Deployment guide

code-server

Overview

code-server, by Coder, runs the full Visual Studio Code editor as a service you reach from any browser. You get the same VS Code experience, including the editor, the extension marketplace, the integrated terminal, settings sync and workspace state, hosted on your own cloud VM. You can develop from a Chromebook, a tablet or a locked-down workstation while the code, tools and compute stay on the server.

This SecureAnyCloud image runs code-server 4.127.0 as a systemd service under a dedicated unprivileged coder account, behind an nginx reverse proxy on port 80. All user state lives on a dedicated Azure data disk, and every VM generates its own password on first boot.

What you get:

code-server 4.127.0, the open-source VS Code in the browser, managed by systemd
The VS Code web IDE on :80, fronted by nginx, which proxies the WebSocket upgrade the IDE requires
code-server running as the unprivileged coder user, bound to the loopback address 127.0.0.1:8080
A unique password generated on first boot and recorded in a root-only file (code-server has no username, so authentication is password-only)
A dedicated Azure data disk at /var/lib/code-server holding user settings, installed extensions and workspace state
code-server.service and nginx.service as enabled, active systemd units
An unauthenticated /healthz endpoint for Azure Load Balancer health probes
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a reasonable starting size. Choose a larger size for heavier extensions, language servers or several concurrent workspaces.

In the network security group (NSG), allow inbound 22/tcp from your management network and 80/tcp. code-server serves plain HTTP on port 80, so for production terminate TLS in front of it with your own domain (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for code-server by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:code-server-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name code-server \
  --image sac1647283583153:code-server-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name code-server --port 80 --priority 1010

Step 3 - Connect to your VM

Connect over SSH as azureuser:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that code-server and nginx are active:

systemctl is-active code-server.service nginx.service

Both report active. code-server runs as the dedicated coder user and listens on the loopback address 127.0.0.1:8080. nginx fronts it on port 80 and passes through the WebSocket upgrade the IDE requires.

All user settings, installed extensions and workspace state live on the dedicated Azure data disk mounted at /var/lib/code-server.

Step 5 - Retrieve your password

Your VM generates a unique code-server password on first boot and writes it to a root-only file. Read it with sudo:

sudo cat /root/code-server-credentials.txt

The file contains CODE_SERVER_PASSWORD and the URL to open. code-server has no username, so you sign in with the password alone. Store it somewhere safe.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes. Query it from the VM:

curl -s http://localhost/healthz

It returns ok. The endpoint never requires authentication, so you can point an Azure Load Balancer health probe at it.

Step 7 - Verify authentication from the command line

code-server rejects a wrong password. For the correct per-VM password, it issues a session cookie with a redirect.

Read the password from the credentials file first, then post it to the login endpoint. The command embeds your unique password, so run it interactively rather than from a script. Replace <CODE_SERVER_PASSWORD> with the value of CODE_SERVER_PASSWORD from Step 5:

curl -s -o /dev/null -w '%{http_code}\n' -c cookies.txt -X POST --data-urlencode 'password=<CODE_SERVER_PASSWORD>' http://127.0.0.1/login; grep -o 'code-server-session' cookies.txt

A correct password returns 302 and prints code-server-session, which shows the session cookie was set. A wrong password returns 200 and sets no session cookie.

Step 8 - Sign in to the web IDE

Browse to http://<vm-public-ip>/. At the password prompt, enter the password from Step 5.

You are now in a full Visual Studio Code editor running in your browser. Choose File -> Open Folder to open a project and start editing.

Open the Extensions panel from the activity bar to browse and install extensions from the marketplace, such as language support, linters and themes.

Open the integrated terminal with Terminal -> New Terminal (or Ctrl+`) to run commands on the VM without leaving the editor.

Step 9 - Confirm user data lives on the dedicated disk

code-server's user state covers settings, installed extensions and workspace and machine state. It is stored under XDG_DATA_HOME=/var/lib/code-server on the dedicated Azure data disk. The data survives OS changes, and you can resize the disk independently. Confirm the mount:

findmnt /var/lib/code-server

The mount is backed by a separate Azure data disk. It is captured into the image and provisioned again on every VM.

Maintenance

Password: the per-VM password lives in /etc/code-server/config.yaml (password:). To rotate it, edit that value and run sudo systemctl restart code-server.
Extensions: install from the Extensions panel in the IDE, or run code-server --install-extension <publisher.name> as the coder user. Extensions persist on the data disk.
Storage: all user state lives under /var/lib/code-server on the data disk. Back up that volume to protect your settings and extensions.
Tuning: the service is defined in /etc/systemd/system/code-server.service. After any change, run sudo systemctl daemon-reload && sudo systemctl restart code-server.
TLS: code-server serves plain HTTP on port 80, and the editor and terminal give full access to the VM. For production, front it with TLS, for example with certbot and your own domain.
Security patches: unattended-upgrades stays enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch code-server on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

code-server is the open-source project that runs full Visual Studio Code on a server and serves it to any modern web browser. You get the complete VS Code experience, including the integrated terminal, the extension marketplace, source control and debugging. It is hosted on your own instance, so your development environment lives next to your code and compute instead of on a laptop.

On this SecureAnyCloud image, code-server runs as a Node.js service under a dedicated unprivileged coder service account. It binds to 127.0.0.1:8080 on the loopback interface. nginx fronts it as a reverse proxy on port 80 (and 443 once you add TLS), with the WebSocket upgrade the editor requires already configured.

