code-server Documentation

README Copy Section

code-server

Run VS Code on any machine anywhere and
access it in the browser.

Highlights Copy Chapter

• Code on any device with a consistent development environment
• Use cloud servers to speed up tests, compilations, downloads, and more
• Preserve battery life when you're on the go; all intensive tasks run on your
  server

Requirements Copy Chapter

See requirements for minimum specs, as well as instructions
on how to set up a Google VM on which you can install code-server.

TL;DR: Linux machine with WebSockets enabled, 1 GB RAM, and 2 vCPUs

Getting started Copy Chapter

There are five ways to get started:

1. Using the install
   script, which
   automates most of the process. The script uses the system package manager if
   possible.
2. Manually installing
   code-server
3. Deploy code-server to your team with coder/coder
4. Using our one-click buttons and guides to deploy code-server to a cloud
   provider ⚡
5. Using the code-server feature for
   devcontainers,
   if you already use devcontainers in your project.

If you use the install script, you can preview what occurs during the install
process:

curl -fsSL https://code-server.dev/install.sh | sh -s -- --dry-run

To install, run:

curl -fsSL https://code-server.dev/install.sh | sh

When done, the install script prints out instructions for running and starting
code-server.

Note
To manage code-server for a team on your infrastructure, see: coder/coder

We also have an in-depth setup and
configuration guide.

Questions? Copy Chapter

See answers to frequently asked
questions.

Want to help? Copy Chapter

See Contributing for
details.

Hiring Copy Chapter

Interested in working at Coder? Check out our open
positions!

For Teams Copy Chapter

We develop coder/coder to help teams to
adopt remote development.

Android Copy Section

Running code-server using UserLAnd

1. Install UserLAnd from Google Play
2. Install an Ubuntu VM
3. Start app
4. Install Node.js and curl using sudo apt install nodejs npm curl -y
5. Install nvm:

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash

6. Exit the terminal using exit and then reopen the terminal
7. Install and use Node.js 22:

nvm install 22
nvm use 22

8. Install code-server globally on device with: npm install code-server
9. Run code-server with code-server
10. Access on localhost:8080 in your browser

Running code-server using Nix-on-Droid

1. Install Nix-on-Droid from F-Droid
2. Start app
3. Spawn a shell with code-server by running nix-shell -p code-server
4. Run code-server with code-server
5. Access on localhost:8080 in your browser

CODE OF CONDUCT Copy Section

Contributor Covenant Code of Conduct

• Contributor Covenant Code of Conduct
  • Our Pledge
  • Our Standards
  • Our Responsibilities
  • Scope
  • Enforcement
  • Attribution

Contributor Covenant Code of Conduct

Our Pledge Copy Chapter

In the interest of fostering an open and welcoming environment, we as
contributors and maintainers pledge to making participation in our project and
our community a harassment-free experience for everyone, regardless of age, body
size, disability, ethnicity, sex characteristics, gender identity and expression,
level of experience, education, socio-economic status, nationality, personal
appearance, race, religion, or sexual identity and orientation.

Our Standards Copy Chapter

Examples of behavior that contributes to creating a positive environment
include:

• Using welcoming and inclusive language
• Being respectful of differing viewpoints and experiences
• Gracefully accepting constructive criticism
• Focusing on what is best for the community
• Showing empathy towards other community members

Examples of unacceptable behavior by participants include:

• The use of sexualized language or imagery and unwelcome sexual attention or
  advances
• Trolling, insulting/derogatory comments, and personal or political attacks
• Public or private harassment
• Publishing others' private information, such as a physical or electronic
  address, without explicit permission
• Other conduct which could reasonably be considered inappropriate in a
  professional setting

Our Responsibilities Copy Chapter

Project maintainers are responsible for clarifying the standards of acceptable
behavior and are expected to take appropriate and fair corrective action in
response to any instances of unacceptable behavior.

Project maintainers have the right and responsibility to remove, edit, or
reject comments, commits, code, wiki edits, issues, and other contributions
that are not aligned to this Code of Conduct, or to ban temporarily or
permanently any contributor for other behaviors that they deem inappropriate,
threatening, offensive, or harmful.

Scope Copy Chapter

This Code of Conduct applies both within project spaces and in public spaces
when an individual is representing the project or its community. Examples of
representing a project or community include using an official project e-mail
address, posting via an official social media account, or acting as an appointed
representative at an online or offline event. Representation of a project may be
further defined and clarified by project maintainers.

Enforcement Copy Chapter

Instances of abusive, harassing, or otherwise unacceptable behavior may be
reported by contacting the project team at [email protected]. All
complaints will be reviewed and investigated and will result in a response that
is deemed necessary and appropriate to the circumstances. The project team is
obligated to maintain confidentiality with regard to the reporter of an incident.
Further details of specific enforcement policies may be posted separately.

Project maintainers who do not follow or enforce the Code of Conduct in good
faith may face temporary or permanent repercussions as determined by other
members of the project's leadership.

Attribution Copy Chapter

This Code of Conduct is adapted from the Contributor Covenant, version 1.4,
available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html

For answers to common questions about this code of conduct, see
https://www.contributor-covenant.org/faq

Coder Copy Section

Coder

To install and run code-server in a Coder workspace, we suggest using the install.sh
script in your template like so:

resource "coder_agent" "dev" {
  arch           = "amd64"
  os             = "linux"
  startup_script = <<EOF
    #!/bin/sh
    set -x
    # install and start code-server
    curl -fsSL https://code-server.dev/install.sh | sh -s -- --version 4.8.3
    code-server --auth none --port 13337 &
    EOF
}

resource "coder_app" "code-server" {
  agent_id     = coder_agent.dev.id
  slug         = "code-server"
  display_name = "code-server"
  url          = "http://localhost:13337/"
  icon         = "/icon/code.svg"
  subdomain    = false
  share        = "owner"

  healthcheck {
    url       = "http://localhost:13337/healthz"
    interval  = 3
    threshold = 10
  }
}

Or use our official code-server module from the Coder module registry:

module "code-server" {
  source     = "registry.coder.com/modules/code-server/coder"
  version    = "1.0.5"
  agent_id   = coder_agent.example.id
  extensions = ["dracula-theme.theme-dracula", "ms-azuretools.vscode-docker"]
}

If you run into issues, ask for help on the coder/coder Discussions
here.

Collaboration Copy Section

Collaboration

With third-party extensions, you can use code-server to collaborate with other developers in real time.

Code sharing using Duckly Copy Chapter

Duckly allows you to share your code in real-time even with people using different IDEs (like JetBrains and VSCode).

• Cross-IDE support,
• Real-time typing,
• P2P encrypted,
• Voice and audio chat,
• Terminal sharing

Installing the Duckly Extension Copy Section

Duckly uses an extension to provide real time sharing features

1. Install the Duckly extension from OpenVSX on code-server.

SERVICE_URL=https://open-vsx.org/vscode/gallery \
  ITEM_URL=https://open-vsx.org/vscode/item \
  code-server --install-extension gitduck.code-streaming

2. Refresh you code-server window. You should now be able to see the Duckly extension.

Sharing with Duckly Copy Section

As code-server is based on VS Code, you can follow the steps described on Duckly's Pair programming with VS Code page and skip the installation step.

Code sharing using CodeTogether Copy Chapter

CodeTogether is a real-time cross-IDE replacement for Microsoft Live Share providing:

• Cross-IDE support - between VS Code, Eclipse, IntelliJ and IDEs based on them (browser or desktop)
• Real-time editing - shared or individual cursors for pairing, mobbing, swarming, or whatever
• P2P encrypted - servers can't decrypt the traffic (Security Details)
• SaaS or On-premises options
• Shared servers, terminals, and consoles
• Unit Testing - with support for Red, Green, Refactor TDD
• Joining via a web browser or your preferred IDE
• Free unlimited 1 hour sessions with 4 participants
• Multiple plans including free or paid options

Installing the CodeTogether extension Copy Section

1. Install the CodeTogether extension from OpenVSX on code-server.

   sh Copy

   SERVICE_URL=https://open-vsx.org/vscode/gallery \
     ITEM_URL=https://open-vsx.org/vscode/item \
     code-server --install-extension genuitecllc.codetogether

2. CodeTogether requires VS Code's proposed API to run. Start code-server with the following flag:

   sh Copy

   code-server --enable-proposed-api genuitecllc.codetogether

   Another option would be to add a value in code-server's config file.

3. Refresh code-server and navigate to the CodeTogether icon in the sidebar to host or join a coding session.

CONTRIBUTING Copy Section

Contributing

• Requirements
  • Linux-specific requirements
• Development workflow
  • Version updates to Code
  • Patching Code
  • Build
  • Troubleshooting
    • I see "Forbidden access" when I load code-server in the browser
    • "Can only have one anonymous define call per script"
  • Help
• Test
  • Unit tests
  • Script tests
  • Integration tests
  • End-to-end tests
• Structure
  • Modifications to Code
  • Currently Known Issues

Requirements Copy Chapter

The prerequisites for contributing to code-server are almost the same as those
for VS Code.
Here is what is needed:

• node v22.x
• git v2.x or greater
• git-lfs
• npm
  • Used to install JS packages and run scripts
• nfpm
  • Used to build .deb and .rpm packages
• jq
  • Used to build code-server releases
• gnupg
  • All commits must be signed and verified; see GitHub's Managing commit
    signature
    verification
    or follow this tutorial
• quilt
  • Used to manage patches to Code
• rsync and unzip
  • Used for code-server releases
• bats
  • Used to run script unit tests

Linux-specific requirements Copy Section

If you're developing code-server on Linux, make sure you have installed or
install the following dependencies:

sudo apt-get install build-essential g++ libx11-dev libxkbfile-dev libsecret-1-dev libkrb5-dev python-is-python3

These are required by Code. See their Wiki
for more information.

Development workflow Copy Chapter

1. git clone https://github.com/coder/code-server.git - Clone code-server
2. git submodule update --init - Clone vscode submodule
3. quilt push -a - Apply patches to the vscode submodule.
4. npm install - Install dependencies
5. npm run watch - Launch code-server localhost:8080. code-server will be live
   reloaded when changes are made; the browser needs to be refreshed manually.

When pulling down changes that include modifications to the patches you will
need to apply them with quilt. If you pull down changes that update the
vscode submodule you will need to run git submodule update --init and
re-apply the patches.

When you make a change that affects people deploying the marketplace please
update the changelog as part of your PR.

Note that building code-server takes a very, very long time, and loading it in
the browser in development mode also takes a very, very long time.

Display language (Spanish, etc) support only works in a full build; it will not
work in development mode.

Generally we prefer that PRs be squashed into main but you can rebase or merge
if it is important to keep the individual commits (make sure to clean up the
commits first if you are doing this).

Version updates to Code Copy Section

PRs will be automatically created with updates to VS Code. If a patch cannot be
automatically resolved, it will be necessary to clone the branch, resolve the
conflicts manually, and finish the update. To do this:

1. Apply as many patches as possible quilt push -a.
2. Once you hit a conflict, force apply with quilt push -f, manually add back
   the rejected code, then run quilt refresh.
3. Once all patches have been resolved, run ./ci/build/update.sh to finish the
   update process.
4. Commit all changes, push them up to the branch, and update the checklist in
   the PR description.

Once the PR is ready, manually verify that the unreleased changelog section
contains all the changes going into this version before merging.

Patching Code Copy Section

1. You can go through the patch stack with quilt push and quilt pop.
2. Create a new patch (quilt new {name}.diff) or use an existing patch.
3. Add the file(s) you are patching (quilt add [-P patch] {file}). A file
   must be added before you make changes to it.
4. Make your changes. Patches do not need to be independent of each other but
   each patch must result in a working code-server without any broken in-between
   states otherwise they are difficult to test and modify.
5. Add your changes to the patch (quilt refresh)
6. Add a comment in the patch about the reason for the patch and how to
   reproduce the behavior it fixes or adds. Every patch should have an e2e test
   as well.

Build Copy Section

You can build a full production release as follows:

git submodule update --init
quilt push -a
npm install
npm run build
VERSION=0.0.0 npm run build:vscode
KEEP_MODULES=1 npm run release

You can omit KEEP_MODULES if you intend to use this in a platform-agnostic way
(like for publishing to NPM), but since the VS Code build process does
post-processing deletion of the modules, it is recommended to keep the modules
when possible, since if you install them later you will have more than is
required. KEEP_MODULES will also bundle Node and the code-server entry script.

Run your build:

./release/bin/code-server

Or if you omitted KEEP_MODULES:

cd release
npm install --omit=dev
node .

Then, to package the release:

npm run package

On Linux, the currently running distro will become the minimum supported
version. In our GitHub Actions CI, we use CentOS 8 for maximum compatibility.
If you need your builds to support older distros, run the build commands
inside a Docker container with all the build requirements installed.

Troubleshooting Copy Section

I see "Forbidden access" when I load code-server in the browser

This means your patches didn't apply correctly. We have a patch to remove the
auth from vanilla Code because we use our own.

Try popping off the patches with quilt pop -a and reapplying with quilt push -a.

"Can only have one anonymous define call per script"

Code might be trying to use a dev or prod HTML in the wrong context. You can try
re-running code-server and setting VSCODE_DEV=1.

Help Copy Section

If you get stuck or need help, you can always start a new GitHub Discussion
here. One of the maintainers
will respond and help you out.

Test Copy Chapter

There are four kinds of tests in code-server:

1. Unit tests
2. Script tests
3. Integration tests
4. End-to-end tests

Unit tests Copy Section

Our unit tests are written in TypeScript and run using
Jest, the testing framework].

These live under test/unit.

We use unit tests for functions and things that can be tested in isolation. The
file structure is modeled closely after /src so it's easy for people to know
where test files should live.

Script tests Copy Section

Our script tests are written in bash and run using bats.

These tests live under test/scripts.

We use these to test anything related to our scripts (most of which live under
ci).

Integration tests Copy Section

These are a work in progress. We build code-server and run tests with npm run test:integration, which ensures that code-server builds work on their
respective platforms.

Our integration tests look at components that rely on one another. For example,
testing the CLI requires us to build and package code-server.

End-to-end tests Copy Section

The end-to-end (e2e) tests are written in TypeScript and run using
Playwright.

These live under test/e2e.

Before the e2e tests run, we run globalSetup, which eliminates the need to log
in before each test by preserving the authentication state.

Take a look at codeServer.test.ts to see how you would use it (see
test.use).

We also have a model where you can create helpers to use within tests. See
models/CodeServer.ts for an example.

Structure Copy Chapter

code-server essentially serves as an HTTP API for logging in and starting a
remote Code process.

The CLI code is in src/node and the HTTP routes are implemented
in src/node/routes.

Most of the meaty parts are in the Code portion of the codebase under
lib/vscode, which we describe next.

Modifications to Code Copy Section

Our modifications to Code can be found in the patches directory.
We pull in Code as a submodule pointing to an upstream release branch.

In v1 of code-server, we had Code as a submodule and used a single massive patch
that split the codebase into a front-end and a server. The front-end consisted
of the UI code, while the server ran the extensions and exposed an API to the
front-end for file access and all UI needs.

