code-server (by Coder) runs Visual Studio Code on a server and serves it to your browser. You get a full VS Code editor with terminal, extensions, Git and debugging, and all the work happens on the server. It’s handy for coding from a tablet, a Chromebook or a locked-down work laptop, and for keeping a consistent dev environment close to your deployments.
Alternative: VS Code’s Remote-SSH extension, which uses your local VS Code with the server as the backend over SSH. See SSH keys.
Requirements
- At least 1 vCPU and 2 GB RAM. Use 2–4 vCPU and 4 GB+ RAM if you’ll run language servers, builds and Docker.
- A domain name for HTTPS (needed for clipboard, service workers and some extensions).
- Pick a VPS location close to you. Typing latency matters in an editor. See choosing a VPS location.
Install
curl -fsSL https://code-server.dev/install.sh | sh # uses .deb/.rpm on Debian/Ubuntu/RHEL-family
sudo systemctl enable --now code-server@$USER
The service runs as your user, with the same home directory, SSH keys and tools as your shell. Review install scripts before piping them to a shell if you prefer: the script supports --dry-run.
Configure
~/.config/code-server/config.yaml:
bind-addr: 127.0.0.1:8080
auth: password
password: a-long-random-password
cert: false
sudo systemctl restart code-server@$USER
Keep bind-addr on 127.0.0.1, and put HTTPS in front. Or skip the web exposure entirely and use an SSH tunnel: ssh -L 8080:127.0.0.1:8080 user@server. See SSH tunnelling.
To use a hashed password instead of plain text, set hashed-password (an argon2 hash) in the config.
Nginx with HTTPS and WebSockets
server {
server_name code.example.com;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header Accept-Encoding gzip;
}
# listen 443 ssl; certbot --nginx -d code.example.com
}
The editor needs WebSockets. Without the Upgrade headers, it loads and then disconnects. See Nginx WebSocket proxy and Let’s Encrypt.
Extra protection
code-server’s password is a single shared secret, and the session gives a full shell as your user. Add another layer:
- SSO in front (oauth2-proxy, Authelia or Authentik), or Nginx basic auth. See Authelia.
- VPN-only access (WireGuard or Tailscale), with no public exposure at all. See Tailscale.
- Fail2ban on the Nginx logs, and a strong password. See Fail2ban.
- Don’t run it as root.
Extensions
code-server uses the Open VSX registry by default, because Microsoft’s marketplace terms restrict it to official products. Most popular extensions (Python, Go, Rust Analyzer, ESLint, Prettier, GitLens) are on Open VSX. For others, install a .vsix file: Extensions view → “…” → Install from VSIX.
Port forwarding for web apps
When you run a dev server (for example on port 3000), code-server can proxy it at https://code.example.com/proxy/3000/. Or configure a wildcard subdomain (--proxy-domain) so each port gets 3000.code.example.com. Both use code-server’s authentication.
Make it a real dev box
- Install your toolchains as your user: Node via nvm, Python virtual environments, Go, Rust. See Python virtual environments.
- Add your user to the
dockergroup if you build containers. That group is root-equivalent, so only do it on a personal server. See Docker rootless mode. - Use
tmuxin the integrated terminal for long-running tasks, so they survive browser disconnects. See tmux. - Settings Sync from desktop VS Code doesn’t work with code-server. Keep
settings.jsonand your extension list in a dotfiles repository instead.
Updating
Re-run the install script (or install the new .deb), then restart: sudo systemctl restart code-server@$USER. Your settings and extensions live in ~/.local/share/code-server.
Quick reference
| Item | Value |
|---|---|
| Service | code-server@$USER |
| Config | ~/.config/code-server/config.yaml |
| Default port | 8080 (bind to 127.0.0.1) |
| Data and extensions | ~/.local/share/code-server |
| App preview | /proxy/<port>/ |
Related: Jupyter server and Linux server hardening.