OpenParable
Skip to content
← Back to skills

Run In Dev Container

DevOps & Security
run-in-dev-container

Run In Dev Container is an Agent Skill for devops & security published in the dfinity/ic repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Use when you need to run a command (build, test, tool) inside the IC dev container via ./ci/container/container-run.sh — including on a host that has Docker but not podman (set CONTAINER_RUNTIME=docker).

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/dfinity/ic/blob/HEAD/.claude/skills/run-in-dev-container/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/run-in-dev-container, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Running commands in the IC dev container

./ci/container/container-run.sh runs a command inside the pinned IC dev container (the ghcr.io/dfinity/ic-dev image), bind-mounting the repo checkout at /ic and reusing ~/.cache for the Bazel/cargo/zig caches.

Prefer running builds and build tooling through it: it gives you the exact, pinned toolchain environment, and standardizing on the container — regardless of whether it's backed by podman or docker — keeps things simple and consistent.

Choosing the container runtime

The script supports two runtimes, selected by the CONTAINER_RUNTIME env var:

  • podman (default) — rootful and privileged.
  • docker — for hosts that have the Docker daemon but no podman.

Which one to use depends on where you are:

  • namespace.so devboxes (e.g. this machine — test -d /.namespace): use docker. podman isn't available there, and the namespace.so daemon can't do some things podman's setup expects (e.g. bind-mounting the host's /tmp).
  • DFINITY infra, in particular a "devenv" machine (which container-run.sh detects via /var/lib/cloud/instance plus a /hoststorage mount): use podman — the default, so no env var needed.

On a docker host, prefix every invocation with CONTAINER_RUNTIME=docker:

# interactive shell in the container
CONTAINER_RUNTIME=docker ./ci/container/container-run.sh

# run a single command and exit
CONTAINER_RUNTIME=docker ./ci/container/container-run.sh <command> [args...]

If CONTAINER_RUNTIME is unsupported the script errors out early; if the chosen runtime's daemon isn't reachable it prints which command it tried.

Notes

  • The repo is mounted at /ic and that's the working directory, so invoke repo-local scripts with a relative path, e.g. CONTAINER_RUNTIME=docker ./ci/container/container-run.sh ./path/to/script.sh.
  • The image is pulled from ghcr.io on first use (large, one-time).
  • Anything the command writes under /ic (or ~/.cache) persists on the host, since those are bind-mounted.
  • Don't nest: the script refuses to run inside an existing container.