Self hosted VSCode you open in any browser tab

What you are actually setting up

code-server is Coder's patched version of VS Code's open-source code, adapted so it can live on a server and be used from a browser. You get the familiar editor, extensions and an integrated terminal, but the files and the processes sit on the server. Close the laptop, open a tablet, and you are back in the same session.

That terminal is the part to respect. Anyone who reaches the login page and gets past it has a shell on your server, which is why Coder's own guide says never to put it on the internet without some form of authentication and encryption. Most of this page is about doing that properly.

Will a small server keep up?

For code-server on its own, yes: Coder's requirements page recommends no less than two cores and a gigabyte of memory, on any Linux distribution, with WebSockets allowed through. What decides the size is the work you do in it. Our rough guide, not Coder's:

• Writing code, running scripts, small web projects: one of the small cartridge servers, ideally with NVMe so searches and installs feel instant.
• Big compiles, several containers, heavy language servers: more cores and memory, such as the Xeon D-1587 cartridge, which has 16 cores and takes up to 128 GB.
• A whole team: one virtual machine per person, on a two-processor server.

Every option, with its memory choices, cities and current price, is on the dedicated servers page. Releases exist for amd64 and arm64 machines; there is no Windows build.

Why a server of your own suits it

A shared virtual server slows down when its neighbours get busy, and a dev box is exactly where you notice: a build that took a minute yesterday takes three today. Here the server is a single computer that does your work and nobody else's, with root access, and its port is unmetered, so cloning big repositories and pulling images never adds a bandwidth line to the invoice.

The other comfort is getting back in. On rack servers, blades and two cartridge models (m510, m710x) there is a remote console that shows you the screen and the power button, so a firewall mistake does not mean a support ticket. You can reinstall the operating system from the control panel whenever you like. Ready servers are handed over within 30 minutes of the payment being approved, month to month. You manage the server; we keep the hardware and the network running.

Up and running in an evening

1. Log in over SSH and, if you only have root, create a normal user first (adduser yourname then usermod -aG sudo yourname) and log back in as that user. code-server will run as this user, and its terminal will be this user's shell; never run it as root.
2. Turn the firewall on with only SSH allowed, switching on IPv6 handling first so the rule covers both address families.
3. Download Coder's install script, then open it in a pager and look through it before anything runs. Its --dry-run option prints every command it would run. On Ubuntu and Debian it installs the .deb package from GitHub; downloading that .deb yourself and installing it with dpkg -i gets you the same thing.
4. Start the service. The first start creates the config file, ~/.config/code-server/config.yaml, holding a randomly generated password in plain text.

# Firewall: IPv6 rules on first, then SSH only
sudo sed -i 's/^IPV6=.*/IPV6=yes/' /etc/default/ufw
sudo ufw allow OpenSSH
sudo ufw --force enable

# Fetch the installer, read it, preview it, run it
curl -fsSL https://code-server.dev/install.sh -o install.sh
less install.sh
sh install.sh --dry-run
sh install.sh
# (alternative: download code-server_VERSION_amd64.deb from
#  github.com/coder/code-server/releases, then sudo dpkg -i that file)

# Run it now and at every boot, as you
sudo systemctl enable --now code-server@$USER

A password nobody can read off the disk

Out of the box, config.yaml tells code-server to listen on 127.0.0.1:8080, use password login, skip TLS, and it holds the password itself in plain text. Swap that for a hashed-password line, which code-server checks first. You cannot pass a password as a command-line flag at all; it only comes from this file or an environment variable, so the file is the thing to protect.

Coder's FAQ makes the hash with npx argon2-cli, typing the password into the command. Our version below asks for it silently instead, so it never lands in your shell history, and uses the argon2 tool from Ubuntu's own repositories. It locks the file to mode 600 first, because code-server creates it with ordinary permissions.

sudo apt install -y argon2
read -rs -p 'New password: ' PW; echo
HASH=$(printf '%s' "$PW" | argon2 "$(openssl rand -hex 16)" -e); unset PW
CFG=~/.config/code-server/config.yaml
chmod 600 "$CFG"
sed -i '/^password:/d; /^hashed-password:/d' "$CFG"
echo "hashed-password: \"$HASH\"" >> "$CFG"
cat "$CFG"   # bind-addr should still read 127.0.0.1:8080
sudo systemctl restart code-server@$USER

Wrong guesses are throttled too: two login attempts a minute, plus twelve more an hour. Treat that as a speed bump, not a lock.

