk |
env.sh |
GITLAB_URL |
If GitLab |
GitLab instance URL (e.g. https://gitlab.example.com) |
env.sh |
GIT_USER_NAME, GIT_USER_EMAIL, and GIT_PLATFORM are active out of the box.
GIT_SIGNING_KEY and the platform token/URL variables ship commented out in
env.sh/devcontainer.json — uncomment the row for your platform. In this repo's
own .devcontainer/ only, GITHUB_TOKEN/GITHUB_COM_TOKEN are left active.
Egress and proxy
| Variable (in container) |
Required |
Purpose |
Source |
EGRESS_ALLOWLIST |
Yes |
Path to the project egress allowlist file |
devcontainer.json remoteEnv |
PROXY_YAML |
No |
Path to the HTTP/HTTPS domain allowlist (default: .devcontainer/proxy.yaml) |
devcontainer.json remoteEnv |
HTTP_PROXY / HTTPS_PROXY / http_proxy / https_proxy |
— |
All four set to http://127.0.0.1:8080 — every app HTTP/HTTPS request enters the chain at mitmproxy. Full path: app → mitmproxy:8080 (TLS inspect) → privoxy:8888 (domain allowlist) → internet. Both upper- and lowercase variants cover curl, pip, Go, Java, Node.js, etc. Never unset or override these |
devcontainer.json remoteEnv |
NO_PROXY / no_proxy |
— |
Comma-separated bypass list (default: 127.0.0.1,localhost,::1) |
devcontainer.json remoteEnv |
NODE_EXTRA_CA_CERTS |
— |
Points to system CA bundle so Node.js trusts the mitmproxy CA |
Dockerfile ENV |
Container identity and runtime
| Variable (in container) |
Required |
Purpose |
Source |
CONTAINER_NAME |
No |
Friendly name shown in shell prompt and monitor title |
devcontainer.json remoteEnv |
WORKSPACE_DIR |
No |
Workspace mount path (default: /workspaces) — set from ${containerWorkspaceFolder} |
devcontainer.json remoteEnv |
SSH_AUTH_SOCK |
— |
Path to the forwarded 1Password SSH agent socket (/run/host-services/ssh-auth.sock) |
devcontainer.json remoteEnv |
TF_PLUGIN_CACHE_DIR |
— |
Terraform provider plugin cache directory (/home/vscode/.terraform.d/plugins) |
devcontainer.json remoteEnv |
DEVCONTAINER |
— |
Set to 1 to mark the dev-container environment |
devcontainer.json remoteEnv |
mise
| Variable (in container) |
Required |
Purpose |
Source |
MISE_GLOBAL_CONFIG_FILE |
— |
Path to mise global config (default: ~/.mise.toml) |
Dockerfile ENV |
MISE_TRUSTED_CONFIG_PATHS |
— |
Colon-separated paths mise trusts without prompting |
Dockerfile ENV |
| Variable (in container) |
Required |
Purpose |
Source |
OCI_CLI_REGION |
If OCI |
OCI region (e.g. us-ashburn-1) |
env.sh |
OCI_CLI_TENANCY |
If OCI |
OCI tenancy OCID |
env.sh |
OCI_CLI_USER |
If OCI |
OCI user OCID |
env.sh |
OCI_CLI_FINGERPRINT |
If OCI |
OCI API key fingerprint |
env.sh |
OCI_CLI_KEY_CONTENT |
If OCI |
OCI private key PEM content (read from 1Password, never written to disk) |
env.sh |
OCI_CLI_AUTH |
If OCI |
Set to api_key so the OCI SDK uses the API key from env (not instance principal). Shipped commented-out in devcontainer.json — uncomment alongside the other OCI rows |
devcontainer.json (commented) |
PROXMOX_VE_ENDPOINT |
If Proxmox |
Proxmox cluster API URL |
env.sh |
GOVC_URL |
If vSphere |
vCenter SDK URL |
env.sh |
Secrets (optional)
The OpenBao rows are shipped commented-out in devcontainer.json. Uncomment
them to use the bao CLI against an OpenBao server. Also add the server hostname
to proxy.yaml and egress-allowlist.txt.
| Variable (in container) |
Required |
Purpose |
Source |
BAO_ADDR |
If OpenBao |
OpenBao server API address (e.g. https://openbao.example.com:8200) |
env.sh |
BAO_TOKEN |
If OpenBao |
OpenBao auth token (read from 1Password, never written to disk) |
env.sh |
BAO_CACERT |
No |
In-container path to the server CA cert for self-signed TLS |
env.sh |
Observability (optional)
The OpenTelemetry block is shipped commented-out in devcontainer.json.
Uncomment the rows you need to have the Claude Code CLI export traces, metrics,
and log events natively. When enabled, the host values are populated through
MY_PROJECT_-prefixed variables in .devcontainer/env.sh. See
ADR 0013.
| Variable (in container) |
Required |
Purpose |
Source |
CLAUDE_CODE_ENABLE_TELEMETRY |
No |
Set 1 to enable Claude Code CLI OTEL export |
devcontainer.json (commented) |
CLAUDE_CODE_ENHANCED_TELEMETRY_BETA |
No |
Opt into the enhanced telemetry beta |
devcontainer.json (commented) |
OTEL_TRACES_EXPORTER |
No |
Traces exporter (e.g. otlp) |
devcontainer.json (commented) |
OTEL_METRICS_EXPORTER |
No |
Metrics exporter (e.g. otlp) |
devcontainer.json (commented) |
OTEL_LOGS_EXPORTER |
No |
Log-events exporter (e.g. otlp) |
devcontainer.json (commented) |
OTEL_EXPORTER_OTLP_PROTOCOL |
No |
OTLP wire protocol (e.g. http/protobuf, grpc) |
devcontainer.json (commented) |
OTEL_EXPORTER_OTLP_ENDPOINT |
No |
OTLP collector URL (required when telemetry is enabled) |
devcontainer.json (commented) |
OTEL_EXPORTER_OTLP_HEADERS |
No |
Extra OTLP headers (e.g. auth tokens) |
devcontainer.json (commented) |
OTEL_SERVICE_NAME |
No |
Service name reported to the collector |
devcontainer.json (commented) |
ANTHROPIC_API_KEY |
No |
Claude API key (use op run instead where possible) |
op run |