Secure Dev Container for Untrusted Code Review

A hardened devcontainer configuration for safely reviewing potentially malicious code in Cursor/VS Code.

Features

• 🔒 Network isolated - No outbound connections from container
• 📁 Read-only filesystem - Container can't be modified
• 🚫 Dropped capabilities - No privilege escalation
• 💾 Resource limits - Prevents fork bombs and memory exhaustion
• 🛡️ No credential leakage - Git/SSH credentials stay on host
• 🤖 AI-assisted review - Cursor/Copilot still works (runs on host)

Setup

Create .devcontainer/ folder in your project with these two files:

devcontainer.json

{
  "name": "Secure Code Review Sandbox",
  "build": {
    "dockerfile": "Dockerfile"
  },
  
  "remoteUser": "sandbox",
  "workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind,readonly",
  "workspaceFolder": "/workspace",
  
  "customizations": {
    "vscode": {
      "settings": {
        "security.workspace.trust.enabled": true,
        "security.workspace.trust.untrustedFiles": "open",
        "task.allowAutomaticTasks": "off",
        "git.enabled": false,
        "git.autofetch": false,
        "terminal.integrated.inheritEnv": false,
        "extensions.autoUpdate": false,
        "extensions.autoCheckUpdates": false,
        "npm.autoDetect": "off",
        "typescript.disableAutomaticTypeAcquisition": true
      },
      "extensions": [
        "oderwat.indent-rainbow",
        "aaron-bond.better-comments"
      ]
    }
  },
  
  "postCreateCommand": "echo '⚠️  SANDBOX MODE - Network disabled, filesystem read-only. Run LLM security scan with @workspace prompt.'",
  
  "runArgs": [
    "--cap-drop=ALL",
    "--security-opt=no-new-privileges",
    "--network=none",
    "--read-only",
    "--memory=2g",
    "--memory-swap=2g",
    "--pids-limit=256",
    "--tmpfs=/tmp:rw,noexec,nosuid,size=256m"
  ]
}

Dockerfile

FROM node:20-slim

RUN useradd -m -s /bin/bash sandbox \
    && apt-get update \
    && apt-get install -y --no-install-recommends \
        less \
        file \
    && rm -rf /var/lib/apt/lists/* \
    && rm -rf /root/.npm /root/.node-gyp

USER sandbox
WORKDIR /workspace

🤖 LLM Security Scan Prompt

Once the container is running, use this prompt in Cursor's AI chat (Cmd+L / Ctrl+L):

@workspace Perform a security audit of this codebase. Look for:

1. **Malicious patterns**
   - Obfuscated code (eval, Function constructor, atob/btoa chains)
   - Data exfiltration (fetch/axios to external URLs, process.env access)
   - Credential harvesting (keyloggers, form hijacking)
   - Crypto miners or botnet code

2. **Supply chain risks**
   - Suspicious postinstall/preinstall scripts in package.json
   - Typosquatted dependencies
   - Pinned versions pointing to compromised releases
   - Git hooks that execute code

3. **Backdoors**
   - Hidden API endpoints
   - Hardcoded credentials or tokens
   - Base64 encoded payloads
   - Unusual network connections

4. **File system risks**
   - Code that reads ~/.ssh, ~/.aws, ~/.gitconfig
   - Writes outside project directory
   - Accesses browser profiles or cookies

Report findings with file paths and line numbers. Rate overall risk: LOW / MEDIUM / HIGH / CRITICAL

Quick Scan (shorter version)

@workspace Security scan: Look for eval(), obfuscated code, postinstall scripts, 
external network calls, credential access (~/.ssh, ~/.aws, env vars), and 
base64 encoded strings. List suspicious files with line numbers.

Security Flags Explained

Flag	Purpose
--cap-drop=ALL	Remove all Linux capabilities
--security-opt=no-new-privileges	Prevent privilege escalation via setuid/setgid
--network=none	Complete network isolation
--read-only	Immutable container filesystem
--memory=2g	Cap memory to prevent exhaustion
--pids-limit=256	Prevent fork bombs
--tmpfs=/tmp:noexec	Temp dir exists but can't execute binaries

Why LLM Still Works

The network isolation (--network=none) only affects processes inside the container. Cursor/VS Code AI features run on your host machine and connect to AI APIs from there. The container just provides the sandboxed filesystem view.

┌─────────────────────────────────────────┐
│  Your Machine (Host)                    │
│  ┌───────────────────┐                  │
│  │ Cursor/VS Code    │◄──► AI APIs ✅   │
│  │ (has network)     │     (Claude,     │
│  └────────┬──────────┘      OpenAI)     │
│           │                             │
│  ┌────────▼──────────┐                  │
│  │ Dev Container     │                  │
│  │ --network=none    │◄──► Internet ❌  │
│  │ (isolated)        │                  │
│  └───────────────────┘                  │
└─────────────────────────────────────────┘

Variations

Allow editing (not just viewing)

Remove readonly from the workspace mount:

"workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind",

Multi-language (no Node)

Replace the Dockerfile with:

FROM debian:bookworm-slim

RUN useradd -m -s /bin/bash sandbox \
    && apt-get update \
    && apt-get install -y --no-install-recommends \
        less \
        file \
        tree \
    && rm -rf /var/lib/apt/lists/*

USER sandbox
WORKDIR /workspace

Usage

1. Clone/download untrusted repo to a folder
2. Add .devcontainer/ folder with these files
3. Open folder in Cursor/VS Code
4. "Reopen in Container" when prompted
5. Run LLM security scan with prompt above
6. Manually review flagged files

⚠️ Limitations

• Cannot install dependencies (npm install, pip install, etc.)
• Cannot run the code (by design - static analysis only)
• LLM may miss sophisticated obfuscation
• For dynamic analysis, use a VM instead

Checklist Before Trusting Code

• LLM scan completed
• Reviewed all postinstall/preinstall scripts
• Checked for obfuscated/minified source files
• Verified dependencies against known packages
• No suspicious file system access patterns
• No hardcoded external URLs or IPs

---

Created for safe code review workflows. Contributions welcome.