# Development environment
The supported VS Code setup is the repository's Dev Container. Open the repository in VS Code
and run **Dev Containers: Reopen in Container**. The default container is unprivileged and is
suitable for parser, model, rendering, documentation, and repository-policy work.
## Sources of truth
- `rust-toolchain.toml` selects the current Rust toolchain and its components.
- `rust-version` in the workspace `Cargo.toml` declares the MSRV. CI reads it from Cargo
metadata; the workflow does not duplicate it.
- `Cargo.toml` declares package versions. Release workflows read package versions from Cargo
metadata rather than accepting a manually typed version.
- `.devcontainer/Dockerfile` records the exact base-image release and pins its digest.
- `.devcontainer/devcontainer-lock.json` pins resolved Dev Container feature versions and
integrity hashes.
- `.devcontainer/Dockerfile` pins repository tooling; Renovate owns version proposals.
## Included tools
The image provides Rust, Cargo, rustfmt, Clippy, rust-analyzer, CodeLLDB, Git, GitHub CLI, Node.js,
Markdown and YAML support. The cached image layer installs exact versions of `cargo-deny`,
`cargo-semver-checks`, `lychee`, `zizmor`, `markdownlint-cli2`, and `actionlint`.
Actionlint's downloaded archive is verified against its release checksum.
Use the canonical checks documented in [the testing strategy](testing.md). Useful repository
checks include:
```console
cargo fmt --all -- --check
cargo ci-check
cargo ci-policy
cargo ci-clippy
cargo ci-test
cargo deny check
actionlint
zizmor .github/workflows
markdownlint-cli2 "**/*.md" "#target/**"
The default container deliberately does not mount a Docker or Podman socket, run systemd, or
request privileged mode. Runtime and Quadlet-generator conformance requires explicit, isolated
test environments with documented engine versions, privileges, and host requirements. Those
environments will be added with their test harnesses instead of expanding the trust boundary of
every editor session.