diff --git a/agent/agentcontainers/containers.go b/agent/agentcontainers/containers.go
index 8578f03337fbe..4f03f35ed5710 100644
--- a/agent/agentcontainers/containers.go
+++ b/agent/agentcontainers/containers.go
@@ -140,3 +140,10 @@ type Lister interface {
 	// This should include running and stopped containers.
 	List(ctx context.Context) (codersdk.WorkspaceAgentListContainersResponse, error)
 }
+
+// NoopLister is a Lister interface that never returns any containers.
+type NoopLister struct{}
+
+func (NoopLister) List(_ context.Context) (codersdk.WorkspaceAgentListContainersResponse, error) {
+	return codersdk.WorkspaceAgentListContainersResponse{}, nil
+}
diff --git a/cli/agent.go b/cli/agent.go
index fc96aa6d323c3..f87959aec1c49 100644
--- a/cli/agent.go
+++ b/cli/agent.go
@@ -25,6 +25,7 @@ import (
 	"cdr.dev/slog/sloggers/slogjson"
 	"cdr.dev/slog/sloggers/slogstackdriver"
 	"github.com/coder/coder/v2/agent"
+	"github.com/coder/coder/v2/agent/agentcontainers"
 	"github.com/coder/coder/v2/agent/agentexec"
 	"github.com/coder/coder/v2/agent/agentssh"
 	"github.com/coder/coder/v2/agent/reaper"
@@ -37,21 +38,22 @@ import (
 
 func (r *RootCmd) workspaceAgent() *serpent.Command {
 	var (
-		auth                string
-		logDir              string
-		scriptDataDir       string
-		pprofAddress        string
-		noReap              bool
-		sshMaxTimeout       time.Duration
-		tailnetListenPort   int64
-		prometheusAddress   string
-		debugAddress        string
-		slogHumanPath       string
-		slogJSONPath        string
-		slogStackdriverPath string
-		blockFileTransfer   bool
-		agentHeaderCommand  string
-		agentHeader         []string
+		auth                 string
+		logDir               string
+		scriptDataDir        string
+		pprofAddress         string
+		noReap               bool
+		sshMaxTimeout        time.Duration
+		tailnetListenPort    int64
+		prometheusAddress    string
+		debugAddress         string
+		slogHumanPath        string
+		slogJSONPath         string
+		slogStackdriverPath  string
+		blockFileTransfer    bool
+		agentHeaderCommand   string
+		agentHeader          []string
+		devcontainersEnabled bool
 	)
 	cmd := &serpent.Command{
 		Use:   "agent",
@@ -314,6 +316,15 @@ func (r *RootCmd) workspaceAgent() *serpent.Command {
 				return xerrors.Errorf("create agent execer: %w", err)
 			}
 
+			var containerLister agentcontainers.Lister
+			if !devcontainersEnabled {
+				logger.Info(ctx, "agent devcontainer detection not enabled")
+				containerLister = &agentcontainers.NoopLister{}
+			} else {
+				logger.Info(ctx, "agent devcontainer detection enabled")
+				containerLister = agentcontainers.NewDocker(execer)
+			}
+
 			agnt := agent.New(agent.Options{
 				Client:            client,
 				Logger:            logger,
@@ -339,6 +350,7 @@ func (r *RootCmd) workspaceAgent() *serpent.Command {
 				PrometheusRegistry: prometheusRegistry,
 				BlockFileTransfer:  blockFileTransfer,
 				Execer:             execer,
+				ContainerLister:    containerLister,
 			})
 
 			promHandler := agent.PrometheusMetricsHandler(prometheusRegistry, logger)
@@ -461,6 +473,13 @@ func (r *RootCmd) workspaceAgent() *serpent.Command {
 			Description: fmt.Sprintf("Block file transfer using known applications: %s.", strings.Join(agentssh.BlockedFileTransferCommands, ",")),
 			Value:       serpent.BoolOf(&blockFileTransfer),
 		},
+		{
+			Flag:        "devcontainers-enable",
+			Default:     "true",
+			Env:         "CODER_AGENT_DEVCONTAINERS_ENABLE",
+			Description: "Allow the agent to automatically detect running devcontainers.",
+			Value:       serpent.BoolOf(&devcontainersEnabled),
+		},
 	}
 
 	return cmd
diff --git a/cli/testdata/coder_agent_--help.golden b/cli/testdata/coder_agent_--help.golden
index 3394b43a9e900..3dcbb343149d3 100644
--- a/cli/testdata/coder_agent_--help.golden
+++ b/cli/testdata/coder_agent_--help.golden
@@ -33,6 +33,9 @@ OPTIONS:
       --debug-address string, $CODER_AGENT_DEBUG_ADDRESS (default: 127.0.0.1:2113)
           The bind address to serve a debug HTTP server.
 
+      --devcontainers-enable bool, $CODER_AGENT_DEVCONTAINERS_ENABLE (default: true)
+          Allow the agent to automatically detect running devcontainers.
+
       --log-dir string, $CODER_AGENT_LOG_DIR (default: /tmp)
           Specify the location for the agent log files.