VSCode should allow opening a devcontainer by cloning instead of mounting a local clone

Open
#317,971 0 comments 0 reactions 1 assignee View on GitHub

@chrmarti is already working on this.

Since May 22, 2026.

Assessment

This issue has not been assessed yet.

Description

As a mitigation against supply chain attacks, devcontainers can be really powerful. However, the current VSCode implementation appears to require that I first pull my code onto the machine and then mount it.

It is then easy to think "I'll just quickly run this" and pull in a supply chain attack vector and lose all the protection.

Currently I can either clone and use the devcontainer file in the repo (no personalisation) OR use a local devcontainer file and mount.

I would like to be able to start a devcontainer from a local file (because I have my own settings which are not in the repo file), AND specify the clone address.

Dominant language
TypeScript
Stars
193k
Forks
42.9k
PR metrics pending

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/vscode

All issues in microsoft/vscode

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.