Over time, Microsoft added support to Code to run it on the web. They had made
the front-end open source, but not the server. As such, code-server v2 (and
later) uses the Code front-end and implements the server. We did this by using a
Git subtree to fork and modify Code.

Microsoft eventually made the server open source and we were able to reduce our
changes significantly. Some time later we moved back to a submodule and patches
(managed by quilt this time instead of the mega-patch).

As the web portion of Code continues to mature, we'll be able to shrink and
possibly eliminate our patches. In the meantime, upgrading the Code version
requires us to ensure that our changes are still applied correctly and work as
intended. In the future, we'd like to run Code unit tests against our builds to
ensure that features work as expected.

We have extension docs on the CI and build system.

If the functionality you're working on does NOT depend on code from Code, please
move it out and into code-server.

Currently Known Issues Copy Section

• Creating custom Code extensions and debugging them doesn't work
• Extension profiling and tips are currently disabled

FAQ Copy Section

FAQ

• Questions?
• How should I expose code-server to the internet?
• Can I use code-server on the iPad?
• How does the config file work?
• How do I make my keyboard shortcuts work?
• Why can't code-server use Microsoft's extension marketplace?
• How can I request an extension that's missing from the marketplace?
• How do I install an extension?
• How do I install an extension manually?
• How do I use my own extensions marketplace?
• Where are extensions stored?
• Where is VS Code configuration stored?
• How can I reuse my VS Code configuration?
• How does code-server decide what workspace or folder to open?
• Can I open a file at a specific line from a URL?
• How do I access my Documents/Downloads/Desktop folders in code-server on macOS?
• How do I direct server-side requests through a proxy?
• How do I debug issues with code-server?
• What is the healthz endpoint?
• What is the heartbeat file?
• How do I change the reconnection grace time?
• How do I change the password?
• Can I store my password hashed?
• Is multi-tenancy possible?
• Can I use Docker in a code-server container?
• How do I disable telemetry?
• What's the difference between code-server and Coder?
• What's the difference between code-server and Theia?
• What's the difference between code-server and OpenVSCode-Server?
• What's the difference between code-server and GitHub Codespaces?
• What's the difference between code-server and VS Code web?
• Does code-server have any security login validation?
• Are there community projects involving code-server?
• How do I change the port?
• How do I hide the coder/coder promotion in Help: Getting Started?
• How do I disable the proxy?
• How do I disable file download?
• Why do web views not work?

Questions? Copy Chapter

Please file all questions and support requests at
https://github.com/coder/code-server/discussions.

How should I expose code-server to the internet? Copy Chapter

Please see our instructions on exposing code-server safely to the
internet.

Can I use code-server on the iPad? Copy Chapter

See iPad for information on using code-server on the iPad.

How does the config file work? Copy Chapter

When code-server starts up, it creates a default config file in ~/.config/code-server/config.yaml:

bind-addr: 127.0.0.1:8080
auth: password
password: mew...22 # Randomly generated for each config.yaml
cert: false

The default config defines the following behavior:

• Listen on the loopback IP port 8080
• Enable password authorization
• Do not use TLS

Each key in the file maps directly to a code-server flag (run code-server --help to see a listing of all the flags). Any flags passed to code-server
will take priority over the config file.

You can change the config file's location using the --config flag or
$CODE_SERVER_CONFIG environment variable.

The default location respects $XDG_CONFIG_HOME.

How do I make my keyboard shortcuts work? Copy Chapter

Many shortcuts will not work by default, since they'll be "caught" by the browser.

If you use Chrome, you can work around this by installing the progressive web
app (PWA):

1. Start the editor
2. Click the plus icon in the URL toolbar to install the PWA

If you use Firefox, you can use the appropriate extension to install PWA.

1. Go to the installation website of the add-on
2. Add the add-on to Firefox
3. Follow the os-specific instructions on how to install the runtime counterpart

For other browsers, you'll have to remap keybindings for shortcuts to work.

Why can't code-server use Microsoft's extension marketplace? Copy Chapter

Though code-server takes the open-source core of VS Code and allows you to run
it in the browser, it is not entirely equivalent to Microsoft's VS Code.

One major difference is in regards to extensions and the marketplace. The core
of VS code is open source, while the marketplace and many published Microsoft
extensions are not. Furthermore, Microsoft prohibits the use of any
non-Microsoft VS Code from accessing their marketplace. Per the Terms of
Service:

Marketplace Offerings are intended for use only with Visual Studio Products
and Services, and you may only install and use Marketplace Offerings with
Visual Studio Products and Services.

Because of this, we can't offer any extensions on Microsoft's marketplace.
Instead, we use the Open-VSX extension gallery, which is also used by various other forks.
It isn't perfect, but its getting better by the day with more and more extensions.

We also offer our own marketplace for open source extensions, but plan to
deprecate it at a future date and completely migrate to Open-VSX.

These are the closed-source extensions that are presently unavailable:

1. Live Share. We may
   implement something similar (see
   #33)
2. Remote Extensions (SSH, Containers,
   WSL). We may implement
   these again at some point, see
   (#1315).

For more about the closed source portions of VS Code, see vscodium/vscodium.

How can I request an extension that's missing from the marketplace? Copy Chapter

To add an extension to Open-VSX, please see open-vsx/publish-extensions.
We no longer plan to add new extensions to our legacy extension gallery.

How do I install an extension? Copy Chapter

You can install extensions from the marketplace using the extensions sidebar in
code-server or from the command line:

code-server --install-extension <extension id>
# example: code-server --install-extension wesbos.theme-cobalt2

# From the Coder extension marketplace
code-server --install-extension ms-python.python

# From a downloaded VSIX on the file system
code-server --install-extension downloaded-ms-python.python.vsix

How do I install an extension manually? Copy Chapter

If there's an extension unavailable in the marketplace or an extension that
doesn't work, you can download the VSIX from its GitHub releases or build it
yourself.

Once you have downloaded the VSIX to the remote machine, you can either:

• Run the Extensions: Install from VSIX command in the Command Palette.
• Run code-server --install-extension in the terminal

You can also download extensions using the command line. For instance,
downloading from OpenVSX can be done like this:

code-server --install-extension <extension id>

How do I use my own extensions marketplace? Copy Chapter

If you own a marketplace that implements the VS Code Extension Gallery API, you
can point code-server to it by setting $EXTENSIONS_GALLERY.
This corresponds directly with the extensionsGallery entry in in VS Code's product.json.

For example:

export EXTENSIONS_GALLERY='{"serviceUrl": "https://my-extensions/api"}'

Though you can technically use Microsoft's marketplace in this manner, we
strongly discourage you from doing so since this is against their Terms of Use.

For further information, see this
discussion
regarding the use of the Microsoft URLs in forks, as well as VSCodium's
docs.

Where are extensions stored? Copy Chapter

Extensions are stored in ~/.local/share/code-server/extensions by default.

On Linux and macOS if you set the XDG_DATA_HOME environment variable, the
extensions directory will be $XDG_DATA_HOME/code-server/extensions. In
general, we try to follow the XDG directory spec.

Where is VS Code configuration stored? Copy Chapter

VS Code configuration such as settings and keybindings are stored in
~/.local/share/code-server by default.

On Linux and macOS if you set the XDG_DATA_HOME environment variable, the data
directory will be $XDG_DATA_HOME/code-server. In general, we try to follow the
XDG directory spec.

How can I reuse my VS Code configuration? Copy Chapter

You can use the Settings
Sync
extension for this purpose.

Alternatively, you can also pass --user-data-dir ~/.vscode or copy ~/.vscode
into ~/.local/share/code-server to reuse your existing VS Code extensions and
configuration.

How does code-server decide what workspace or folder to open? Copy Chapter

code-server tries the following in this order:

1. The workspace query parameter
2. The folder query parameter
3. The workspace or directory passed via the command line
4. The last opened workspace or directory

Can I open a file at a specific line from a URL? Copy Chapter

Yes. In addition to workspace and folder, code-server supports VS Code's
payload query parameter, which can open a specific file — optionally at a
line and column — once the workbench loads.

payload is a URL-encoded JSON array of [key, value] string pairs. The
openFile key takes a vscode-remote://<host>/<absolute path> URI, where
<host> is the host you use to reach code-server. Add
["gotoLineMode","true"] to have a trailing :line[:column] suffix on the
path interpreted as a cursor position:

https://code.example.com/?folder=/home/coder/project&payload=[["gotoLineMode","true"],["openFile","vscode-remote://code.example.com/home/coder/project/src/app.py:10:5"]]

(with the payload value URL-encoded). Notes:

• Paths must be absolute; there is no form relative to folder.
• This is upstream VS Code web behavior (the same mechanism vscode.dev uses),
  so it works without any code-server-specific configuration.

For example, to generate links from a shell:

#!/bin/sh
# usage: code-link <absolute-file> [line[:column]]
HOST=code.example.com
payload="[[\"gotoLineMode\",\"true\"],[\"openFile\",\"vscode-remote://$HOST$1${2:+:$2}\"]]"
printf 'https://%s/?folder=%s&payload=%s\n' "$HOST" "$(dirname "$1")" \
  "$(printf '%s' "$payload" | jq -sRr @uri)"

How do I access my Documents/Downloads/Desktop folders in code-server on macOS? Copy Chapter

Newer versions of macOS require permission through a non-UNIX mechanism for
code-server to access the Desktop, Documents, Pictures, Downloads, and other folders.

You may have to give Node.js full disk access, since it doesn't implement any of the macOS permission request features natively:

1. Find where Node.js is installed on your machine

   console Copy

   $ which node
   /usr/local/bin/node

2. Grant Node.js full disk access. Open System Preferences > Security &
   Privacy > Privacy > Full Disk Access. Then, click the 🔒 to unlock,
   click +, and select the Node.js binary you located in the previous step.

See #2794 for additional context.

How do I direct server-side requests through a proxy? Copy Chapter

code-server proxies only server-side requests.

To direct server-side requests through a proxy, code-server supports the
following environment variables:

• $HTTP_PROXY
• $HTTPS_PROXY
• $NO_PROXY

export HTTP_PROXY=https://134.8.5.4
export HTTPS_PROXY=https://134.8.5.4
# Now all of code-server's server side requests will go through
# https://134.8.5.4 first.
code-server

• See
  proxy-from-env
  for a detailed reference on these environment variables and their syntax (note
  that code-server only uses the http and https protocols).
• See proxy-agent for information
  on on the supported proxy protocols.

How do I debug issues with code-server? Copy Chapter

First, run code-server with the debug logging (or trace to be really
thorough) by setting the --log flag or the LOG_LEVEL environment variable.
-vvv and --verbose are aliases for --log trace.

First, run code-server with debug logging (or trace logging for more
thorough messages) by setting the --log flag or the LOG_LEVEL environment
variable.

code-server --log debug

Note that the -vvv and --verbose flags are aliases for --log trace.

Next, replicate the issue you're having so that you can collect logging
information from the following places:

1. The most recent files from ~/.local/share/code-server/coder-logs
2. The browser console
3. The browser network tab

Additionally, collecting core dumps (you may need to enable them first) if
code-server crashes can be helpful.

What is the healthz endpoint? Copy Chapter

You can use the /healthz endpoint exposed by code-server to check whether
code-server is running without triggering a heartbeat. The response includes a
status (e.g., alive or expired) and a timestamp for the last heartbeat
(the default is 0).

{
  "status": "alive",
  "lastHeartbeat": 1599166210566
}

This endpoint doesn't require authentication.

What is the heartbeat file? Copy Chapter

As long as there is an active browser connection, code-server touches
~/.local/share/code-server/heartbeat once a minute.

If you want to shutdown code-server if there hasn't been an active connection
after a predetermined amount of time, you can use the --idle-timeout-seconds flag
or set an CODE_SERVER_IDLE_TIMEOUT_SECONDS environment variable.

How do I change the reconnection grace time? Copy Chapter

Pass --reconnection-grace-time <seconds> to code-server, set
CODE_SERVER_RECONNECTION_GRACE_TIME=<seconds>, or add
reconnection-grace-time: <seconds> to
~/.config/code-server/config.yaml.

The default is 10800 (3 hours). If a client stays disconnected longer than
this, it must reload the window.

How do I change the password? Copy Chapter

Edit the password field in the code-server config file at
~/.config/code-server/config.yaml, then restart code-server:

sudo systemctl restart code-server@$USER

Can I store my password hashed? Copy Chapter

Yes, you can do so by setting the value of hashed-password instead of password. Generate the hash with:

echo -n "thisismypassword" | npx argon2-cli -e
$argon2i$v=19$m=4096,t=3,p=1$wst5qhbgk2lu1ih4dmuxvg$ls1alrvdiwtvzhwnzcm1dugg+5dto3dt1d5v9xtlws4

Replace thisismypassword with your actual password and remember to put it
inside quotes! For example:

auth: password
hashed-password: "$argon2i$v=19$m=4096,t=3,p=1$wST5QhBgk2lu1ih4DMuxvg$LS1alrVdIWtvZHwnzCM1DUGg+5DTO3Dt1d5v9XtLws4"

The hashed-password field takes precedence over password.

If you're using Docker Compose file, in order to make this work, you need to change all the single $ to $$. For example:

- HASHED_PASSWORD=$$argon2i$$v=19$$m=4096,t=3,p=1$$wST5QhBgk2lu1ih4DMuxvg$$LS1alrVdIWtvZHwnzCM1DUGg+5DTO3Dt1d5v9XtLws4

Is multi-tenancy possible? Copy Chapter

If you want to run multiple code-servers on shared infrastructure, we recommend
using virtual machines (provide one VM per user). This will easily allow users
to run a Docker daemon. If you want to use Kubernetes, you'll want to
use kubevirt or
sysbox to give each user a VM-like
experience instead of just a container.

Can I use Docker in a code-server container? Copy Chapter

If you'd like to access Docker inside of code-server, mount the Docker socket in
from /var/run/docker.sock. Then, install the Docker CLI in the code-server
container, and you should be able to access the daemon.

You can even make volume mounts work. Let's say you want to run a container and
mount into /home/coder/myproject from inside the code-server container. You
need to make sure the Docker daemon's /home/coder/myproject is the same as the
one mounted inside the code-server container, and the mount will work.

If you want Docker enabled when deploying on Kubernetes, look at the values.yaml
file for the 3 fields: extraVars, lifecycle.postStart, and extraContainers.

How do I disable telemetry? Copy Chapter

Use the --disable-telemetry flag to disable telemetry.

We use the data collected only to improve code-server.

What's the difference between code-server and Coder? Copy Chapter

code-server and Coder are both applications that can be installed on any
machine. The main difference is who they serve. Out of the box, code-server is
simply VS Code in the browser while Coder is a tool for provisioning remote
development environments via Terraform.

code-server was built for individuals while Coder was built for teams. In Coder, you create Workspaces which can have applications like code-server. If you're looking for a team solution, you should reach for Coder.

What's the difference between code-server and Theia? Copy Chapter

At a high level, code-server is a patched fork of VS Code that runs in the
browser whereas Theia takes some parts of VS Code but is an entirely different
editor.

