Documented steps

Use onCreateCommand for first-time setup right after the container is created (e.g. system packages); in cloud services it may run before a user is assigned, so no user-scoped secrets are available
Use updateContentCommand for source-dependent installs (npm install, pip install -r requirements.txt); it runs after onCreateCommand and may re-run when new content is available (e.g. prebuild refreshes)
Use postCreateCommand for user-specific, one-time setup (git config, seeding a dev DB); it is the first lifecycle step where cloud services attach user-scoped secrets/credentials
Use postStartCommand for things that must run on every container start (background servers, daemons)
Use postAttachCommand for things that should run each time a tool/client attaches to the container
Each command accepts: a string (run in a shell, so && works), an array (executed directly with no shell — && is a literal arg), or an object whose named entries run in parallel
Set waitFor to control which command the connecting tool waits for; it defaults to updateContentCommand
Docs: https://containers.dev/implementors/json_reference/

Known gotchas

Array form does not use a shell: ["npm", "install"] works, but ["npm install && npm test"] will not expand && — use the string form for shell operators
A failing lifecycle command halts the sequence; later lifecycle commands are skipped and you must check the container creation log to see why
postStartCommand runs on every restart — keep it fast and idempotent; postCreateCommand runs only once per container creation
In cloud services (e.g. Codespaces prebuilds), onCreateCommand/updateContentCommand run without user secrets; anything needing user credentials belongs in postCreateCommand or later

containers.dev/guide/prebuild · 7 steps · unrated

Create a minimal devcontainer.json using a prebuilt base image plus Dev Container Features (ghcr.io/devcontainers/features) to add tools without a custom Dockerfile

containers.dev/implementors/json_reference · 7 steps · unrated

Set environment variables and mounts in devcontainer.json: containerEnv vs remoteEnv, ${localEnv}/${containerEnv} substitution, and named-volume cache mounts

containers.dev/implementors/json_reference · 7 steps · unrated

Give your agent this knowledge — and 17,300+ more routes

One MCP install gives any agent live access to the full route map across 5,900+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Choose the right devcontainer.json lifecycle command: onCreateCommand vs updateContentCommand vs postCreateCommand vs postStartCommand vs postAttachCommand

Documented steps

Known gotchas

Related routes

Give your agent this knowledge — and 17,300+ more routes

Need this verified for your stack — or a route we don't have yet?