devcontainers-cli module

[bpmct]

A discussion dedicated to the devcontainers-cli module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	20 / 20	12 / 20	7 / 10	67 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	README shows a single example with start_blocks_login = false. No documentation of alternative modes or what start_blocks_login = true changes in practice. The module has minimal options, but no "modes" section or multiple examples are provided.
Visual preview	5	0	No image, GIF, or video embedded in the README. The frontmatter references an SVG icon file, but no visual preview of the module in action is present.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The module defines no sensitive inputs. Variables are agent_id (string) and start_blocks_login (bool). No API keys, tokens, or credentials are involved. README example contains no inline secrets.
Non-hardcoded auth path	4	4	No authentication is required by this module. It installs a CLI tool via a package manager; no keys, tokens, or auth flows are involved. The concern does not arise.

Restricted-Environment Readiness — 12 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	run.sh hardcodes npm install -g @devcontainers/cli, pnpm add -g @devcontainers/cli, and yarn global add @devcontainers/cli. No module input variable overrides the registry URL or download source. No registry_url, npm_config_registry, or equivalent variable exists.
Bring-your-own binary	10	10	run.sh checks command -v devcontainer and exits 0 if found. README explicitly states: "It can be used within any workspace as it runs only if @devcontainers/cli is not installed yet." Pre-baking the binary into the image is a documented path to skip installation entirely.
Egress transparency	3	0	No dedicated README section enumerates external endpoints (e.g., registry.npmjs.org, get.pnpm.io). Endpoints are only visible in run.sh source code. No air-gapped or restricted-network guidance is provided.
Runs without sudo	2	2	run.sh never invokes sudo. It uses CODER_SCRIPT_BIN_DIR and CODER_SCRIPT_DATA_DIR (set by the Coder agent) for install paths, and yarn --prefix / PNPM_HOME to avoid root-owned directories. Works as an unprivileged user.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	3	agent_id has a type and description; start_blocks_login has type, default (false), and description. No validation blocks are present on either variable. Descriptions are clear but minimal.
Test coverage	4	4	main.test.ts provides end-to-end tests via runTerraformApply + executeScriptInContainer: covers missing package manager (error), npm install, yarn install, and missing-docker warning. Business logic paths are well covered. No .tftest.hcl present, but TypeScript tests satisfy the e2e requirement.

Overall — 67 / 100

Raw 45 / 67 → round(45 / 67 × 100) = 67

Track: Utility (devcontainers-cli is a CLI tool installer, not an AI agent or IDE)

---

Scored against SCORECARD.md on 2026-10-26 with solstice-1.