Theia is a browser IDE loosely based
on VS Code. It uses the same text editor library
(Monaco) and extension API, but
everything else is different. Theia also uses Open VSX
for extensions.

Theia doesn't allow you to reuse your existing VS Code config.

What's the difference between code-server and OpenVSCode-Server? Copy Chapter

code-server and OpenVSCode-Server both allow you to access VS Code via a
browser. OpenVSCode-Server is a direct fork of VS Code with changes comitted
directly while code-server pulls VS Code in via a submodule and makes changes
via patch files.

However, OpenVSCode-Server is scoped at only making VS Code available as-is in
the web browser. code-server contains additional changes to make the self-hosted
experience better (see the next section for details).

What's the difference between code-server and GitHub Codespaces? Copy Chapter

Both code-server and GitHub Codespaces allow you to access VS Code via a
browser. GitHub Codespaces, however, is a closed-source, paid service offered by
GitHub and Microsoft.

On the other hand, code-server is self-hosted, free, open-source, and can be run
on any machine with few limitations.

Specific changes include:

• Password authentication
• The ability to host at sub-paths
• Self-contained web views that do not call out to Microsoft's servers
• The ability to use your own marketplace and collect your own telemetry
• Built-in proxy for accessing ports on the remote machine integrated into
  VS Code's ports panel
• Settings are stored on disk like desktop VS Code, instead of in browser
  storage (note that state is still stored in browser storage).
• Wrapper process that spawns VS Code on-demand and has a separate CLI
• Notification when updates are available
• Some other things

Some of these changes appear very unlikely to ever be adopted by Microsoft.
Some may make their way upstream, further closing the gap, but at the moment it
looks like there will always be some subtle differences.

What's the difference between code-server and VS Code web? Copy Chapter

VS Code web (which can be ran using code serve-web) has the same differences
as the Codespaces section above. VS Code web can be a better choice if you need
access to the official Microsoft marketplace.

Does code-server have any security login validation? Copy Chapter

code-server supports setting a single password and limits logins to two per
minute plus an additional twelve per hour.

Are there community projects involving code-server? Copy Chapter

Visit the awesome-code-server
repository to view community projects and guides with code-server! Feel free to
add your own!

How do I change the port? Copy Chapter

There are two ways to change the port on which code-server runs:

1. with an environment variable e.g. PORT=3000 code-server
2. using the flag --bind-addr e.g. code-server --bind-addr localhost:3000

How do I hide the coder/coder promotion in Help: Getting Started? Copy Chapter

You can pass the flag --disable-getting-started-override to code-server or
you can set the environment variable CS_DISABLE_GETTING_STARTED_OVERRIDE=1 or
CS_DISABLE_GETTING_STARTED_OVERRIDE=true.

How do I disable the proxy? Copy Chapter

You can pass the flag --disable-proxy to code-server or
you can set the environment variable CS_DISABLE_PROXY=1 or
CS_DISABLE_PROXY=true.

Note, this option currently only disables the proxy routes to forwarded ports, including
the domain and path proxy routes over HTTP and WebSocket; however, it does not
disable the automatic port forwarding in the VS Code workbench itself. In other words,
user will still see the Ports tab and notifications, but will not be able to actually
use access the ports. It is recommended to set remote.autoForwardPorts to false
when using the option.

How do I disable file download? Copy Chapter

You can pass the flag --disable-file-downloads to code-server

Why do web views not work? Copy Chapter

Web views rely on service workers, and service workers are only available in a
secure context, so most likely the answer is that you are using an insecure
context (for example an IP address).

If this happens, in the browser log you will see something like:

Error loading webview: Error: Could not register service workers: SecurityError: Failed to register a ServiceWorker for scope with script: An SSL certificate error occurred when fetching the script..

To fix this, you must either:

• Access over localhost/127.0.0.1 which is always considered secure.
• Use a domain with a real certificate (for example with Let's Encrypt).
• Use a trusted self-signed certificate with mkcert (or
  create and trust a certificate manually).
• Disable security if your browser allows it. For example, in Chromium see
  chrome://flags/#unsafely-treat-insecure-origin-as-secure

Guide Copy Section

Setup Guide

• Expose code-server
  • Port forwarding via SSH
  • Using Let's Encrypt with Caddy
  • Using Let's Encrypt with NGINX
  • Using a self-signed certificate
  • TLS 1.3 and Safari
• External authentication
• HTTPS and self-signed certificates
• Accessing web services
  • Using a subdomain
  • Using a subpath
  • Using your own proxy
  • Stripping /proxy/ from the request path
  • Proxying to create a React app
  • Proxying to a Vue app
  • Proxying to an Angular app
  • Proxying to a Svelte app
  • Prefixing /absproxy/ with a path
  • Preflight requests
• Internationalization and customization
  • Available keys and placeholders
  • Legacy flag

This article will walk you through exposing code-server securely once you've
completed the installation process.

Expose code-server Copy Chapter

Never expose code-server directly to the internet without some form of
authentication and encryption, otherwise someone can take over your machine via
the terminal.

By default, code-server uses password authentication. As such, you must copy the
password from code-server's config file to log in. To avoid exposing itself
unnecessarily, code-server listens on localhost; this practice is fine for
testing, but it doesn't work if you want to access code-server from a different
machine.

Rate limits: code-server rate limits password authentication attempts to
two per minute plus an additional twelve per hour.

There are several approaches to operating and exposing code-server securely:

• Port forwarding via SSH
• Using Let's Encrypt with Caddy
• Using Let's Encrypt with NGINX
• Using a self-signed certificate

Port forwarding via SSH Copy Section

We highly recommend using port forwarding via
SSH to access
code-server. If you have an SSH server on your remote machine, this approach
doesn't require any additional setup at all.

The downside to SSH forwarding, however, is that you can't access code-server
when using machines without SSH clients (such as iPads). If this applies to you,
we recommend using another method, such as Let's Encrypt instead.

To work properly, your environment should have WebSockets enabled, which
code-server uses to communicate between the browser and server.

1. SSH into your instance and edit the code-server config file to disable
   password authentication:

   console Copy

   # Replaces "auth: password" with "auth: none" in the code-server config.
   sed -i.bak 's/auth: password/auth: none/' ~/.config/code-server/config.yaml

2. Restart code-server:

   console Copy

   sudo systemctl restart code-server@$USER

3. Forward local port 8080 to 127.0.0.1:8080 on the remote instance by running the following command on your local machine:

   console Copy

   # -N disables executing a remote shell
   ssh -N -L 8080:127.0.0.1:8080 [user]@<instance-ip>

4. At this point, you can access code-server by pointing your web browser to http://127.0.0.1:8080.

5. If you'd like to make the port forwarding via SSH persistent, we recommend
   using mutagen
   to do so. Once you've installed mutagen, you can port forward as follows:

   shell Copy

   # This is the same as the above SSH command, but it runs in the background
   # continuously. Be sure to add `mutagen daemon start` to your ~/.bashrc to
   # start the mutagen daemon when you open a shell.
   mutagen forward create --name=code-server tcp:127.0.0.1:8080 < instance-ip > :tcp:127.0.0.1:8080

6. Optional, but highly recommended: add the following to ~/.ssh/config so
   that you can detect bricked SSH connections:

   bash Copy

   Host *
   ServerAliveInterval 5
   ExitOnForwardFailure yes

You can forward your
SSH and
GPG agent to the instance to
securely access GitHub and sign commits without having to copy your keys.

Using Let's Encrypt with Caddy Copy Section

Using Let's Encrypt is an option if you want to
access code-server on an iPad or do not want to use SSH port forwarding.

1. This option requires that the remote machine be exposed to the internet. Make sure that your instance allows HTTP/HTTPS traffic.

2. You'll need a domain name (if you don't have one, you can purchase one from
   Google Domains or the domain service of your
   choice). Once you have a domain name, add an A record to your domain that contains your
   instance's IP address.

3. Install Caddy:

   console Copy

   sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https
   curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
   curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
   sudo apt update
   sudo apt install caddy

4. Replace /etc/caddy/Caddyfile using sudo so that the file looks like this:

   text Copy

   mydomain.com {
     reverse_proxy 127.0.0.1:8080
   }

   If you want to serve code-server from a sub-path, you can do so as follows:

   text Copy

   mydomain.com/code/* {
     uri strip_prefix /code
     reverse_proxy 127.0.0.1:8080
   }

   Remember to replace mydomain.com with your domain name!

5. Reload Caddy:

   console Copy

   sudo systemctl reload caddy

At this point, you should be able to access code-server via
https://mydomain.com.

Using Let's Encrypt with NGINX Copy Section

1. This option requires that the remote machine be exposed to the internet. Make
   sure that your instance allows HTTP/HTTPS traffic.

2. You'll need a domain name (if you don't have one, you can purchase one from
   Google Domains or the domain service of your
   choice). Once you have a domain name, add an A record to your domain that contains your
   instance's IP address.

3. Install NGINX:

   bash Copy

   sudo apt update
   sudo apt install -y nginx certbot python3-certbot-nginx

4. Update /etc/nginx/sites-available/code-server using sudo with the following
   configuration:

   text Copy

   server {
       listen 80;
       listen [::]:80;
       server_name mydomain.com;
   
       location / {
         proxy_pass http://localhost:8080/;
         proxy_set_header Host $http_host;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection upgrade;
         proxy_set_header Accept-Encoding gzip;
       }
   }

   Be sure to replace mydomain.com with your domain name!

5. Enable the config:

   console Copy

   sudo ln -s ../sites-available/code-server /etc/nginx/sites-enabled/code-server
   sudo certbot --non-interactive --redirect --agree-tos --nginx -d mydomain.com -m [email protected]

   Be sure to replace [email protected] with your actual email.

At this point, you should be able to access code-server via
https://mydomain.com.

Using a self-signed certificate Copy Section

Self signed certificates do not work with iPad; see ./ipad.md for
more information.

Before proceeding, we recommend familiarizing yourself with the risks of
self-signing a certificate for
SSL.

We recommend self-signed certificates as a last resort, since self-signed
certificates do not work with iPads and may cause unexpected issues with
code-server. You should only proceed with this option if:

• You do not want to buy a domain or you cannot expose the remote machine to
  the internet
• You do not want to use port forwarding via SSH

To use a self-signed certificate:

1. This option requires that the remote machine be exposed to the internet. Make
   sure that your instance allows HTTP/HTTPS traffic.

2. SSH into your instance and edit your code-server config file to use a
   randomly generated self-signed certificate:

   console Copy

   # Replaces "cert: false" with "cert: true" in the code-server config.
   sed -i.bak 's/cert: false/cert: true/' ~/.config/code-server/config.yaml
   # Replaces "bind-addr: 127.0.0.1:8080" with "bind-addr: 0.0.0.0:443" in the code-server config.
   sed -i.bak 's/bind-addr: 127.0.0.1:8080/bind-addr: 0.0.0.0:443/' ~/.config/code-server/config.yaml
   # Allows code-server to listen on port 443.
   sudo setcap cap_net_bind_service=+ep /usr/lib/code-server/lib/node

3. Restart code-server:

   console Copy

   sudo systemctl restart code-server@$USER

At this point, you should be able to access code-server via
https://<your-instance-ip>.

If you'd like to avoid the warnings displayed by code-server when using a
self-signed certificate, you can use mkcert to create a
self-signed certificate that's trusted by your operating system, then pass the
certificate to code-server via the cert and cert-key config fields.

TLS 1.3 and Safari Copy Section

If you will be using Safari and your configuration does not allow anything less
than TLS 1.3 you will need to add support for TLS 1.2 since Safari does not
support TLS 1.3 for web sockets at the time of writing. If this is the case you
should see OSSStatus: 9836 in the browser console.

External authentication Copy Chapter

If you want to use external authentication mechanism (e.g., Sign in with
Google), you can do this with a reverse proxy such as:

• Pomerium
• oauth2-proxy
• Cloudflare Access

HTTPS and self-signed certificates Copy Chapter

For HTTPS, you can use a self-signed certificate by:

• Passing in --cert
• Passing in an existing certificate by providing the path to --cert and the
  path to the key with --cert-key

The self signed certificate will be generated to
~/.local/share/code-server/self-signed.crt.

If you pass a certificate to code-server, it will respond to HTTPS requests and
redirect all HTTP requests to HTTPS.

You can use Let's Encrypt to get a TLS certificate
for free.

Note: if you set proxy_set_header Host $host; in your reverse proxy config, it
will change the address displayed in the green section of code-server in the
bottom left to show the correct address.

Accessing web services Copy Chapter

If you're working on web services and want to access them locally, code-server
can proxy to any port using either a subdomain or a subpath, allowing you to
securely access these services using code-server's built-in authentication.

Using a subdomain Copy Section

You will need a DNS entry that points to your server for each port you want to
access. You can either set up a wildcard DNS entry for *.<domain> if your
domain name registrar supports it, or you can create one for every port you want
to access (3000.<domain>, 8080.<domain>, etc).

You should also set up TLS certificates for these subdomains, either using a
wildcard certificate for *.<domain> or individual certificates for each port.

To set your domain, start code-server with the --proxy-domain flag:

code-server --proxy-domain <domain>

For instance, if you have code-server exposed on domain.tld and a Python
server running on port 8080 of the same machine code-server is running on, you
could run code-server with --proxy-domain domain.tld and access the Python
server via 8080.domain.tld.

Note that this uses the host header, so ensure your reverse proxy (if you're
using one) forwards that information.

Using a subpath Copy Section

Simply browse to /proxy//. For instance, if you have code-server
exposed on domain.tld and a Python server running on port 8080 of the same
machine code-server is running on, you could access the Python server via
domain.tld/proxy/8000.

Using your own proxy Copy Section

You can make extensions and the ports panel use your own proxy by setting
VSCODE_PROXY_URI. For example if you set
VSCODE_PROXY_URI=https://{{port}}.kyle.dev when an application is detected
running on port 3000 of the same machine code-server is running on the ports
panel will create a link to https://3000.kyle.dev instead of pointing to the
built-in subpath-based proxy.

Note: relative paths are also supported i.e.
VSCODE_PROXY_URI=./proxy/{{port}}

Stripping `/proxy/` from the request path Copy Section

You may notice that the code-server proxy strips /proxy/ from the
request path.

HTTP servers should use relative URLs to avoid the need to be coupled to the
absolute path at which they are served. This means you must use trailing
slashes on all paths with
subpaths.

This reasoning is why the default behavior is to strip /proxy/ from the
base path. If your application uses relative URLs and does not assume the
absolute path at which it is being served, it will just work no matter what port
you decide to serve it off or if you put it in behind code-server or any other
proxy.

However, some prefer the cleaner aesthetic of no trailing slashes. Omitting the
trailing slashes couples you to the base path, since you cannot use relative
redirects correctly anymore. If you're okay with this tradeoff, use /absproxy
instead and the path will be passed as is (e.g., /absproxy/3000/my-app-path).

