initial commit

.devcontainer/Dockerfile

@@ -0,0 +1,41 @@
+# One image for the whole stack, so every repo's toolchain is installed here.
+#
+# Start from the image of whichever toolchain is the most awkward to add by
+# hand, and add the others on top. The devcontainers images are at
+# mcr.microsoft.com/devcontainers/: base, go, typescript-node, python, rust,
+# java. The remote user is `vscode` on most of them and `node` on
+# typescript-node; keep USERNAME below in sync.
+FROM mcr.microsoft.com/devcontainers/base:bookworm
+ARG USERNAME=vscode
+
+# A second toolchain, copied from its official image. Pin the same version the
+# repo's CI uses.
+#
+# COPY --from=golang:1.26-bookworm /usr/local/go /usr/local/go
+# ENV GOPATH=/home/${USERNAME}/go
+# ENV PATH=/usr/local/go/bin:/home/${USERNAME}/go/bin:$PATH
+#
+# Watch out. `ENV PATH` alone is not enough: /etc/profile reassigns PATH
+# outright, so any login shell (VS Code terminals, and anything Claude Code
+# spawns) loses the toolchain. Other variables survive, only PATH needs
+# replaying:
+#
+# RUN printf 'export PATH=/usr/local/go/bin:${GOPATH:-$HOME/go}/bin:$PATH\n' \
+#         > /etc/profile.d/go.sh
+
+# Whatever the servers and their tests shell out to at runtime, plus the
+# packages the repos' own release images install.
+#
+# RUN apt-get update \
+#     && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+#         build-essential \
+#     && rm -rf /var/lib/apt/lists/*
+
+# Linters and package managers, at the versions CI pins.
+#
+# RUN su ${USERNAME} -c "npm install -g pnpm@10"
+
+# The repos are bind mounted as siblings under /workspaces, which is also the
+# workspace root. Create it here so it belongs to the remote user rather than
+# being left root-owned by the daemon creating the mount points.
+RUN mkdir -p /workspaces && chown ${USERNAME}:${USERNAME} /workspaces