User settings, installed extensions and workspace state live on a dedicated EBS data volume mounted at /var/lib/code-server. You can resize the volume independently, and it is separate from the operating system disk.

On the first boot of every instance, a one-shot service generates a per-instance access password and writes it into the editor configuration. It also records the password in /root/code-server-credentials.txt with mode 0600. code-server has no username, so the password alone signs you in. No shared or default credentials ship in the image.

Prerequisites

Before you deploy this image, make sure you have:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your developers use to reach code-server
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for code-server. Select the SecureAnyCloud listing, choose Select, then Continue on the subscription summary.

Pick an instance type of t3.medium or larger. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users use. Leave the root volume at the default size or larger. The image adds a separate data volume for the user-data store automatically.

Select Launch instance. First-boot initialization takes under a minute after the instance state becomes Running and the status checks pass.

Launch the Instance from the AWS CLI

The command below launches an instance from the SecureAnyCloud code-server Marketplace AMI into an existing subnet and security group.

Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID and <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.medium \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":20,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=code-server-01}]'

On success, the command prints a JSON document. Note the instance ID. Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect and Retrieve the Access Password

Connect over SSH with the key pair you selected and the public IP address from step 2. The SSH login user depends on the operating system of the AMI variant you launched:

AMI variant SSH login user

code-server 4.127 on Ubuntu 24.04 ubuntu

The first-boot service runs before the SSH daemon is ready, so the credentials file is always in place when you first log in.

ssh <login-user>@<public-ip>
sudo cat /root/code-server-credentials.txt

The plain-text file contains the code-server URL and the per-instance access password.

From the same SSH session, confirm the deployment is healthy. nginx serves the health endpoint, and it is open:

curl -fsS http://127.0.0.1/healthz

ok

An ok response confirms nginx is fronting the application. Then confirm that the two services that make up the stack are running:

systemctl is-active code-server nginx

active active

First Sign-in

Open a web browser and go to http://<public-ip>/. code-server shows its sign-in page and prompts for the access password.

The sign-in page is served behind nginx. code-server has no username, so the password alone signs you in.

Enter the password from /root/code-server-credentials.txt and select Submit. The full Visual Studio Code interface opens in your browser, with the activity bar, file explorer, editor and status bar.

The editor runs in the browser, with a workspace folder open in the file explorer.

Open a Folder and Edit

Select File -> Open Folder, or use the open a folder link on the Welcome page. Choose a directory on the instance, for example your home directory or a project you have cloned.

code-server opens the folder in the explorer, just like desktop VS Code. Create files, edit across your project, use search and refactoring, and save with the usual keyboard shortcuts. Everything renders in the browser and runs on the instance.

The first time you open a folder, VS Code asks whether you trust its authors. Choose Yes, I trust the authors to enable tasks, debugging and all extensions for that folder.

Use the Integrated Terminal

Open Terminal -> New Terminal (or press Ctrl + `) to get a shell on the instance, right next to your code. Run builds, package managers, git and any other command-line tooling without leaving the browser.

The integrated terminal runs shell commands on the instance as the coder service user.

Because the terminal runs as the unprivileged coder user, connect over SSH as your instance login user, which has sudo, for commands that need root.

Install Extensions

Select the Extensions icon in the activity bar (or press Ctrl + Shift + X) to browse and install extensions for your languages and frameworks. Search the marketplace, select an extension and choose Install.

Installed extensions live on the dedicated data volume under /var/lib/code-server, so they persist across restarts.

Enable HTTPS with Let's Encrypt

For production, serve code-server over HTTPS so that your session and the editor's WebSocket cannot be intercepted. The image ships with nginx, which certbot can configure automatically.

The commands below assume a DNS record that points your fully qualified domain name at the instance's public IP address.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d code.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

certbot obtains a certificate and rewrites the nginx server block to serve HTTPS and redirect HTTP. The WebSocket upgrade headers already in the site are preserved. The certbot systemd timer renews the certificate automatically.

Backups and Maintenance

code-server keeps your settings, installed extensions and workspace state under /var/lib/code-server on the dedicated data volume. Because that is a separate EBS volume, you can take a coordinated EBS snapshot of it for point-in-time backups. Alternatively, archive the tree to object storage:

sudo systemctl stop code-server
sudo tar czf <backup-dir>/code-server-$(date +%F).tgz -C /var/lib code-server
sudo systemctl start code-server

Ship the archive to an Amazon S3 bucket or another object store.

To rotate the access password, edit password: in /etc/code-server/config.yaml and run sudo systemctl restart code-server.

Both services run under systemd. Check their state at any time:

systemctl is-active code-server nginx

active active

Scaling and Operations

Put the web tier behind an Application Load Balancer and terminate TLS there. Forward the WebSocket upgrade so the editor can connect.
Grow the user-data store by extending the EBS data volume and running sudo resize2fs on /var/lib/code-server
Give each developer their own instance for an isolated, reproducible environment, or share one instance across a small team
Pin the code-server version across a fleet by controlling which AMI version you launch

Read the official code-server documentation at https://coder.com/docs/code-server.

Support

SecureAnyCloud provides 24/7/365 expert technical support for this image. Guaranteed response within 24 hours, one hour average for critical issues. Contact sales@secureanycloud.com.

For general code-server questions, consult the documentation at https://coder.com/docs/code-server. code-server is a trademark of Coder Technologies, Inc. Its use here is nominative and does not imply affiliation or endorsement.

Deploy on AWS

Launch code-server on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS