Security-focused Rust dev container with rust-analyzer, persisted toolchains and caches.

See Getting Started in the repository README for how to apply this template.

The imageVariant option selects the tag of the ghcr.io/bare-devcontainer/rustup base image, which tracks the Debian release: trixie is Debian 13 and bookworm is Debian 12.

The values offered when applying the template are proposals, not a closed list — any published tag can be entered, including narrower ones such as a rustup version or a dated build for tighter pinning. See the published tags for what is currently available.

This template applies the shared hardening defaults of Bare Dev Container Templates:

• Builds on ghcr.io/bare-devcontainer/rustup, a minimal image from bare-devcontainer/images with pinned digests, SLSA provenance, and an SPDX SBOM for supply-chain transparency.
• Runs as the non-root dev user.
• Drops all Linux capabilities (--cap-drop=ALL) and sets the no-new-privileges security option, so processes cannot gain elevated privileges inside the container. Remove no-new-privileges from securityOpt if you need su/sudo.
• Starts an init process ("init": true) to reap zombie processes.

After applying the template, we recommend pinning the image to a digest so every rebuild uses exactly the image you expect — see Pinning Images to a Digest.

The image ships no Rust toolchain. A toolchain pinned in rust-toolchain.toml is installed on the first cargo or rustc run; otherwise, install one with rustup default stable.

Installed toolchains and Cargo's download caches are persisted in named volumes, so rebuilding the container to pick up image updates doesn't require re-downloading them. Bash history is persisted the same way, so a rebuild doesn't clear it:

A rebuild keeps the toolchains as they are, so it neither updates them (run rustup update) nor discards changes made to them from inside the container, for example by a build script. To download them afresh on every rebuild, remove the /home/dev/.rustup mount.

~/.cargo/bin is not persisted, so binaries installed with cargo install do not survive a rebuild.

The image sets HISTFILE to /home/dev/.local/state/bash/history rather than the default ~/.bash_history, so bash writes into the volume.

• Installs the rust-lang.rust-analyzer VS Code extension, with format-on-save enabled for Rust files.
• Forks of VS Code (Cursor, Windsurf, VSCodium, code-server) read the same customizations.vscode block, but resolve extension IDs against Open VSX rather than the Visual Studio Marketplace, where availability depends on the publisher having opted in.
• Editors without dev container integration (Neovim, Helix, Emacs, ...) can attach to the running container with devcontainer exec --workspace-folder . <command> and use the tooling in the image directly. The image ships only rustup, so add the language server to the toolchain first with rustup component add rust-analyzer; it then resolves through /home/dev/.cargo/bin, which is on PATH.

• To use the debugger, uncomment "capAdd": ["SYS_PTRACE"] in devcontainer.json.
• If you use VS Code, uncomment the remoteEnv block in devcontainer.json to open $EDITOR/$VISUAL/$GIT_EDITOR (e.g. git commit) in a VS Code tab.
• To add a directory to PATH through remoteEnv, keep /home/dev/.cargo/bin in the value, as in "PATH": "/home/dev/.cargo/bin:<your-dir>:${containerEnv:PATH}". The image puts /home/dev/.cargo/bin on PATH through a remoteEnv entry of its own, which a PATH set in devcontainer.json replaces rather than extends.

Note: This file was auto-generated from the devcontainer-template.json. Add additional notes to a NOTES.md.