Proxying to create a React app Copy Section

You must use /absproxy/ with create-react-app (see
#2565 and
#2222 for more information).
You will need to inform create-react-app of the path at which you are serving
via $PUBLIC_URL and webpack via $WDS_SOCKET_PATH:

PUBLIC_URL=/absproxy/3000 \
  WDS_SOCKET_PATH=$PUBLIC_URL/sockjs-node \
  BROWSER=none yarn start

You should then be able to visit
https://my-code-server-address.io/absproxy/3000 to see your app exposed
through code-server.

We highly recommend using the subdomain approach instead to avoid this class of issue.

Proxying to a Vue app Copy Section

Similar to the situation with React apps, you have to make a few modifications
to proxy a Vue app.

1. add vue.config.js
2. update the values to match this (you can use any free port):

module.exports = {
  devServer: {
    port: 3454,
    sockPath: "sockjs-node",
  },
  publicPath: "/absproxy/3454",
}

3. access app at <code-server-root>/absproxy/3454 e.g. http://localhost:8080/absproxy/3454

Read more about publicPath in the Vue.js docs

Proxying to an Angular app Copy Section

In order to use code-server's built-in proxy with Angular, you need to make the
following changes in your app:

1. use `` in src/index.html
2. add --serve-path /absproxy/4200 to ng serve in your package.json

For additional context, see this GitHub Discussion.

Proxying to a Svelte app Copy Section

In order to use code-server's built-in proxy with Svelte, you need to make the
following changes in your app:

1. Add svelte.config.js if you don't already have one
2. Update the values to match this (you can use any free port):

const config = {
  kit: {
    paths: {
      base: "/absproxy/5173",
    },
  },
}

3. Access app at <code-server-root>/absproxy/5173/ e.g. `http://localhost:8080/absproxy/5173/

For additional context, see this Github Issue

Prefixing `/absproxy/` with a path Copy Section

This is a case where you need to serve an application via absproxy as
explained above while serving code-server itself from a path other than the root
in your domain.

For example: http://my-code-server.com/user/123/workspace/my-app. To achieve
this result:

1. Start code-server with the switch --abs-proxy-base-path=/user/123/workspace
2. Follow one of the instructions above for your framework.

Preflight requests Copy Section

By default, if you have auth enabled, code-server will authenticate all proxied
requests including preflight requests. This can cause issues because preflight
requests do not typically include credentials. To allow all preflight requests
through the proxy without authentication, use --skip-auth-preflight.

Internationalization and customization Copy Chapter

code-server allows you to provide a JSON file to configure certain strings. This
can be used for both internationalization and customization.

Create a JSON file with your custom strings:

{
  "WELCOME": "Welcome to {{app}}",
  "LOGIN_TITLE": "{{app}} Access Portal",
  "LOGIN_BELOW": "Please log in to continue",
  "PASSWORD_PLACEHOLDER": "Enter Password"
}

Then reference the file:

code-server --i18n /path/to/custom-strings.json

Or this can be done in the config file:

i18n: /path/to/custom-strings.json

You can combine this with the --locale flag to configure language support for
both code-server and VS Code in cases where code-server has no support but VS
Code does. If you are using this for internationalization, please consider
sending us a pull request to contribute it to src/node/i18n/locales.

Available keys and placeholders Copy Section

Refer to ../src/node/i18n/locales/en.json
for a full list of the available keys for translations. Note that the only
placeholders supported for each key are the ones used in the default string.

The --app-name flag controls the {{app}} placeholder in templates. If you
want to change the name, you can either:

1. Set --app-name (potentially alongside --i18n)
2. Use --i18n and hardcode the name in your strings

Legacy flag Copy Section

The --welcome-text flag is now deprecated. Use the WELCOME key instead.

Helm Copy Section

code-server Helm Chart

code-server code-server is VS Code running
on a remote server, accessible through the browser.

This chart is community maintained by @Matthew-Beckett and @alexgorbatchev

Quickstart Copy Chapter

$ git clone https://github.com/coder/code-server
$ cd code-server
$ helm upgrade --install code-server ci/helm-chart

Introduction Copy Chapter

This chart bootstraps a code-server deployment on a
Kubernetes cluster using the Helm
package manager.

Prerequisites Copy Chapter

• Kubernetes 1.6+

Installing the Chart Copy Chapter

To install the chart with the release name code-server:

$ git clone https://github.com/coder/code-server
$ cd code-server
$ helm upgrade --install code-server ci/helm-chart

The command deploys code-server on the Kubernetes cluster in the default
configuration. The configuration section lists the parameters
that can be configured during installation.

Tip: List all releases using helm list

Uninstalling the Chart Copy Chapter

To uninstall/delete the code-server deployment:

$ helm delete code-server

The command removes all the Kubernetes components associated with the chart and
deletes the release.

Configuration Copy Chapter

The following table lists the configurable parameters of the code-server chart
and their default values.

Values Copy Chapter

Specify each parameter using the --set key=value[,key=value] argument to helm install. For example,

$ helm upgrade --install code-server \
  ci/helm-chart \
  --set persistence.enabled=false

The above command sets the persistence storage to false.

Alternatively, a YAML file that specifies the values for the above parameters
can be provided while installing the chart. For example,

$ helm upgrade --install code-server ci/helm-chart -f values.yaml

Tip: You can use the default values.yaml

Extra Containers

There are two parameters which allow to add more containers to pod.
Use extraContainers to add regular containers
and extraInitContainers to add init containers. You can read more
about init containers in k8s documentation.

Both parameters accept strings and use them as a templates

Example of using extraInitContainers:

extraInitContainers: |
  - name: customization
    image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
    imagePullPolicy: IfNotPresent
    env:
      - name: SERVICE_URL
        value: https://open-vsx.org/vscode/gallery
      - name: ITEM_URL
        value: https://open-vsx.org/vscode/item
    command:
      - sh
      - -c
      - |
        code-server --install-extension ms-python.python
        code-server --install-extension golang.Go
    volumeMounts:
      - name: data
        mountPath: /home/coder

With this yaml in file init.yaml, you can execute

$ helm upgrade --install code-server \
  ci/helm-chart \
  --values init.yaml

to deploy code-server with python and golang extensions preinstalled
before main container have started.

Install Copy Section

Install

• install.sh
  • Detection reference
• npm
• Standalone releases
• Debian, Ubuntu
• Fedora, CentOS, RHEL, SUSE
• Arch Linux
• Artix Linux
• macOS
• Docker
• Helm
• Windows
• Raspberry Pi
• Termux
• Cloud providers
• Uninstall
  • install.sh
  • Homebrew
  • npm
  • Debian, Ubuntu

This document demonstrates how to install code-server on various distros and
operating systems.

install.sh Copy Chapter

The easiest way to install code-server is to use our install
script for Linux, macOS and FreeBSD. The install script
attempts to use the system package manager if possible.

You can preview what occurs during the install process:

curl -fsSL https://code-server.dev/install.sh | sh -s -- --dry-run

To install, run:

curl -fsSL https://code-server.dev/install.sh | sh

You can modify the installation process by including one or more of the
following flags:

• --dry-run: echo the commands for the install process without running them.
• --method: choose the installation method.
  • --method=detect: detect the package manager but fallback to
    --method=standalone.
  • --method=standalone: install a standalone release archive into ~/.local.
• --prefix=/usr/local: install a standalone release archive system-wide.
• --version=X.X.X: install version X.X.X instead of latest version.
• --help: see usage docs.
• --edge: install the latest edge version (i.e. pre-release)

When done, the install script prints out instructions for running and starting
code-server.

If you're concerned about the install script's use of curl | sh and the
security implications, please see this blog
post
by sandstorm.io.

If you prefer to install code-server manually, despite the detection
references and --dry-run feature, then continue on for
information on how to do this. The install.sh script runs the
exact same commands presented in the rest of this document.

Detection reference Copy Section

• For Debian and Ubuntu, code-server will install the latest deb package.

• For Fedora, CentOS, RHEL and openSUSE, code-server will install the latest RPM
  package.

• For Arch Linux, code-server will install the AUR package.

• For any unrecognized Linux operating system, code-server will install the
  latest standalone release into ~/.local.

  • Ensure that you add ~/.local/bin to your $PATH to run code-server.

• For macOS, code-server will install the Homebrew package (if you don't have
  Homebrew installed, code-server will install the latest standalone release
  into ~/.local).

  • Ensure that you add ~/.local/bin to your $PATH to run code-server.

• For FreeBSD, code-server will install the npm package with npm

• If you're installing code-server onto architecture with no releases,
  code-server will install the npm package with npm

  • We currently offer releases for amd64 and arm64.
  • The npm package builds the native modules on post-install.

npm Copy Chapter

We recommend installing with npm when:

1. You aren't using a machine with amd64 or arm64.
2. You're on Linux with glibc < v2.28 or glibcxx < v3.4.21.
3. You're running Alpine Linux or are using a non-glibc libc. See
   #1430
   for more information.

Installing code-server with npm builds native modules on install.

This process requires C dependencies; see our guide on installing with npm for more information.

Standalone releases Copy Chapter

We publish self-contained .tar.gz archives for every release on
GitHub. The archives bundle the
node binary and node modules.

We create the standalone releases using the npm package, and we
then create the remaining releases using the standalone version.

The only requirement to use the standalone release is glibc >= 2.28 and
glibcxx >= v3.4.21 on Linux (for macOS, there is no minimum system
requirement).

To use a standalone release:

1. Download the latest release archive for your system from
   GitHub.
2. Unpack the release.
3. Run code-server by executing ./bin/code-server.

You can add ./bin/code-server to your $PATH so that you can execute
code-server without providing full path each time.

Here is a sample script for installing and using a standalone code-server
release on Linux:

mkdir -p ~/.local/lib ~/.local/bin
curl -fL https://github.com/coder/code-server/releases/download/v$VERSION/code-server-$VERSION-linux-amd64.tar.gz \
  | tar -C ~/.local/lib -xz
mv ~/.local/lib/code-server-$VERSION-linux-amd64 ~/.local/lib/code-server-$VERSION
ln -s ~/.local/lib/code-server-$VERSION/bin/code-server ~/.local/bin/code-server
PATH="~/.local/bin:$PATH"
code-server
# Now visit http://127.0.0.1:8080. Your password is in ~/.config/code-server/config.yaml

Debian, Ubuntu Copy Chapter

The standalone arm64 .deb does not support Ubuntu 16.04 or earlier. Please
upgrade or build with npm.

curl -fOL https://github.com/coder/code-server/releases/download/v$VERSION/code-server_${VERSION}_amd64.deb
sudo dpkg -i code-server_${VERSION}_amd64.deb
sudo systemctl enable --now code-server@$USER
# Now visit http://127.0.0.1:8080. Your password is in ~/.config/code-server/config.yaml

Fedora, CentOS, RHEL, SUSE Copy Chapter

The standalone arm64 .rpm does not support CentOS 7. Please upgrade or build
with npm.

curl -fOL https://github.com/coder/code-server/releases/download/v$VERSION/code-server-$VERSION-amd64.rpm
sudo rpm -i code-server-$VERSION-amd64.rpm
sudo systemctl enable --now code-server@$USER
# Now visit http://127.0.0.1:8080. Your password is in ~/.config/code-server/config.yaml

Arch Linux Copy Chapter

# Install code-server from the AUR using yay.
yay -S code-server
sudo systemctl enable --now code-server@$USER
# Now visit http://127.0.0.1:8080. Your password is in ~/.config/code-server/config.yaml

# Install code-server from the AUR with plain makepkg.
git clone https://aur.archlinux.org/code-server.git
cd code-server
makepkg -si
sudo systemctl enable --now code-server@$USER
# Now visit http://127.0.0.1:8080. Your password is in ~/.config/code-server/config.yaml

Artix Linux Copy Chapter

# Install code-server from the AUR
git clone https://aur.archlinux.org/code-server.git
cd code-server
makepkg -si

Save the file as code-server in /etc/init.d/ and make it executable with chmod +x code-server. Put your username in line 3.

#!/sbin/openrc-run
name=$RC_SVCNAME
description="$name - VS Code on a remote server"
user="" # your username here
homedir="/home/$user"
command="$(which code-server)"
# Just because you can do this does not mean you should. Use ~/.config/code-server/config.yaml instead
#command_args="--extensions-dir $homedir/.local/share/$name/extensions --user-data-dir $homedir/.local/share/$name --disable-telemetry"
command_user="$user:$user"
pidfile="/run/$name/$name.pid"
command_background="yes"
extra_commands="report"

depend() {
  use logger dns
  need net
}

start_pre() {
  checkpath --directory --owner $command_user --mode 0755 /run/$name /var/log/$name
}

start() {
  default_start
  report
}

stop() {
  default_stop
}

status() {
  default_status
  report
}

report() {
  # Report to the user
  einfo "Reading configuration from ~/.config/code-server/config.yaml"
}

Start on boot with default runlevel

rc-update add code-server default

Start the service immediately

rc-service code-server start

macOS Copy Chapter

brew install code-server
brew services start code-server
# Now visit http://127.0.0.1:8080. Your password is in ~/.config/code-server/config.yaml

Docker Copy Chapter

# This will start a code-server container and expose it at http://127.0.0.1:8080.
# It will also mount your current directory into the container as `/home/coder/project`
# and forward your UID/GID so that all file system operations occur as your user outside
# the container.
#
# Your $HOME/.config is mounted at $HOME/.config within the container to ensure you can
# easily access/modify your code-server config in $HOME/.config/code-server/config.json
# outside the container.
mkdir -p ~/.config
docker run -it --name code-server -p 127.0.0.1:8080:8080 \
  -v "$HOME/.local:/home/coder/.local" \
  -v "$HOME/.config:/home/coder/.config" \
  -v "$PWD:/home/coder/project" \
  -u "$(id -u):$(id -g)" \
  -e "DOCKER_USER=$USER" \
  codercom/code-server:latest

Our official image supports amd64 and arm64. For arm32 support, you can
use a community-maintained code-server
alternative.

Helm Copy Chapter

You can install code-server using the Helm package manager.

Windows Copy Chapter

We currently do not publish Windows
releases.

Raspberry Pi Copy Chapter

We recommend installing code-server onto Raspberry Pi with npm.

If you see an error related to node-gyp during installation, See #5174 for more information.

Termux Copy Chapter

Please see code-server's Termux docs for more
information.

Cloud providers Copy Chapter

We maintain one-click apps and install scripts for cloud
providers such as DigitalOcean,
Railway, Heroku, and Azure.

Uninstall Copy Chapter

code-server can be completely uninstalled by removing the application directory, and your user configuration directory.

