l7-devenv, or `de` for short[0], is a containerized terminal-based IDE using rootless Podman, neovim and friends, and proxying of network requests and sockets.
IMO, the security story around most widely used code editors is not great today. Security, convenience, and productivity appear to be pick-any-2 when fundamentally I believe they don't have to be in conflict.
`de` takes a critical look at the software and secrets used for day-to-day development and compartmentalizes them using containers. For example, you can connect seamlessly to authenticated GitHub endpoints without leaking your production token while LSPs and package scripts are run in separate ephemeral containers. It also provides features and integrations to make the developer experience more productive and joyful, with a current focus on Node.js development[1], GitHub, and web3.
The main and integrated editor is neovim. No plugin manager is used; instead plugins are installed natively from git submodules and bundled into the image.
This is currently in a prototype stage[2] and driven by internal needs. It derives heavily from existing community efforts (<3).
You will find this relevant if you want:
- To be using neovim for Node.js development and collaborating on github.com
- Separate your developer credentials from your editor and code-under-test
- More control of your https requests[3]
- Something more secure than distrobox but more lightweight and seamless than QubesOS (<3)
- More terminal joy and less waiting at requests to load for your routine code review workflows
- Some inspiration for your own setup
---
[0]: Names WIP
[1]: While current focus is catering to JS/TS devs, it should be straightforward to add your own runtimes and buildtimes. There is an example for golang in there if you look around.
[2]: Provided as-is, currently no guarantees given regarding actual security, etc. In particular, the proxied container socket used to spawn side-containers could definitely use some tightening down.
[3]: The TLS MitM is already done and redirecting the current proxy to something like mitmproxy should be trivial for the motivated