OpenVSCode Server

Prerequisites

• An active Azure subscription, an SSH key pair, and a virtual network and subnet in the target region.
• Standard_B2s (2 vCPU / 4 GiB RAM) is a reasonable starting point. Size up for heavier extensions, language servers or multiple concurrent workspaces.
• Network security group (NSG) inbound rules: allow 22/tcp from your management network, 443/tcp for the editor and, optionally, 80/tcp, which only redirects to HTTPS. The raw editor port 3000 stays on loopback and is never exposed.
• The image ships with a self-signed certificate, so your browser warns on first connection. See Maintenance to install a real certificate.
• The integrated terminal can run arbitrary code, including outbound network calls. Keep inbound access restricted to trusted networks.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal and choose Create a resource. Search the Marketplace for OpenVSCode Server by SecureAnyCloud, then select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443).

Choose Review + create, then Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, then create the VM and open port 443:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:openvscode-server:default:latest
az vm create \
  --resource-group <your-rg> \
  --name openvscode-server \
  --image sac1647283583153:openvscode-server:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name openvscode-server --port 443 --priority 1010

Step 3 - Connect to your VM

Connect over SSH as the azureuser account:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that both services are active:

systemctl is-active openvscode-server.service nginx.service

Both report active.

OpenVSCode Server runs as the dedicated unprivileged openvscode user and listens only on the loopback connector 127.0.0.1:3000. nginx fronts it on port 443 over TLS with the WebSocket upgrade the editor requires. Because the editor runs as a non-root account, a browser terminal session never has needless privilege on the VM.

Step 5 - Retrieve your connection token

The connection token is generated uniquely on the first boot of your VM. It is written to a root-only file, along with the URL to open:

sudo cat /root/openvscode-credentials.txt

This file contains OPENVSCODE_CONNECTION_TOKEN and OPENVSCODE_URL. There is no username. The token alone gates access, and anyone with the URL has an interactive shell on the VM as the openvscode user. Treat the token like a password and store it somewhere safe.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes. Request it with:

curl -s http://localhost/healthz

It returns ok. This endpoint never requires the token, so it is safe for an Azure Load Balancer health probe. Every editor request still requires authentication.

Step 7 - Verify the token gates access from the command line

OpenVSCode Server rejects any request with no token or a wrong token (HTTP 403). It accepts the per-VM token with a redirect into the workbench (HTTP 302).

The command embeds your unique token, so run it interactively rather than from a script. Substitute the value of OPENVSCODE_CONNECTION_TOKEN from Step 5 for <OPENVSCODE_TOKEN>:

curl -sk -o /dev/null -w 'no token -> %{http_code}\n' https://127.0.0.1/
curl -sk -o /dev/null -w 'per-VM tok -> %{http_code}\n' "https://127.0.0.1/?tkn=<OPENVSCODE_TOKEN>"

The first line prints 403 (denied), the second prints 302 (accepted). The -k flag tells curl to accept the image's self-signed certificate.

Step 8 - Open the editor in your browser

Browse to the OPENVSCODE_URL from Step 5, which has the form https://<vm-public-ip>/?tkn=<your-token>. Your browser warns once about the self-signed certificate. Accept it, or install a real certificate first (see Maintenance).

OpenVSCode Server validates the token, sets a session cookie and opens a full Visual Studio Code editor in your browser.

Use the Explorer to open a file in the workspace and start editing. The default workspace folder is /var/lib/openvscode-server/workspace, owned by the openvscode user.

Open the integrated terminal with Terminal > New Terminal to run commands on the VM without leaving the editor. The terminal runs as the unprivileged openvscode user.

Open the Extensions panel from the activity bar to browse and install extensions from the marketplace, such as language support, linters and themes.

Maintenance

• Connection token. The per-VM token lives in /etc/openvscode-server/connection-token. To rotate it, write a new secret (for example openssl rand -hex 24 | sudo tee /etc/openvscode-server/connection-token) and run sudo systemctl restart openvscode-server. Then update OPENVSCODE_URL for your users.
• TLS certificate. The image ships a per-VM self-signed certificate at /etc/nginx/tls/openvscode.crt. For production, replace it with a certificate for your own domain, for example with certbot:

text sudo apt-get install -y certbot python3-certbot-nginx sudo certbot --nginx -d ide.example.com

• Extensions. Install extensions from the Extensions panel in the IDE. They persist under the openvscode user's home at /var/lib/openvscode-server.
• Storage. The workspace and editor state live under /var/lib/openvscode-server. Back up that directory to protect your files, settings and extensions, and grow the OS disk if you need more room.
• Network egress. The integrated terminal can run arbitrary code that reaches the internet. Restrict outbound rules on the NSG if you need to limit what the editor can contact.
• Tuning. The service is defined in /etc/systemd/system/openvscode-server.service, with memory and task limits. After any change, run sudo systemctl daemon-reload && sudo systemctl restart openvscode-server.
• Security patches. Unattended upgrades remain enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch OpenVSCode Server on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com