To delete settings and data:

rm -rf ~/.local/share/code-server ~/.config/code-server

install.sh Copy Section

If you installed with the install script, by default code-server will be in ~/.local/lib/code-server-<version> and you can remove it with rm -rf. e.g.

rm -rf ~/.local/lib/code-server-*

Homebrew Copy Section

To remove the code-server homebrew package, run:

brew remove code-server

# Alternatively
brew uninstall code-server

npm Copy Section

To remove the code-server global module, run:

npm uninstall --global code-server

Debian, Ubuntu Copy Section

To uninstall, run:

sudo apt remove code-server

Ios Copy Section

Using code-server on iOS with iSH

1. Install iSH from the App Store
2. Install curl and nano with apk add curl nano
3. Configure iSH to use an earlier version of NodeJS with nano /etc/apk/repositories and edit v3.14 to v3.12 on both repository links.
4. Install nodejs and npm with apk add nodejs npm
5. Install code-server with curl -fsSL https://code-server.dev/install.sh | sh
6. Run code-server with code-server
7. Access on localhost:8080 in your browser

Ipad Copy Section

iPad

• Using the code-server progressive web app (PWA)
• Access code-server using Servediter
• Raspberry Pi USB-C network
• Recommendations
• Known issues
  • Workaround for issue with ctrl+c not stopping a running process in the terminal
• Access code-server with a self-signed certificate on an iPad
  • Certificate requirements
  • Sharing a self-signed certificate with an iPad

Once you've installed code-server, you can access it from an iPad.

Using the code-server progressive web app (PWA) Copy Chapter

To use code-server on an iPad, we recommend installing the code-server
progressive web app (PWA):

1. Open code-server in Safari.
2. Click the Share icon.
3. Click Add to Home Screen.

You can now open code-server from the Home screen, and when you do, you'll be
using the PWA. Running code-server as a PWA gets you more screen real estate and
access to top-level keyboard shortcuts since its running like a native app.

For example, you can use cmd+w to close an active file in the workbench. You
can add this to keybindings.json:

1. Open code-server

2. Go to Command Palette > Open Keyboard Shortcuts (JSON)

3. Add the following to keybindings.json

   json Copy

   {
     "key": "cmd+w",
     "command": "workbench.action.closeActiveEditor"
   }

4. Test the command by using cmd+w to close an active file.

Access code-server using Servediter Copy Chapter

If you are unable to get the self-signed certificate working, or you do not have a domain
name to use, you can use Servediter for code-server.

Servediter for code-server is not officially supported by the code-server team!

To use Servediter:

1. Download the app from the App Store.
2. When prompted, provide your server information. If you are running a local
   server or a Raspberry Pi connected via USB-C, you will input your settings
   into Self Hosted Server.

Raspberry Pi USB-C network Copy Chapter

We've heard of users having great success using code-server on an iPad connected
to a Raspberry Pi via USB-C (the Raspberry Pi provides both power and direct
network access). Setting this up requires you to turn on Network over USB-C
on the Raspberry Pi, then continuing with code-server as usual on the iPad.

For more information, see:

• General introduction to Pi as an iPad
  accessory
• iPad with Pi FAQ
• Technical guide to connecting a Raspberry Pi to an
  iPad

You may also find the following tips from Acker
Apple helpful:

Here are my keys to success. I bought a 4" touch screen with fan included that
attaches as a case to the Pi. I use the touch screen for anytime I have
connection issues, otherwise I turn off the Pi screen. I gave my Pi a network
name so I can easily connect at home on wifi or when on go with 1 usb-c cable
that supplys both power and network connectivity. Lastly, not all usb-c cables
are equal and not all will work so try different usb-c cables if you are going
mad (confirm over wifi first then move to cable).

Recommendations Copy Chapter

Once you can access code-server on your iPad, you may find the following tips
and tricks helpful:

• Use multi-task mode to make code changes and see the browser at the same time
  • This prevents the iOS background from dropping an app's state if you are
    switching between code-server and browser (with both in full-screen)
• Be sure you are using the debug/terminal that is built into VS Code so that
  you don’t need another terminal app running
  • This also prevents switching between full screen apps and losing your view
    due to iOS' background app memory management

Known issues Copy Chapter

• Getting self-signed certificates to work is an involved
  process
• Keyboard issues:
  • The keyboard disappear sometimes
    #979
  • Some expectations regarding shortcuts may not be met:
    • cmd + n opens new browser window instead of new file, and it's difficult
      to set alternative as a workaround
    • In general, expect to edit your keyboard shortcuts
  • There's no escape key by default on the Magic Keyboard, so most users set
    the globe key to be an escape key
• Trackpad scrolling does not work on iPadOS < 14.5
  (#1455)
  • WebKit fix
• Keyboard may lose focus in Safari / split view #4182
• Terminal text does not appear by default #3824
• Copy & paste in terminal does not work well with keyboard shortcuts #3491
• ctrl+c does not stop a long-running process in the browser
  • Tracking upstream issue here:
    #114009
  • See workaround

Additionally, see issues in the code-server repo that are tagged with the os-ios
label
for more information.

Workaround for issue with `ctrl+c` not stopping a running process in the terminal Copy Section

This's currently an issue with ctrl+c not stopping a running process in the
integrated terminal. We have filed an issue upstream and are tracking
here.

In the meantime, you can manually define a shortcut as a workaround:

1. Open the Command Palette

2. Look for Preferences: Open Keyboard Shortcuts (JSON)

3. Add the following snippet:

   json Copy

   {
     "key": "ctrl+c",
     "command": "workbench.action.terminal.sendSequence",
     "args": {
       "text": "\u0003"
     },
     "when": "terminalFocus"
   }

Source: StackOverflow

Access code-server with a self-signed certificate on an iPad Copy Chapter

If you've installed code-server and are running it with a self-signed
certificate, you may see multiple
security warnings from Safari. To fix this, you'll need to install the
self-signed certificate generated by code-server as a profile on your device (you'll also need to do this to
enable WebSocket connections).

Certificate requirements Copy Section

• We're assuming that you're using the self-signed certificate code-server
  generates for you (if not, make sure that your certificate abides by the
  guidelines issued by Apple).
• We've noticed that the certificate has to include basicConstraints=CA:true.
• Your certificate must have a subject alt name that matches the hostname you'll
  use to access code-server from the iPad. You can pass this name to code-server
  so that it generates the certificate correctly using --cert-host.

Sharing a self-signed certificate with an iPad Copy Section

To share a self-signed certificate with an iPad:

1. Get the location of the certificate code-server generated; code-server prints
   the certificate's location in its logs:

   console Copy

   [2020-10-30T08:55:45.139Z] info - Using generated certificate and key for HTTPS: ~/.local/share/code-server/mymbp_local.crt

2. Send the certificate to the iPad, either by emailing it to yourself or using
   Apple's Airdrop feature.

3. Open the *.crt file so that you're prompted to go into Settings to install.

4. Go to Settings > General > Profile, and select the profile. Tap Install.

5. Go to Settings > About > Certificate Trust Settings and enable
   full trust for your certificate.

You should be able to access code-server without all of Safari's warnings now.

warning: Your iPad must access code-server via a domain name. It could be local
DNS like mymacbookpro.local, but it must be a domain name. Otherwise, Safari will
not allow WebSockets connections.

MAINTAINING Copy Section

Maintaining

• Releasing
  • Release Candidates
  • AUR
  • Docker
  • nixpkgs
  • npm
• Testing
• Documentation
  • Troubleshooting

We keep code-server up to date with VS Code releases (there are usually two or
three a month) but we are not generally actively developing code-server aside
from fixing regressions.

Most of the work is keeping on top of issues and discussions.

Releasing Copy Chapter

1. Check that the changelog lists all the important changes.
2. Make sure the changelog entry lists the current version of VS Code.
3. Go to GitHub Actions > Draft release > Run workflow on the commit you want to
   release. For the version we match VS Code's minor and patch version. The
   patch number may become temporarily out of sync if we need to put out a
   patch, but if we make our own minor change then we will not release it until
   the next minor VS Code release.
4. CI will build an NPM package and platform-specific packages, and upload those
   to a draft release.
5. Update the resulting draft release with the changelog contents.
6. Publish the draft release after validating it.
7. Update the changelog with the release date and bump the Helm chart version
   once the Docker images have published.
8. Merge the PR submitted to coder/code-server-aur repo.

Release Candidates

We prefer to do release candidates so the community can test things before a
full-blown release. To do this follow the same steps as above but:

1. Add a -rc.<number> suffix to the version.
2. When you publish the release select "pre-release". CI will not automatically
   publish pre-releases.
3. Do not update the chart version or merge in the changelog until the final
   release.

AUR

We publish to AUR as a package
here. This process is manual
and can be done by following the steps in this
repo.

Docker

We publish code-server as a Docker image
here, tagging it both with the
version and latest.

This is currently automated with the release process.

nixpkgs

We publish code-server in nixpkgs but it must be updated manually.

npm

We publish code-server as a npm package
here.

This is currently automated with the release process.

Testing Copy Chapter

Our testing structure is laid out under our Contributing
docs.

If you're ever looking to add more tests, here are a few ways to get started:

• run npm run test:unit and look at the coverage chart. You'll see all the
  uncovered lines. This is a good place to start.
• look at test/scripts to see which scripts are tested. We can always use more
  tests there.
• look at test/e2e. We can always use more end-to-end tests.

Otherwise, talk to a current maintainer and ask which part of the codebase is
lacking most when it comes to tests.

Documentation Copy Chapter

Troubleshooting Copy Section

Our docs are hosted on Vercel. Vercel only shows logs in
realtime, which means you need to have the logs open in one tab and reproduce
your error in another tab. Since our logs are private to Coder the organization,
you can only follow these steps if you're a Coder employee. Ask a maintainer for
help if you need it.

Taking a real scenario, let's say you wanted to troubleshoot this docs
change. Here is how you would
do it:

1. Go to https://vercel.com/codercom/codercom
2. Click "View Function Logs"
3. In a separate tab, open the preview link from github-actions-bot
4. Now look at the function logs and see if there are errors in the logs

Npm Copy Section

npm Install Requirements

• Node.js version
• Ubuntu, Debian
• Fedora, CentOS, RHEL
• Alpine
• macOS
• FreeBSD
• Windows
• Installing
• Troubleshooting
  • Issues with Node.js after version upgrades
  • Debugging install issues with npm

If you're installing code-server via npm, you'll need to install additional
dependencies required to build the native modules used by VS Code. This article
includes installing instructions based on your operating system.

WARNING: Do not use yarn to install code-server. Unlike npm, it does not respect
lockfiles for distributed applications. It will instead use the latest version
available at installation time - which might not be the one used for a given
code-server release, and might lead to unexpected behavior.

Node.js version Copy Chapter

We use the same major version of Node.js shipped with Code's remote, which is
currently 22.x. VS Code also lists Node.js
requirements.

Using other versions of Node.js may lead to unexpected
behavior.

Ubuntu, Debian Copy Chapter

sudo apt-get install -y \
  build-essential \
  pkg-config \
  python3
npm config set python python3

Proceed to installing

Fedora, CentOS, RHEL Copy Chapter

sudo yum groupinstall -y 'Development Tools'
sudo yum config-manager --set-enabled PowerTools # unnecessary on CentOS 7
sudo yum install -y python2
npm config set python python2

Proceed to installing

Alpine Copy Chapter

apk add alpine-sdk bash libstdc++ libc6-compat python3 krb5-dev

Proceed to installing

macOS Copy Chapter

xcode-select --install

Proceed to installing

FreeBSD Copy Chapter

pkg install -y git python npm-node22 pkgconf
pkg install -y libinotify

Proceed to installing

Windows Copy Chapter

Installing code-server requires all of the prerequisites for VS Code development. When installing the C++ compiler tool chain, we recommend using "Option 2: Visual Studio 2019" for best results.

Next, install code-server with:

npm install code-server
code-server
# Now visit http://127.0.0.1:8080. Your password is in ~/.config/code-server/config.yaml

A postinstall.sh script will attempt to run. Select your terminal (e.g., Git bash) as the default shell for npm run-scripts. If an additional dialog does not appear, run the install command again.

If the code-server command is not found, you'll need to add a directory to your PATH. To find the directory, use the following command:

npm config get prefix

For help and additional troubleshooting, see #1397.

Installing Copy Chapter

After adding the dependencies for your OS, install the code-server package globally:

npm install code-server
code-server
# Now visit http://127.0.0.1:8080. Your password is in ~/.config/code-server/config.yaml

Troubleshooting Copy Chapter

If you need further assistance, post on our GitHub Discussions
page.

Issues with Node.js after version upgrades Copy Section

Occasionally, you may run into issues with Node.js.

If you install code-server using npm, and you upgrade your Node.js
version, you may need to reinstall code-server to recompile native modules.
Sometimes, you can get around this by navigating into code-server's lib/vscode
directory and running npm rebuild to recompile the modules.

A step-by-step example of how you might do this is:

1. Install code-server: brew install code-server
2. Navigate into the directory: cd /usr/local/Cellar/code-server/<version>/libexec/lib/vscode/
3. Recompile the native modules: npm rebuild
4. Restart code-server

Debugging install issues with npm Copy Section

To debug installation issues, install with npm:

# Uninstall
npm uninstall --global code-server > /dev/null 2>&1

# Install with logging
npm install --loglevel verbose --global code-server

Requirements Copy Section

Requirements

You'll need a machine on which you can run code-server. You can use a physical
machine you have, or you can use a VM on GCP/AWS.

At the minimum, we recommend:

• 1 GB of RAM
• 2 CPU cores

You can use any Linux distribution, but our
docs assume that you're using
Debian hosted by Google Cloud (see the following section for instructions on
setting this up).

Your environment must have WebSockets enabled, since code-server uses WebSockets
for communication between the browser and the server.

Set up a VM on Google Cloud Copy Chapter

The following steps walk you through setting up a VM running Debian using Google
Cloud (though you are welcome to use any machine or VM provider).

If you're signing up with Google for the first time, you should get a 3-month trial with
$300 of credits.

After you sign up and create a new Google Cloud Provider (GCP) project, create a
new Compute Engine VM instance:

1. Using the sidebar, navigate to Compute Engine > VM Instances.
2. Click Create Instance.
3. Provide a name for new instance.
4. Choose the region that's closest to you based on GCP
   ping.
5. Choose a zone (any option is fine).
6. We recommend choosing an E2 series instance from the general-purpose
   family.
7. Change the instance type to custom and set at least 2 cores and 2
   GB of RAM. You can add more resources if desired, though you can also edit
   your instance at a later point.
8. Though optional, we highly recommend switching the persistent disk to an SSD
   with at least 32 GB. To do so, click change under Boot Disk. Then,
   change the type to SSD Persistent Disk, and set the size to 32. (You
   can also grow your disk at a later date).
9. Go to Networking > Networking Interfaces and edit the existing
   interface to use a static internal IP. Click Done to save.
10. If you don't have a project-wide SSH
    key,
    go to Security > SSH Keys to add your public key.
11. Click Create to proceed.

Notes:

• To lower costs, you can shut down your server when you're not using it.
• We recommend using the gcloud cli to avoid using the GCP Dashboard if possible.
• For serving code-server over HTTPS, we recommend using an external domain name along with a service such as Let's Encrypt

SECURITY Copy Section

Security Policy

Coder and the code-server team want to keep the code-server project secure and safe for end-users.

Tools Copy Chapter

We use the following tools to help us stay on top of vulnerability mitigation.

