diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 80b8c4e9f2..8d19e869a7 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,3 +1,6 @@
+// This file should be kept in sync with "privileged/devcontainer.json".
+// This file is used for local development. The other file is used for running benchmark tests in CI.
+// The only difference is using the "privileged" property to allow the container to run as root.
 {
   "name": "slang-devcontainer",
   "runArgs": [],
diff --git a/.devcontainer/privileged/devcontainer.json b/.devcontainer/privileged/devcontainer.json
new file mode 100644
index 0000000000..6e9307a281
--- /dev/null
+++ b/.devcontainer/privileged/devcontainer.json
@@ -0,0 +1,40 @@
+// This file should be kept in sync with "../devcontainer.json".
+// This file is used for running benchmark tests in CI. The other file is used for local development.
+// The only difference is using the "privileged" property to allow the container to run as root.
+{
+  "name": "slang-devcontainer",
+  "runArgs": [],
+  "build": {
+    "dockerfile": "../Dockerfile"
+  },
+  "privileged": true,
+  "postAttachCommand": "/bin/bash scripts/bin/infra setup",
+  "portsAttributes": {
+    // _MKDOCS_WATCH_PORT_ | keep in sync with the port number defined in "$REPO_ROOT/crates/infra/cli/src/toolchains/mkdocs/mod.rs"
+    "5353": {
+      "label": "mkdocs",
+      "onAutoForward": "openPreview"
+    }
+  },
+  "customizations": {
+    "vscode": {
+      // Keep extensions list in-sync with "$REPO_ROOT/.vscode/extensions.json"
+      "extensions": [
+        // Language Support
+        "igochkov.vscode-ebnf",
+        "NomicFoundation.hardhat-solidity",
+        "redhat.vscode-yaml",
+        "rust-lang.rust-analyzer",
+        "samuelcolvin.jinjahtml",
+        "tamasfe.even-better-toml",
+        "yzhang.markdown-all-in-one",
+        // Formatting/Linting
+        "DavidAnson.vscode-markdownlint",
+        "esbenp.prettier-vscode",
+        "Gruntfuggly.triggertaskonsave",
+        "streetsidesoftware.code-spell-checker",
+        "timonwong.shellcheck"
+      ]
+    }
+  }
+}
diff --git a/.github/actions/devcontainer/run/action.yml b/.github/actions/devcontainer/run/action.yml
new file mode 100644
index 0000000000..700f19f864
--- /dev/null
+++ b/.github/actions/devcontainer/run/action.yml
@@ -0,0 +1,35 @@
+name: "devcontainer/run"
+
+inputs:
+  runCmd:
+    type: "string"
+    required: true
+
+  env:
+    type: "string"
+    default: ""
+
+  privileged:
+    type: "boolean"
+    default: false
+
+runs:
+  using: "composite"
+  steps:
+    - name: "Run in devcontainer"
+      uses: "devcontainers/ci@a56d055efecd725e8cfe370543b6071b79989cc8"
+      if: "${{ !inputs.privileged }}"
+      with:
+        configFile: ".devcontainer/devcontainer.json"
+        env: "${{ inputs.env }}"
+        push: "never"
+        runCmd: "${{ inputs.runCmd }}"
+
+    - name: "Run in devcontainer (privileged)"
+      uses: "devcontainers/ci@a56d055efecd725e8cfe370543b6071b79989cc8"
+      if: "${{ inputs.privileged }}"
+      with:
+        configFile: ".devcontainer/privileged/devcontainer.json"
+        env: "${{ inputs.env }}"
+        push: "never"
+        runCmd: "${{ inputs.runCmd }}"
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 19006fc62b..719b3626b2 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -27,16 +27,10 @@ jobs:
       - name: "Restore Cache"
         uses: "./.github/actions/cache/restore"
 
-      - name: "infra setup cargo"
-        uses: "./.devcontainer"
-        with:
-          entrypoint: "./scripts/bin/infra"
-          args: "setup cargo"
-
       - name: "infra perf benchmark"
-        uses: "./.devcontainer"
+        uses: "./.github/actions/devcontainer/run"
         with:
-          entrypoint: "./scripts/bin/infra"
-          args: "perf benchmark"
-        env:
-          BENCHER_API_TOKEN: "${{ secrets.BENCHER_API_TOKEN }}"
+          runCmd: "./scripts/bin/infra perf benchmark"
+          privileged: true
+          env: |
+            BENCHER_API_TOKEN=${{ secrets.BENCHER_API_TOKEN }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5a85de366b..c8997f5101 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,29 +37,20 @@ jobs:
       # Run all CI steps in order: _SLANG_INFRA_CI_STEPS_ORDERED_ (keep in sync)
       #
 
-      - name: "infra setup"
-        uses: "./.devcontainer"
-        with:
-          entrypoint: "./scripts/bin/infra"
-          args: "setup"
-
       - name: "infra check"
-        uses: "./.devcontainer"
+        uses: "./.github/actions/devcontainer/run"
         with:
-          entrypoint: "./scripts/bin/infra"
-          args: "check"
+          runCmd: "./scripts/bin/infra check"
 
       - name: "infra test"
-        uses: "./.devcontainer"
+        uses: "./.github/actions/devcontainer/run"
         with:
-          entrypoint: "./scripts/bin/infra"
-          args: "test"
+          runCmd: "./scripts/bin/infra test"
 
       - name: "infra lint"
-        uses: "./.devcontainer"
+        uses: "./.github/actions/devcontainer/run"
         with:
-          entrypoint: "./scripts/bin/infra"
-          args: "lint"
+          runCmd: "./scripts/bin/infra lint"
 
       - name: "Save Cache"
         uses: "./.github/actions/cache/save"
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 69b72700bf..a5d0eb6f17 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -34,17 +34,10 @@ jobs:
       - name: "Restore Cache"
         uses: "./.github/actions/cache/restore"
 
-      - name: "infra setup pipenv"
-        uses: "./.devcontainer"
-        with:
-          entrypoint: "./scripts/bin/infra"
-          args: "setup pipenv"
-
       - name: "infra check mkdocs"
-        uses: "./.devcontainer"
+        uses: "./.github/actions/devcontainer/run"
         with:
-          entrypoint: "./scripts/bin/infra"
-          args: "check mkdocs"
+          runCmd: "./scripts/bin/infra check mkdocs"
 
       - name: "Configure Pages"
         uses: "actions/configure-pages@1f0c5cde4bc74cd7e1254d0cb4de8d49e9068c7d"
@@ -86,19 +79,12 @@ jobs:
       - name: "Restore Cache"
         uses: "./.github/actions/cache/restore"
 
-      - name: "infra setup cargo npm"
-        uses: "./.devcontainer"
-        with:
-          entrypoint: "./scripts/bin/infra"
-          args: "setup cargo npm"
-
       - name: "infra publish changesets"
-        uses: "./.devcontainer"
+        uses: "./.github/actions/devcontainer/run"
         with:
-          entrypoint: "./scripts/bin/infra"
-          args: "publish changesets"
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          runCmd: "./scripts/bin/infra publish changesets"
+          env: |
+            GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
 
       - name: "Create/Update Changesets Pull Request"
         id: "runChangesets"
@@ -127,32 +113,23 @@ jobs:
       - name: "Restore Cache"
         uses: "./.github/actions/cache/restore"
 
-      - name: "infra setup cargo npm"
-        uses: "./.devcontainer"
-        with:
-          entrypoint: "./scripts/bin/infra"
-          args: "setup cargo npm"
-
       - name: "infra publish npm"
-        uses: "./.devcontainer"
+        uses: "./.github/actions/devcontainer/run"
         with:
-          entrypoint: "./scripts/bin/infra"
-          args: "publish npm"
-        env:
-          NPM_TOKEN: "${{ secrets.NPM_TOKEN }}"
+          runCmd: "./scripts/bin/infra publish npm"
+          env: |
+            NPM_TOKEN=${{ secrets.NPM_TOKEN }}
 
       - name: "infra publish cargo"
-        uses: "./.devcontainer"
+        uses: "./.github/actions/devcontainer/run"
         with:
-          entrypoint: "./scripts/bin/infra"
-          args: "publish cargo"
-        env:
-          CARGO_REGISTRY_TOKEN: "${{ secrets.CARGO_REGISTRY_TOKEN }}"
+          runCmd: "./scripts/bin/infra publish cargo"
+          env: |
+            CARGO_REGISTRY_TOKEN=${{ secrets.CARGO_REGISTRY_TOKEN }}
 
       - name: "infra publish github-release"
-        uses: "./.devcontainer"
+        uses: "./.github/actions/devcontainer/run"
         with:
-          entrypoint: "./scripts/bin/infra"
-          args: "publish github-release"
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          runCmd: "./scripts/bin/infra publish github-release"
+          env: |
+            GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/sanctuary.yml b/.github/workflows/sanctuary.yml
index fbc1bbd153..b857c5d882 100644
--- a/.github/workflows/sanctuary.yml
+++ b/.github/workflows/sanctuary.yml
@@ -51,14 +51,7 @@ jobs:
       - name: "Restore Cache"
         uses: "./.github/actions/cache/restore"
 
-      - name: "infra setup cargo"
-        uses: "./.devcontainer"
-        with:
-          entrypoint: "./scripts/bin/infra"
-          args: "setup cargo"
-
       - name: "infra run solidity_testing_sanctuary"
-        uses: "./.devcontainer"
+        uses: "./.github/actions/devcontainer/run"
         with:
-          entrypoint: "./scripts/bin/infra"
-          args: "run --release --bin solidity_testing_sanctuary -- --shards-count ${{ env.SHARDS_COUNT }} --shard-index ${{ matrix.shard_index }} ${{ inputs.chain }} ${{ inputs.network }}"
+          runCmd: "./scripts/bin/infra run solidity_testing_sanctuary run --release --bin solidity_testing_sanctuary -- --shards-count ${{ env.SHARDS_COUNT }} --shard-index ${{ matrix.shard_index }} ${{ inputs.chain }} ${{ inputs.network }}"
diff --git a/crates/infra/cli/src/commands/ci/mod.rs b/crates/infra/cli/src/commands/ci/mod.rs
index 02a7c9a1f0..a0c7c7ccee 100644
--- a/crates/infra/cli/src/commands/ci/mod.rs
+++ b/crates/infra/cli/src/commands/ci/mod.rs
@@ -12,9 +12,9 @@ pub struct CiController;
 impl CiController {
     #[allow(clippy::unused_self)] // For symmetry with other commands
     pub fn execute(&self) -> Result<()> {
-        // Run all CI steps in order: _SLANG_INFRA_CI_STEPS_ORDERED_ (keep in sync)
-
         SetupController::default().execute()?;
+
+        // Run all CI steps in order: _SLANG_INFRA_CI_STEPS_ORDERED_ (keep in sync)
         CheckController::default().execute()?;
         TestController::default().execute()?;
         LintController::default().execute()?;