diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
new file mode 100644
index 00000000..59f814be
--- /dev/null
+++ b/.devcontainer/Dockerfile
@@ -0,0 +1,9 @@
+FROM mcr.microsoft.com/devcontainers/typescript-node:22-bookworm@sha256:7653612ebf9384fa1cbd32413d8f4fbf7daaf24e39e8664d9fc030de8c0c0af2
+
+# VS Code/Electron share Chromium's native library requirements; playwright
+# install-deps tracks that list upstream. xvfb enables headless test runs.
+RUN npx --yes playwright install-deps chromium && \
+	apt-get update && \
+	apt-get install --yes --no-install-recommends xvfb && \
+	apt-get clean && \
+	rm -rf /var/lib/apt/lists/* /root/.npm
diff --git a/.devcontainer/README.md b/.devcontainer/README.md
new file mode 100644
index 00000000..d903d566
--- /dev/null
+++ b/.devcontainer/README.md
@@ -0,0 +1,10 @@
+# vscode-coder devcontainer
+
+[![Open in Dev Containers](https://img.shields.io/static/v1?label=Dev%20Containers&message=Open&color=blue)](https://vscode.dev/redirect?url=vscode://ms-vscode-remote.remote-containers/cloneInVolume?url=https://github.com/coder/vscode-coder)
+
+A ready-to-code environment matching CI: Node 22, pnpm, and `xvfb` for
+headless integration tests. Click the badge above (or run **Dev
+Containers: Clone Repository in Container Volume…** from the command
+palette) to spin it up.
+
+See [`AGENTS.md`](../AGENTS.md) for build, lint, and test commands.
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
new file mode 100644
index 00000000..cc14f5cd
--- /dev/null
+++ b/.devcontainer/devcontainer.json
@@ -0,0 +1,18 @@
+{
+	"name": "vscode-coder",
+	"build": {
+		"dockerfile": "Dockerfile"
+	},
+	"remoteUser": "node",
+	"customizations": {
+		"vscode": {
+			"extensions": [
+				"esbenp.prettier-vscode",
+				"dbaeumer.vscode-eslint",
+				"vitest.explorer",
+				"ms-vscode.extension-test-runner"
+			]
+		}
+	},
+	"postCreateCommand": "pnpm install --frozen-lockfile"
+}
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ab1f1612..6723c1d9 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -11,6 +11,12 @@ updates:
       interval: "weekly"
     cooldown:
       default-days: 7
+  - package-ecosystem: "docker"
+    directory: "/.devcontainer"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
diff --git a/.gitignore b/.gitignore
index 2f41ff05..f85999f1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,7 @@
 /.vscode-test/
 /.nyc_output/
 /coverage/
+/.pnpm-store/
 *.vsix
 pnpm-debug.log
 .eslintcache
diff --git a/AGENTS.md b/AGENTS.md
index 22cffe04..752eb913 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -42,6 +42,13 @@ doesn't make sense. Honesty over agreeableness.
 | **Single extension test** | `pnpm test:extension ./test/unit/filename.test.ts`  |
 | **Single webview test**   | `pnpm test:webview ./test/webview/filename.test.ts` |
 
+Integration tests launch VS Code and need a display. On headless
+environments (CI, devcontainers) prefix with `xvfb-run -a`:
+
+```sh
+xvfb-run -a pnpm test:integration
+```
+
 ## Testing
 
 - Test observable behavior and outputs, not implementation details