• dependabot
  • Submits pull requests to upgrade dependencies. We use dependabot's version
    upgrades as well as security updates.
• code-scanning
  • CodeQL
    • Semantic code analysis engine that runs on a regular schedule (see
      codeql-analysis.yml)
  • trivy
    • Comprehensive vulnerability scanner that runs on PRs into the default
      branch and scans both our container image and repository code (see
      trivy-scan-repo and trivy-scan-image jobs in build.yaml)
• npm audit
  • Audits NPM dependencies.

Supported Versions Copy Chapter

Coder sponsors the development and maintenance of the code-server project. We will fix security issues within 90 days of receiving a report and publish the fix in a subsequent release. The code-server project does not provide backports or patch releases for security issues at this time.

Reporting a Vulnerability Copy Chapter

To report a vulnerability, please send an email to security[@]coder.com, and our security team will respond to you.

Termux Copy Section

Termux

• Install
• NPM Installation
• Upgrade
• Known Issues
  • Git won't work in /sdcard
  • Many extensions including language packs fail to install
• Extra
  • Keyboard Shortcuts and Tab Key
  • Create a new user
  • Install Go
  • Install Python

Install Copy Chapter

1. Get Termux from F-Droid.
2. Run pkg install tur-repo
3. Run pkg install code-server
4. You can now start code server by simply running code-server.

NPM Installation Copy Chapter

1. Get Termux from F-Droid.

2. We will now change using the following command.

termux-change-repo

Now select Main Repository then change repo to Mirrors by Grimler Hosted on grimler.se.

3. After successfully updating of repository update and upgrade all the packages by the following command

pkg update
pkg upgrade -y

4. Now let's install requirement dependancy.

pkg install -y \
  build-essential \
  binutils \
  pkg-config \
  python3 \
  nodejs-lts
npm config set python python3
node -v

you will get Node version v22

5. Now install code-server following our guide on installing with npm

6. Congratulation code-server is installed on your device using the following command.

code-server --auth none

7. If already installed then use the following command for upgradation.

npm update --global code-server

Upgrade Copy Chapter

1. Remove all previous installs rm -rf ~/.local/lib/code-server-*
2. Run the install script again curl -fsSL https://code-server.dev/install.sh | sh

Known Issues Copy Chapter

Git won't work in `/sdcard` Copy Section

Issue : Using git in the /sdcard directory will fail during cloning/commit/staging/etc...
Fix : None
Potential Workaround :

1. Create a soft-link from the debian-fs to your folder in /sdcard
2. Use git from termux (preferred)

Many extensions including language packs fail to install Copy Section

Issue: Android is not seen as a Linux environment but as a separate, unsupported platform, so code-server only allows Web Extensions, refusing to download extensions that run on the server.
Fix: None
Potential workarounds :

Either

• Manually download extensions as .vsix file and install them via Extensions: Install from VSIX... in the Command Palette.

• Use an override to pretend the platform is Linux:

Create a JS script that patches process.platform:

// android-as-linux.js
Object.defineProperty(process, "platform", {
  get() {
    return "linux"
  },
})

Then use Node's --require option to make sure it is loaded before code-server starts:

NODE_OPTIONS="--require /path/to/android-as-linux.js" code-server

⚠️ Note that Android and Linux are not 100% compatible, so use these workarounds at your own risk. Extensions that have native dependencies other than Node or that directly interact with the OS might cause issues.

Extra Copy Chapter

Keyboard Shortcuts and Tab Key Copy Section

In order to support the tab key and use keyboard shortcuts, add this to your
settings.json:

{
  "keyboard.dispatch": "keyCode"
}

Create a new user Copy Section

To create a new user follow these simple steps -

1. Create a new user by running useradd -m.
2. Change the password by running passwd .
3. Give your new user sudo access by running visudo, scroll down to User privilege specification and add the following line after root username ALL=(ALL:ALL) ALL.
4. Now edit the /etc/passwd file with your command line editor of choice and at the end of the line that specifies your user change /bin/sh to /bin/bash.
5. Now switch users by running su -

• Remember the - betweeen su and username is required to execute /etc/profile,
  since /etc/profile may have some necessary things to be executed you should always add a -.

Install Go Copy Section

From https://golang.org/doc/install

1. Go to https://golang.org/dl/ and copy the download link for linux arm and run the following:

wget download_link

2. Extract the downloaded archive. (This step will erase all previous GO installs, make sure to create a backup if you have previously installed GO)

rm -rf /usr/local/go && tar -C /usr/local -xzf archive_name

3. Run nano /etc/profile and add the following line export PATH=$PATH:/usr/local/go/bin.
4. Now run exit (depending on if you have switched users or not, you may have to run exit multiple times to get to normal termux shell) and start Debian again.
5. Check if your install was successful by running go version

Install Python Copy Section

Run these commands as root

1. Run the following commands to install required packages to build python:

sudo apt-get update
sudo apt-get install make build-essential libssl-dev zlib1g-dev \
  libbz2-dev libreadline-dev libsqlite3-dev wget curl llvm \
  libncursesw5-dev xz-utils tk-dev libxml2-dev libxmlsec1-dev libffi-dev liblzma-dev

2. Install pyenv from pyenv-installer by running:

curl -L https://github.com/pyenv/pyenv-installer/raw/master/bin/pyenv-installer | bash

3. Run nano /etc/profile and add the following:

export PYENV_ROOT="/root/.pyenv"
export PATH="/root/.pyenv/bin:$PATH"
eval "$(pyenv init --path)"
eval "$(pyenv virtualenv-init -)"

4. Exit and start Debian again.
5. Run pyenv versions to list all installable versions.
6. Run pyenv install version to install the desired python version.

   The build process may take some time (an hour or 2 depending on your device).

7. Run touch /root/.pyenv/version && echo "your_version_here" > /root/.pyenv/version
8. (You may have to start Debian again) Run python3 -V to verify if PATH works or not.

   If python3 doesn't work but pyenv says that the install was successful in step 6 then try running $PYENV_ROOT/versions/your_version/bin/python3.

Triage Copy Section

Triage

Triaging code-server issues is done with the following issue filter:

is:issue is:open no:project sort:created-asc -label:blocked -label:upstream -label:waiting-for-info -label:extension-request

This will show issues that:

1. Are open.
2. Have no assigned project.
3. Are not blocked or tagged for work by upstream (the VS Code core team).
   If an upstream issue is detrimental to the code-server experience we may fix
   it in our patch instead of waiting for the VS Code team to fix it. Someone
   should periodically go through these issues to see if they can be unblocked!
4. Are not labeled waiting-for-info.
5. Are not extension requests.

Triage process Copy Chapter

1. If an issue is a question/discussion, it should be converted into a GitHub
   discussion.
2. Otherwise, give the issue the appropriate labels (feel free to create new
   ones if necessary). There are no hard and set rules for labels. We don't have
   many so look through and see how they've been used throughout the repository.
   They all also have descriptions.
3. If more information is required, please ask the submitter and tag as
   waiting-for-info and wait.
4. Finally, the issue should be moved into the
   code-server project where we
   pick out issues to fix and track their progress.

We also use milestones to track
what issues are planned/or were closed for what release.

Upgrade Copy Section

Upgrade

To upgrade code-server, install the new version over the old version. All user
data is in ~/.local/share/code-server, so they are preserved between
installations.

CHANGELOG Copy Section

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

Unreleased Copy Chapter

[4.132.0](https://github.com/coder/code-server/releases/tag/v4.132.0) - 2026-08-10 Copy Chapter

Code v1.132.0

Changed Copy Section

• Update to Code 1.132.0

Fixed Copy Section

• When proxying, cookies were being decoded and re-encoded, which could cause
  issues for applications that encode differently. Cookies are now passed
  through unchanged (aside from stripping out code-server's session token).

[4.131.0](https://github.com/coder/code-server/releases/tag/v4.131.0) - 2026-07-30 Copy Chapter

Code v1.131.0

Changed Copy Section

• Update to Code 1.131.0

[4.130.0](https://github.com/coder/code-server/releases/tag/v4.130.0) - 2026-07-24 Copy Chapter

Code v1.130.0

Changed Copy Section

• Update to Code 1.130.0

[4.129.0](https://github.com/coder/code-server/releases/tag/v4.129.0) - 2026-07-17 Copy Chapter

Code v1.129.0

Changed Copy Section

• Update to Code 1.129.0

[4.128.0](https://github.com/coder/code-server/releases/tag/v4.128.0) - 2026-07-11 Copy Chapter

Code v1.128.0

Changed Copy Section

• Update to Code 1.128.0

[4.127.0](https://github.com/coder/code-server/releases/tag/v4.127.0) - 2026-07-02 Copy Chapter

Code v1.127.0

Changed Copy Section

• Update to Code 1.127.0

[4.126.0](https://github.com/coder/code-server/releases/tag/v4.126.0) - 2026-06-24 Copy Chapter

Code v1.126.0

Changed Copy Section

• Update to Code 1.126.0

[4.125.0](https://github.com/coder/code-server/releases/tag/v4.125.0) - 2026-06-18 Copy Chapter

Code v1.125.0

Changed Copy Section

• Update to Code 1.125.0

[4.124.2](https://github.com/coder/code-server/releases/tag/v4.124.2) - 2026-06-16 Copy Chapter

Code v1.124.2

Security Copy Section

• Strip code-server's session token from the cookie before proxying to a local
  port. Previously, when you used built-in password authentication, the cookie
  would be sent to the local proxied port, which meant if the service was
  malicious and not already running as your code-server user it could use the
  cookie to log into code-server and execute commands as your code-server user.

Changed Copy Section

• Update to Code 1.124.2

[4.123.0](https://github.com/coder/code-server/releases/tag/v4.123.0) - 2026-06-03 Copy Chapter

Code v1.123.0

Changed Copy Section

• Update to Code 1.123.0
• Microsoft dropped support for armhf remotes so there will no longer be any
  builds for armhf.

[4.122.1](https://github.com/coder/code-server/releases/tag/v4.122.1) - 2026-06-02 Copy Chapter

Code v1.122.1

Changed Copy Section

• Update to Code 1.122.1

[4.122.0](https://github.com/coder/code-server/releases/tag/v4.122.0) - 2026-05-29 Copy Chapter

Code v1.122.0

Changed Copy Section

• Update to Code 1.122.0

Fixed Copy Section

• --app-name will now affect window titles within the editor (it is now used
  as the value for ${appName} in the title template) as well as some other
  places like the help > about dialog.

Added Copy Section

• App name can now be set with the CODE_SERVER_APP_NAME environment variable.

[4.121.0](https://github.com/coder/code-server/releases/tag/v4.121.0) - 2026-05-20 Copy Chapter

Code v1.121.0

Changed Copy Section

• Update to Code 1.121.0

[4.118.0](https://github.com/coder/code-server/releases/tag/v4.118.0) - 2026-05-06 Copy Chapter

Code v1.118.0

Changed Copy Section

• Update to Code 1.118.0

[4.117.0](https://github.com/coder/code-server/releases/tag/v4.117.0) - 2026-04-22 Copy Chapter

Code v1.117.0

Changed Copy Section

• Update to Code 1.117.0

[4.116.0](https://github.com/coder/code-server/releases/tag/v4.116.0) - 2026-04-16 Copy Chapter

Code v1.116.0

Changed Copy Section

• Update to Code 1.116.0

[4.115.0](https://github.com/coder/code-server/releases/tag/v4.115.0) - 2026-04-08 Copy Chapter

Code v1.115.0

Changed Copy Section

• Update to Code 1.115.0

[4.114.1](https://github.com/coder/code-server/releases/tag/v4.114.1) - 2026-04-06 Copy Chapter

Code v1.114.0

Changed Copy Section

• Ensure native modules are built from source so they use the correct version of
  glibc. This should bring down the requirement from 2.34 back down to 2.28.

[4.114.0](https://github.com/coder/code-server/releases/tag/v4.114.0) - 2026-04-04 Copy Chapter

Code v1.114.0

Changed Copy Section

• Update to Code 1.114.0.

[4.113.1](https://github.com/coder/code-server/releases/tag/v4.113.1) - 2026-04-03 Copy Chapter

Code v1.113.0

This is a re-release of v4.113.0 but with the correct Node binaries for arm64
and armv7l. Previously they were packaging the amd64 Node binary due to a
mistake while refactoring CI to use more of the upstream build scripts.

[4.113.0](https://github.com/coder/code-server/releases/tag/v4.113.0) - 2026-04-02 Copy Chapter

Code v1.113.0

Changed Copy Section

• Update to Code 1.113.0

[4.112.0](https://github.com/coder/code-server/releases/tag/v4.112.0) - 2026-03-19 Copy Chapter

Code v1.112.0

Changed Copy Section

• Update to Code 1.112.0

[4.111.0](https://github.com/coder/code-server/releases/tag/v4.111.0) - 2026-03-11 Copy Chapter

Code v1.111.0

Changed Copy Section

• Update to Code 1.111.0
• --app-name now affects the error page title.

[4.110.1](https://github.com/coder/code-server/releases/tag/v4.110.1) - 2026-03-10 Copy Chapter

Code v1.110.1

Changed Copy Section

• Update to Code 1.110.1

[4.110.0](https://github.com/coder/code-server/releases/tag/v4.110.0) - 2026-03-09 Copy Chapter

Code v1.110.0

Changed Copy Section

• Update to Code 1.110.0

[4.109.5](https://github.com/coder/code-server/releases/tag/v4.109.5) - 2026-03-02 Copy Chapter

Code v1.109.5

Changed Copy Section

• Update to Code 1.109.5

[4.109.2](https://github.com/coder/code-server/releases/tag/v4.109.2) - 2026-02-12 Copy Chapter

Code v1.109.2

Changed Copy Section

• Update to Code 1.109.2

[4.109.0](https://github.com/coder/code-server/releases/tag/v4.109.0) - 2026-02-12 Copy Chapter

Code v1.109.0

Changed Copy Section

• Update to Code 1.109.0

[4.108.2](https://github.com/coder/code-server/releases/tag/v4.108.2) - 2026-01-26 Copy Chapter

Code v1.108.2

Changed Copy Section

• Update to Code 1.108.2

[4.108.1](https://github.com/coder/code-server/releases/tag/v4.108.1) - 2026-01-16 Copy Chapter

Code v1.108.1

Changed Copy Section

• Update to Code 1.108.1

[4.108.0](https://github.com/coder/code-server/releases/tag/v4.108.0) - 2026-01-12 Copy Chapter

Code v1.108.0

Changed Copy Section

• Update to Code 1.108.0

[4.107.1](https://github.com/coder/code-server/releases/tag/v4.107.1) - 2026-01-09 Copy Chapter

Code v1.107.1

Changed Copy Section

• Update to Code 1.107.1

[4.107.0](https://github.com/coder/code-server/releases/tag/v4.107.0) - 2026-12-17 Copy Chapter

Code v1.107.0

Changed Copy Section

• Update to Code 1.107.0

Added Copy Section

• New --cookie-suffix flag that can be used to add a suffix to the cookie when
  using the built-in password authentication. You can use this to avoid
  collisions with other instances of code-server.
• Support a new property authorizationHeaderToken on the extension gallery
  configuration. This will be added to marketplace requests as a bearer token
  using the Authorization header.

