Installs into .claude/skills of the current project.
Sponsors
SSkills DirectorySkills Directory
Know which skills are safe — weekly.
SSkills DirectorySkills Directory
Is that skill safe to install?
Are you the author of Dev Environments?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/andreibesleaga-dev-environments)
---
name: dev-environments
description: "Set up, configure, and maintain local/remote development environments. Use when: setup dev environment, configure docker compose, build devcontainer."
license: CC-BY-SA-4.0
metadata:
source: "agents/skills/ops/dev-environments.skill.md"
tags: "ops"
core: "false"
context_cost: "medium"
---
# dev-environments
## Goal
Automate the setup, orchestration, and maintenance of identical development environments across the team (using DevContainers, DevSpace, or Docker Compose).
## Steps
1. **Analyze Requirements**: Parse the `PLAN.md` to identify all necessary languages, databases, and dependencies.
2. **Configuration**: Generate `DEVCONTAINER_TEMPLATE.json` or `docker-compose.yml` defining the required services.
3. **Scripting**: Write setup scripts for seeding local databases and pulling necessary environment variables.
4. **Verification**: Run `docker-compose build` or equivalent to verify the environment spins up without errors.
## Security & Guardrails
### 1. Skill Security
- **Local Sandbox Escape**: Do not map the entire host filesystem to the container (e.g., `-v /:/host`). Bind-mount only the project directory.
- **Privileged Mode Veto**: Never run development containers with `--privileged` flags unless explicitly requested and warning the user of root compromises.
### 2. System Integration Security
- **Port Collision & Exposure**: Ensure local development environments do not accidentally bind ports to `0.0.0.0` on the host, exposing unauthenticated dev databases to the local LAN.
- **Production Secret Pollution**: The development setup scripts MUST use dummy/sample `.env` variables and verify they do not download production secrets.
### 3. LLM & Agent Guardrails
- **Dependency Hallucination**: The LLM must not inject outdated, unsigned/unverified third-party scripts into the Dockerfiles.
- **OS Bias**: Development environments must remain cross-platform (Linux/Mac/WSL). The LLM cannot implement a solution that breaks for developers not matching its assumed OS.
