dev-environment
The wrapper that only looked for two
A devcontainer rebuild failure on Apple Silicon traced back to a browser launcher that matched x86 and legacy Chromium cache paths but missed ARM64.
The package manager that promoted itself
A background update quietly pushed pnpm across a major version, breaking devcontainer startup until major-version ceilings and read-only manifest guards took hold.
The server that ran somewhere else
Wiring up Sentry hosted Model Context Protocol server inside the devcontainer, routing remote HTTPS queries through the egress firewall, and keeping access tokens out of version control.
Three aliases, one posture
Fixing a mount-namespace bug that broke git worktrees across autonomous CLI aliases, dropping phantom sandboxes, and persisting workspace ownership across container rebuilds.
Primary sources behind the firewall
Opening outbound access for primary compliance documentation through the devcontainer firewall, balancing a default-deny sandbox with authoritative research.
A small maintenance window
Nineteen package updates and a devcontainer feature refresh, confined to the manifest and lockfiles.
Gone by the next restart
A prototyping rule edited straight into an installed third-party skill file looked shipped, until a devcontainer restart quietly reverted it, for two reasons the agent had missed.
The second watcher that never started
A silent host-sleep protection gap surfaces when two devcontainers run at once, traced to a lock file scoped by project instead of by workspace, and fixed by mirroring a sibling repository that had already solved it.
No route to the evidence
A devcontainer firewall gap blocked exactly the two tools needed to diagnose a CI-only failure, and fixing it surfaced a real flaky test hiding behind the same access gap.
Thirty-three components in isolation
Adopting a zero-mock Storybook catalog for reusable Svelte components, defining the two-importer scope boundary, and enforcing story coverage in CI.