[4.106.3](https://github.com/coder/code-server/releases/tag/v4.106.3) - 2025-12-01 Copy Chapter

Code v1.106.3

Changed Copy Section

• Update to Code 1.106.3

[4.106.2](https://github.com/coder/code-server/releases/tag/v4.106.2) - 2025-11-19 Copy Chapter

Code v1.106.2

Changed Copy Section

• Update to Code 1.106.2

[4.106.0](https://github.com/coder/code-server/releases/tag/v4.106.0) - 2025-11-19 Copy Chapter

Code v1.106.0

Changed Copy Section

• Update to Code 1.106.0

[4.105.1](https://github.com/coder/code-server/releases/tag/v4.105.1) - 2025-10-20 Copy Chapter

Code v1.105.1

Changed Copy Section

• Update to Code 1.105.1

[4.105.0](https://github.com/coder/code-server/releases/tag/v4.105.0) - 2025-10-17 Copy Chapter

Code v1.105.0

Changed Copy Section

• Update to Code 1.105.0

[4.104.3](https://github.com/coder/code-server/releases/tag/v4.104.3) - 2025-10-07 Copy Chapter

Code v1.104.3

Changed Copy Section

• Update to Code 1.104.3.

[4.104.2](https://github.com/coder/code-server/releases/tag/v4.104.2) - 2025-09-26 Copy Chapter

Code v1.104.2

Changed Copy Section

• Update to Code 1.104.2.

[4.104.1](https://github.com/coder/code-server/releases/tag/v4.104.1) - 2025-09-19 Copy Chapter

Code v1.104.1

Changed Copy Section

• Update to Code 1.104.1.

[4.104.0](https://github.com/coder/code-server/releases/tag/v4.104.0) - 2025-09-15 Copy Chapter

Code v1.104.0

Fixed Copy Section

• Fix "extension not found" errors from Open VSX when trying to install the
  latest version of an extension.

Changed Copy Section

• Update to Code 1.104.0.

[4.103.2](https://github.com/coder/code-server/releases/tag/v4.103.2) - 2025-08-25 Copy Chapter

Code v1.103.2

Changed Copy Section

• Update to Code 1.103.2.

[4.103.1](https://github.com/coder/code-server/releases/tag/v4.103.1) - 2025-08-15 Copy Chapter

Code v1.103.1

Changed Copy Section

• Update to Code 1.103.1.

[4.103.0](https://github.com/coder/code-server/releases/tag/v4.103.0) - 2025-08-12 Copy Chapter

Code v1.103.0

Changed Copy Section

• Update to Code 1.103.0.

[4.102.2](https://github.com/coder/code-server/releases/tag/v4.102.2) - 2025-07-24 Copy Chapter

Code v1.102.2

Changed Copy Section

• Update to Code 1.102.2.

[4.102.1](https://github.com/coder/code-server/releases/tag/v4.102.1) - 2025-07-17 Copy Chapter

Code v1.102.1

Changed Copy Section

• Update to Code 1.102.1.

[4.102.0](https://github.com/coder/code-server/releases/tag/v4.102.0) - 2025-07-16 Copy Chapter

Code v1.102.0

Changed Copy Section

• Update to Code 1.102.0.

Added Copy Section

• Custom strings can be configured using the --i18n flag set to a JSON
  file. This can be used for either translation (and can be used alongside
  --locale) or for customizing the strings. See
  ./src/node/i18n/locales/en.json for the
  available keys.

[4.101.2](https://github.com/coder/code-server/releases/tag/v4.101.2) - 2025-06-25 Copy Chapter

Code v1.101.2

Changed Copy Section

• Update to Code 1.101.2.

Fixed Copy Section

• Fix web views not loading due to 401 when requesting the service worker.

[4.101.1](https://github.com/coder/code-server/releases/tag/v4.101.1) - 2025-06-20 Copy Chapter

Code v1.101.1

Changed Copy Section

• Update to Code 1.101.1.

[4.101.0](https://github.com/coder/code-server/releases/tag/v4.101.0) - 2025-06-20 Copy Chapter

Code v1.101.0

Changed Copy Section

• Update to Code 1.101.0.

[4.100.3](https://github.com/coder/code-server/releases/tag/v4.100.3) - 2025-06-03 Copy Chapter

Code v1.100.3

Changed Copy Section

• Update to Code 1.100.3.

[4.100.2](https://github.com/coder/code-server/releases/tag/v4.100.2) - 2025-05-15 Copy Chapter

Code v1.100.2

Changed Copy Section

• Update to Code 1.100.2.

[4.100.1](https://github.com/coder/code-server/releases/tag/v4.100.1) - 2025-05-13 Copy Chapter

Code v1.100.1

Changed Copy Section

• Update to Code 1.100.1.

[4.100.0](https://github.com/coder/code-server/releases/tag/v4.100.0) - 2025-05-12 Copy Chapter

Code v1.100.0

Added Copy Section

• Trusted domains for links can now be set at run-time by configuring
  linkProtectionTrustedDomains in the lib/vscode/product.json file or via
  the --link-protection-trusted-domains flag.

Changed Copy Section

• Update to Code 1.100.0.
• Disable extension signature verification, which previously was skipped by
  default (the package used for verification is not available to OSS builds of
  VS Code) but now reportedly throws hard errors making it impossible to install
  extensions.

Fixed Copy Section

• Flags with repeatable options now work via the config file.

[4.99.4](https://github.com/coder/code-server/releases/tag/v4.99.4) - 2025-05-02 Copy Chapter

Code v1.99.3

Security Copy Section

• Validate that ports in the path proxy are numbers, to prevent proxying to
  arbitrary domains.

[4.99.3](https://github.com/coder/code-server/releases/tag/v4.99.3) - 2025-04-17 Copy Chapter

Code v1.99.3

Added Copy Section

• Added --skip-auth-preflight flag to let preflight requests through the
  proxy.

Changed Copy Section

• Update to Code 1.99.3.

[4.99.2](https://github.com/coder/code-server/releases/tag/v4.99.2) - 2025-04-10 Copy Chapter

Code v1.99.2

Changed Copy Section

• Update to Code 1.99.2.

[4.99.1](https://github.com/coder/code-server/releases/tag/v4.99.1) - 2025-04-08 Copy Chapter

Code v1.99.1

Changed Copy Section

• Update to Code 1.99.1.

[4.99.0](https://github.com/coder/code-server/releases/tag/v4.99.0) - 2025-04-07 Copy Chapter

Code v1.99.0

Changed Copy Section

• Update to Code 1.99.0.

[4.98.0](https://github.com/coder/code-server/releases/tag/v4.98.0) - 2025-03-07 Copy Chapter

Code v1.98.0

Changed Copy Section

• Update to Code 1.98.0.

[4.97.2](https://github.com/coder/code-server/releases/tag/v4.96.4) - 2025-02-18 Copy Chapter

Code v1.97.2

Added Copy Section

• Added back macOS amd64 builds.

Changed Copy Section

• Update to Code 1.97.2.
• Softened dark mode login page colors.

[4.96.4](https://github.com/coder/code-server/releases/tag/v4.96.4) - 2025-01-20 Copy Chapter

Code v1.96.4

Changed Copy Section

• Update to Code 1.96.4.

[4.96.2](https://github.com/coder/code-server/releases/tag/v4.96.2) - 2024-12-20 Copy Chapter

Code v1.96.2

Changed Copy Section

• Update to Code 1.96.2.

[4.96.1](https://github.com/coder/code-server/releases/tag/v4.96.1) - 2024-12-18 Copy Chapter

Code v1.96.1

Added Copy Section

• Dark color scheme for login and error pages.

Changed Copy Section

• Update to Code 1.96.1.

[4.95.3](https://github.com/coder/code-server/releases/tag/v4.95.3) - 2024-11-18 Copy Chapter

Code v1.95.3

Changed Copy Section

• Update to Code 1.95.3.

[4.95.2](https://github.com/coder/code-server/releases/tag/v4.95.2) - 2024-11-12 Copy Chapter

Code v1.95.2

Changed Copy Section

• Update to Code 1.95.2.

[4.95.1](https://github.com/coder/code-server/releases/tag/v4.95.1) - 2024-11-06 Copy Chapter

Code v1.95.1

Changed Copy Section

• Update to Code 1.95.1.

[4.93.1](https://github.com/coder/code-server/releases/tag/v4.93.1) - 2024-09-23 Copy Chapter

Code v1.93.1

Changed Copy Section

• Updated to Code 1.93.1.

Added Copy Section

• Added --abs-proxy-base-path flag for when code-server is not at the root.

[4.92.2](https://github.com/coder/code-server/releases/tag/v4.92.2) - 2024-08-19 Copy Chapter

Code v1.92.2

Breaking changes Copy Section

• Dropped a patch that changed the compile target from es2022 to es2020 because
  it no longer works with the way VS Code uses static properties. This may break
  older browsers, so those browsers will either have to be updated or use an
  older version of code-server.

Changed Copy Section

• Updated to Code 1.92.2.

[4.91.0](https://github.com/coder/code-server/releases/tag/v4.91.0) - 2024-07-10 Copy Chapter

Code v1.91.0

Changed Copy Section

• Updated to Code 1.91.0.

[4.90.3](https://github.com/coder/code-server/releases/tag/v4.90.3) - 2024-06-21 Copy Chapter

Code v1.90.2

Changed Copy Section

• Updated to Code 1.90.2.

Fixed Copy Section

• When the log gets rotated it will no longer incorrectly be moved to a new
  directory created in the current working directory named with a date.
  Instead, the file itself is prepended with the date and kept in the same
  directory, as originally intended.

[4.90.2](https://github.com/coder/code-server/releases/tag/v4.90.2) - 2024-06-14 Copy Chapter

Code v1.90.1

Changed Copy Section

• Updated to Code 1.90.1.

[4.90.1](https://github.com/coder/code-server/releases/tag/v4.90.1) - 2024-06-12 Copy Chapter

Code v1.90.0

Fixed Copy Section

• Cache a call to get CPU information used in telemetry that could result in a
  lack responsiveness if it was particularly slow.

[4.90.0](https://github.com/coder/code-server/releases/tag/v4.90.0) - 2024-06-11 Copy Chapter

Code v1.90.0

Changed Copy Section

• Updated to Code 1.90.0.
• Updated Node to 20.11.1.

Added Copy Section

• Send contents to the clipboard in the integrated terminal by piping to
  code-server --stdin-to-clipboard or code-server -c.

  You may want to make this an alias:

  text Copy

  alias xclip="code-server --stdin-to-clipboard"
  echo -n "hello world" | xclip

[4.89.1](https://github.com/coder/code-server/releases/tag/v4.89.1) - 2024-04-14 Copy Chapter

Code v1.89.1

Changed Copy Section

• Updated to Code 1.89.1.

[4.89.0](https://github.com/coder/code-server/releases/tag/v4.89.0) - 2024-04-08 Copy Chapter

Code v1.89.0

Changed Copy Section

• Updated to Code 1.89.0.

[4.23.1](https://github.com/coder/code-server/releases/tag/v4.23.1) - 2024-04-15 Copy Chapter

Code v1.88.1

Changed Copy Section

• Updated to Code 1.88.1.

[4.23.0](https://github.com/coder/code-server/releases/tag/v4.23.0) - 2024-04-08 Copy Chapter

Code v1.88.0

Changed Copy Section

• Updated to Code 1.88.0.
• Updated Node to 18.18.2.

Fixed Copy Section

• Fix masking the exit code when failing to install extensions on the command
  line outside the integrated terminal. Installing extensions inside the
  integrated terminal still masks the exit code and is an upstream bug.

[4.22.1](https://github.com/coder/code-server/releases/tag/v4.22.1) - 2024-03-14 Copy Chapter

Code v1.87.2

Changed Copy Section

• Updated to Code 1.87.2.
• Enable keep-alive for proxy agent.

[4.22.0](https://github.com/coder/code-server/releases/tag/v4.22.0) - 2024-03-03 Copy Chapter

Code v1.87.0

Changed Copy Section

• Updated to Code 1.87.0.

[4.21.2](https://github.com/coder/code-server/releases/tag/v4.21.2) - 2024-02-28 Copy Chapter

Code v1.86.2

Changed Copy Section

• Updated to Code 1.86.2.

[4.21.1](https://github.com/coder/code-server/releases/tag/v4.21.1) - 2024-02-09 Copy Chapter

Code v1.86.1

Changed Copy Section

• Updated to Code 1.86.1.
• Updated to Node 18.17.1.

Added Copy Section

• Docker images for Fedora and openSUSE.

[4.21.0](https://github.com/coder/code-server/releases/tag/v4.21.0) - 2024-02-05 Copy Chapter

Code v1.86.0

Changed Copy Section

• Updated to Code 1.86.0.

[4.20.1](https://github.com/coder/code-server/releases/tag/v4.20.1) - 2024-01-22 Copy Chapter

Code v1.85.2

Changed Copy Section

• Updated to Code 1.85.2.

Fixed Copy Section

• Query variables are no longer double-encoded when going over the path proxy.

[4.20.0](https://github.com/coder/code-server/releases/tag/v4.20.0) - 2023-12-21 Copy Chapter

Code v1.85.1

Added Copy Section

• New flag --disable-file-uploads to disable uploading files to the remote by
  drag and drop and to disable opening local files via the "show local" button
  in the file open prompt. Note that you can still open local files by drag and
  dropping the file onto the editor pane.
• Added wget to the release image.

Changed Copy Section

• Updated to Code 1.85.1.
• The --disable-file-downloads flag will now disable the "show local" button
  in the file save prompt as well.
• Debian release image updated to use Bookworm.

[4.19.1](https://github.com/coder/code-server/releases/tag/v4.19.1) - 2023-11-29 Copy Chapter

Code v1.84.2

Fixed Copy Section

• Fixed an issue where parts of the editor would not load (like the file
  explorer, source control, etc) when using a workspace file.

[4.19.0](https://github.com/coder/code-server/releases/tag/v4.19.0) - 2023-11-18 Copy Chapter

Code v1.84.2

Changed Copy Section

• Updated to Code 1.84.2.

[4.18.0](https://github.com/coder/code-server/releases/tag/v4.18.0) - 2023-10-20 Copy Chapter

Code v1.83.1

Changed Copy Section

• Updated to Code 1.83.1.

[4.17.1](https://github.com/coder/code-server/releases/tag/v4.17.1) - 2023-09-29 Copy Chapter

Code v1.82.2

Fixed Copy Section

• Make secret storage persistent. For example, logging in with GitHub should
  persist between browser refreshes and code-server restarts.
• Issues with argon2 on arm builds should be fixed now.

[4.17.0](https://github.com/coder/code-server/releases/tag/v4.17.0) - 2023-09-22 Copy Chapter

Code v1.82.2

Added Copy Section

• Japanese locale.
• CODE_SERVER_HOST environment variable.