Getting to it from your laptop or tablet

Coder's guide highly recommends an SSH tunnel, and it is the simplest route: nothing new opens on the server. On your own computer run ssh -N -L 8080:127.0.0.1:8080 yourname@dev-box, leave it running, and visit http://127.0.0.1:8080. Their tunnel steps turn the password off; we suggest leaving it on if anyone else has an account on the machine.

A tablet with no SSH client needs HTTPS instead. You will want a domain name with an A record (plus AAAA if your server has IPv6) pointing at the server. Caddy then obtains a certificate from Let's Encrypt on its own and hands requests on to code-server. Since Caddy runs directly on the server, ufw blocks it on both IPv4 and IPv6 until you open ports 80 and 443.

sudo ufw allow 80,443/tcp
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo apt update && sudo apt install -y caddy
echo 'dev.example.com {
  reverse_proxy 127.0.0.1:8080
}' | sudo tee /etc/caddy/Caddyfile
sudo systemctl reload caddy

Want a sign-in such as Google's instead of a shared password? Coder's guide lists reverse proxies that add it, such as oauth2-proxy and Pomerium.

Your extensions

Most of what you install comes from Open VSX, an open extension gallery. Microsoft's own marketplace is off the table. Coder's FAQ explains that Microsoft lets only its own builds of VS Code use it, and quotes the marketplace terms: "Marketplace Offerings are intended for use only with Visual Studio Products and Services".

So a few closed-source extensions are missing, Live Share and Microsoft's Remote extensions among them. If something you rely on is not on Open VSX, download its VSIX file and install it with the Extensions: Install from VSIX command or with code-server --install-extension. To bring your desktop setup along, the FAQ suggests copying ~/.vscode into ~/.local/share/code-server.

Keeping it healthy

• Updating means installing the newer version on top of the old one; your settings and extensions in ~/.local/share/code-server stay put. Then restart code-server so the newer version is what answers.
• Copy ~/.config/code-server, ~/.local/share/code-server and your projects to somewhere off the server on a schedule, and keep your code in git. A Gitea server of your own or Forgejo makes a good home for it.
• Prefer no usage data leaving the box? Start it with --disable-telemetry, or put disable-telemetry: true in config.yaml.
• If keyboard shortcuts get swallowed by the browser, install code-server as an app (a PWA) from Chrome's address bar.

When something else fits better

code-server is built for one person. For a team, Coder points you to their separate Coder product, or to giving everyone their own virtual machine, which a Proxmox server is made for. If what you need is automated builds on every push rather than an editor, look at a Jenkins server for your team or a GitHub Actions runner of your own. And if a Microsoft-only extension is a must, Coder's FAQ says VS Code web may suit you better.

Questions people ask

Is code-server free to use?

Yes. It is open source under the MIT licence, copyright Coder Technologies Inc., and there is nothing to pay for running it on your own machine. You pay only for the server it runs on.

Do I need a domain name?

Not if you use an SSH tunnel: you browse to 127.0.0.1:8080 on your own computer. You need one for the HTTPS route, because Let's Encrypt issues the certificate for a name that points at your server.

I broke SSH with a firewall rule. Now what?

Where your model has a remote console (rack servers, blades, the m510 and m710x), open it yourself: it shows the server's screen and power button without SSH, so you can undo the rule. On the other cartridges you have power control only, so test firewall changes carefully there.

Can I use the same setup for a few colleagues?

One code-server has one password and one user account behind it, so everyone would share the same shell. Coder's FAQ recommends a virtual machine per person for shared hardware.

How is this different from GitHub Codespaces?

Coder's FAQ describes Codespaces as a closed-source, paid service from GitHub and Microsoft, while code-server is free, open source and runs on a machine you choose. With your own server, the hardware and the data are yours to manage.