Changed Copy Section

• Update to Code 1.82.2. This includes an update to Node 18, which also means
  that the minimum glibc is now 2.28. If you need to maintain a lower glibc then
  you can take a version of Node 18 that is compiled with a lower glibc and use
  that to build code-server (or at a minimum rebuild the native modules).
• Display paths to config files in full rather than abbreviated. If you have
  trouble with the password not working please update and make sure the
  displayed config paths are what you expect.

Fixed Copy Section

• Fix some dependency issues for the standalone arm64 and armv7l releases. If
  you had issues with missing or failing modules please try these new builds.

[4.16.1](https://github.com/coder/code-server/releases/tag/v4.16.1) - 2023-07-31 Copy Chapter

Code v1.80.2

Changed Copy Section

• Updated to Code 1.80.2.

[4.16.0](https://github.com/coder/code-server/releases/tag/v4.16.0) - 2023-07-28 Copy Chapter

Code v1.80.1

Added Copy Section

• --disable-proxy flag. This disables the domain and path proxies but it does
  not disable the ports panel in Code. That can be disabled by using
  remote.autoForwardPorts=false in your settings.

[4.15.0](https://github.com/coder/code-server/releases/tag/v4.15.0) - 2023-07-21 Copy Chapter

Code v1.80.1

Changed Copy Section

• Updated to Code 1.80.1.

Added Copy Section

• --trusted-origin flag for specifying origins that you trust but do not
  control (for example a reverse proxy).

Code v1.79.2

[4.14.1](https://github.com/coder/code-server/releases/tag/v4.14.1) - 2023-06-26 Copy Chapter

Code v1.79.2

Security Copy Section

• Remove extra write permissions on the Node binary bundled with the linux-amd64
  tarball. If you extract the tar without a umask this could mean the Node
  binary would be unexpectedly writable.

Fixed Copy Section

• Inability to launch multiple instances of code-server for different users.

Added Copy Section

• --session-socket CLI flag to configure the location of the session socket.
  By default it will be placed in /code-server-ipc.sock.

[4.14.0](https://github.com/coder/code-server/releases/tag/v4.14.0) - 2023-06-16 Copy Chapter

Code v1.79.2

Added Copy Section

• --domain-proxy now supports {{port}} and {{host}} template variables.

Changed Copy Section

• Updated to Code 1.79.2
• Files opened from an external terminal will now open in the most closely
  related window rather than in the last opened window.

[4.13.0](https://github.com/coder/code-server/releases/tag/v4.13.0) - 2023-05-19 Copy Chapter

Code v1.78.2

Changed Copy Section

• Updated to Code 1.78.2.

Fixed Copy Section

• Proxying files that contain non-ASCII characters.
• Origin check when X-Forwarded-Host contains comma-separated hosts.

[4.12.0](https://github.com/coder/code-server/releases/tag/v4.12.0) - 2023-04-21 Copy Chapter

Code v1.77.3

Changed Copy Section

• Updated to Code 1.77.3
• Ports panel will use domain-based proxy (instead of the default path-based
  proxy) when set via --proxy-domain.
• Apply --app-name to the PWA title.

Added Copy Section

• Thai translation for login page.
• Debug logs around the origin security check. If you are getting forbidden
  errors on web sockets please run code-server with --log debug to see why the
  requests are being blocked.

[4.11.0](https://github.com/coder/code-server/releases/tag/v4.11.0) - 2023-03-16 Copy Chapter

Code v1.76.1

Changed Copy Section

• Updated to Code 1.76.1

[4.10.1](https://github.com/coder/code-server/releases/tag/v4.10.1) - 2023-03-04 Copy Chapter

Code v1.75.1

Security Copy Section

Added an origin check to web sockets to prevent cross-site hijacking attacks on
users using older or niche browser that do not support SameSite cookies and
attacks across sub-domains that share the same root domain.

The check requires the host header to be set so if you use a reverse proxy
ensure it forwards that information otherwise web sockets will be blocked.

[4.10.0](https://github.com/coder/code-server/releases/tag/v4.10.0) - 2023-02-15 Copy Chapter

Code v1.75.1

Changed Copy Section

• Updated to Code 1.75.1

Removed Copy Section

• Removed --link (was deprecated over thirteen months ago in 4.0.1).

[4.9.1](https://github.com/coder/code-server/releases/tag/v4.9.1) - 2022-12-15 Copy Chapter

Code v1.73.1

Changed Copy Section

• Updated a couple steps in the build and release process to ensure we're using
  npm and yarn consistently depending on the step.

Fixed Copy Section

• Fixed an issue with code-server version not displaying in the Help > About window.
• Fixed terminal not loading on macOS clients.

[4.9.0](https://github.com/coder/code-server/releases/tag/v4.9.0) - 2022-12-06 Copy Chapter

Code v1.73.1

Changed Copy Section

• Upgraded to Code 1.73.1

Added Copy Section

• /security.txt added as a route with info on our security policy information thanks to @ghuntley

Fixed Copy Section

• Installing on majaro images should now work thanks to @MrPeacockNLB for
  adding the --noconfirm flag in install.sh

Known Issues Copy Section

• --cert on Ubuntu 22.04: OpenSSL v3 is used which breaks pem meaning the
  --cert feature will not work. Reference

[4.8.3](https://github.com/coder/code-server/releases/tag/v4.8.3) - 2022-11-07 Copy Chapter

Code v1.72.1

Added Copy Section

• install script now supports arch-like (i.e. manjaro, endeavourous, etc.)
  architectures

Changed Copy Section

• Updated text in the Getting Started page.

[4.8.2](https://github.com/coder/code-server/releases/tag/v4.8.2) - 2022-11-02 Copy Chapter

Code v1.72.1

Added Copy Section

• New text in the Getting Started page with info about
  coder/coder. This is enabled by default but can be disabled by passing the CLI
  flag --disable-getting-started-override or setting
  CS_DISABLE_GETTING_STARTED_OVERRIDE=1 or
  CS_DISABLE_GETTING_STARTED_OVERRIDE=true.

[4.8.1](https://github.com/coder/code-server/releases/tag/v4.8.1) - 2022-10-28 Copy Chapter

Code v1.72.1

Fixed Copy Section

• Fixed CSP error introduced in 4.8.0 that caused issues with webviews and most
  extensions.

[4.8.0](https://github.com/coder/code-server/releases/tag/v4.8.0) - 2022-10-24 Copy Chapter

Code v1.72.1

Added Copy Section

• Support for the Ports panel which leverages code-server's built-in proxy. It
  also uses VSCODE_PROXY_URI where {{port}} is replace when forwarding a port.
  Example: VSCODE_PROXY_URI=https://{{port}}.kyle.dev would forward an
  application running on localhost:3000 to https://3000.kyle.dev
• Support for --disable-workspace-trust CLI flag
• Support for --goto flag to open file @ line:column
• Added Ubuntu-based images for Docker releases. If you run into issues with
  PATH being overwritten in Docker please try the Ubuntu image as this is a
  problem in the Debian base image.

Changed Copy Section

• Updated Code to 1.72.1

Fixed Copy Section

• Enabled BROWSER environment variable
• Patched asExternalUri to work so now extensions run inside code-server can use it

[4.7.1](https://github.com/coder/code-server/releases/tag/v4.7.1) - 2022-09-30 Copy Chapter

Code v1.71.2

Changed Copy Section

• Updated Code to 1.71.2

Fixed Copy Section

• Fixed install script not upgrading code-server when already installed on RPM-based machines
• Fixed install script failing to gain root permissions on FreeBSD

[4.7.0](https://github.com/coder/code-server/releases/tag/v4.7.0) - 2022-09-09 Copy Chapter

Code v1.71.0

Changed Copy Section

• Updated Code to 1.71.0

Removed Copy Section

• Dropped heartbeat patch because it was implemented upstream

Fixed Copy Section

• Add flags --unsafe-perm --legacy-peer-deps in npm-postinstall.sh which ensures installing with npm works correctly

[4.6.1](https://github.com/coder/code-server/releases/tag/v4.6.1) - 2022-09-31 Copy Chapter

Code v1.70.2

Changed Copy Section

• Updated Code to 1.70.2
• Updated argon2 to 0.29.0 which should fix issues on FreeBSD
• Updated docs to suggest using npm instead of yarn

Removed Copy Section

• Dropped database migration patch affected to 4.0.2 versions and earlier.

Fixed Copy Section

• Fixed preservation of process.execArgv which means you can pass --prof to profile code-server

[4.6.0](https://github.com/coder/code-server/releases/tag/v4.6.0) - 2022-08-17 Copy Chapter

Code v1.70.1

Changed Copy Section

• Updated Code to 1.70.1.

Added Copy Section

• Added a heartbeat to sockets. This should prevent them from getting closed by
  reverse proxy timeouts when idle like NGINX's default 60-second timeout.

Fixed Copy Section

• Fixed logout option appearing even when authentication is disabled.

[4.5.2](https://github.com/coder/code-server/releases/tag/v4.5.2) - 2022-08-15 Copy Chapter

Code v1.68.1

Security Copy Section

• Fixed the proxy route not performing authentication. For example if you were
  to run a development HTTP server using python -m http.server 8000 then it
  would be accessible at my.domain/proxy/8000/ without any authentication.

  If all of the following apply to you please update as soon as possible:

  • You run code-server with the built-in password authentication.
  • You run unprotected HTTP services on ports accessible by code-server.

Changed Copy Section

• Invoking code-server in the integrated terminal will now use the script that
  comes with upstream Code. This means flags like --wait will be
  automatically supported now. However the upstream script only has the ability
  to interact with the running code-server and cannot spawn new instances. If
  you need to spawn a new code-server from the integrated terminal please
  specify the full path to code-server's usual script (for example
  /usr/bin/code-server).

Fixed Copy Section

• Invoking code-server in the integrated terminal will now work instead of
  erroring about not finding Node.

[4.5.1](https://github.com/coder/code-server/releases/tag/v4.5.1) - 2022-07-18 Copy Chapter

Code v1.68.1

Changed Copy Section

• We now use release/v<0.0.0> for the release branch name so it doesn't
  conflict with the tag name
• Added .prettierignore to ignore formatting files in lib/vscode

Added Copy Section

• Allow more comprehensive affinity config in Helm chart
• Added custom message in Homebrew PR to make sure code-server maintainers are
  tagged
• Allow setting priorityClassName via Helm chart
• Added troubleshooting docs to CONTRIBUTING.md

Fixed Copy Section

• Removed default memory limit which was set via NODE_OPTIONS
• Changed output in pipe to make it easier to debug code-server when doing live
  edits
• Fixed display-language patch to use correct path which broke in 4.5.0
• Fixed multiple code-server windows opening when using the code-server CLI in
  the Integrated Terminal
• Fixed Integrated Terminal not working when web base was not the root path

Security Copy Section

• Updated glob-parent version in dependencies

[4.5.0](https://github.com/coder/code-server/releases/tag/v4.5.0) - 2022-06-29 Copy Chapter

Code v1.68.1

Changed Copy Section

• Updated codecov to use codecov uploader
• Moved integration tests to Jest
• Fixed docker release to only download .deb
• Upgraded to Code 1.68.1
• Install nfpm from GitHub
• Upgraded to TypeScript 4.6

Added Copy Section

• Added tests for open, isWsl, handlePasswordValidation
• Provided alternate image registry to dockerhub
• Allowed users to have scripts run on container with ENTRYPOINTD environment
  variable

Fixed Copy Section

• Fixed open CLI command to work on macOS

[4.4.0](https://github.com/coder/code-server/releases/tag/v4.4.0) - 2022-05-06 Copy Chapter

Code v1.66.2

Changed Copy Section

• Refactored methods in Heart class and made Heart.beat() async to make
  testing easier.
• Upgraded to Code 1.66.2.

Added Copy Section

• Added back telemetry patch which was removed in the Code reachitecture.
• Added support to use true for CS_DISABLE_FILE_DOWNLOADS environment
  variable. This means you can disable file downloads by setting
  CS_DISABLE_FILE_DOWNLOADS to true or 1.
• Added tests for Heart class.

Fixed Copy Section

• Fixed installation issue in AUR after LICENSE rename.
• Fixed issue with listening on IPv6 addresses.
• Fixed issue with Docker publish action not being able to find artifacts. Now
  it downloads the release assets from the release.

[4.3.0](https://github.com/coder/code-server/releases/tag/v4.3.0) - 2022-04-14 Copy Chapter

Code v1.65.2

Changed Copy Section

• Excluded .deb files from release Docker image which drops the compressed and
  uncompressed size by 58% and 34%.
• Upgraded to Code 1.65.2.

Added Copy Section

• Added a new CLI flag called --disable-file-downloads which allows you to
  disable the "Download..." option that shows in the UI when right-clicking on a
  file. This can also set by running CS_DISABLE_FILE_DOWNLOADS=1.
• Aligned the dependencies for binary and npm release artifacts.

Fixed Copy Section

• Fixed the code-server version from not displaying in the Help > About dialog.
• Fixed issues with the TypeScript and JavaScript Language Features Extension
  failing to activate.
• Fixed missing files in ipynb extension.
• Fixed the homebrew release workflow.
• Fixed the Docker release workflow from not always publishing version tags.

[4.2.0](https://github.com/coder/code-server/releases/tag/v4.2.0) - 2022-03-22 Copy Chapter

Code v1.64.2

Added Copy Section

• Added tests for handleArgsSocketCatchError, setDefaults and
  optionDescriptions.

Changed Copy Section

• We switched from using the fork coder/vscode to a submodule of
  microsoft/vscode + patches managed by quilt for how Code sits inside the
  code-server codebase.
• Upgraded to Code 1.64.2.

Fixed Copy Section

• Update popup notification through --disable-update-check is now fixed.
• Fixed PWA icons not loading on iPad
• Fixed the homebrew release process. Our cdrci bot should now automatically
  update the version as part of the release pipeline.
• Fixed titleBar color setting being ignored in PWA.

Security Copy Section

• Updated to minimist-list.
• Updated cloud-agent to v0.2.4 which uses nhooyr.io/webscoket v1.8.7.

[4.1.0](https://github.com/coder/code-server/releases/tag/v4.1.0) - 2022-03-03 Copy Chapter

Code v1.63.0

Added Copy Section

• Support for injecting GitHub token into Code so extensions can make use of it.
  This can be done with the GITHUB_TOKEN environment variable or github-auth
  in the config file.
• New flag --socket-mode allows setting the mode (file permissions) of the
  socket created when using --socket.
• The version of Code bundled with code-server now appears when using the
  --version flag. For example: 4.0.2 5cdfe74686aa73e023f8354a9a6014eb30caa7dd with Code 1.63.0.
  If you have been parsing this flag for the version you might want to use
  --version --json instead as doing that will be more stable.

Changed Copy Section

• The workspace or folder passed on the CLI will now use the same redirect
  method that the last opened workspace or folder uses. This means if you use
  something like code-server /path/to/dir you will now get a query parameter
  added (like so: my-domain.tld?folder=/path/to/dir), making it easier to edit
  by hand and making it consistent with the last opened and menu open behaviors.
• The folder/workspace query parameter no longer has encoded slashes, making
  them more readable and editable by hand. This was only affecting the last
  opened behavior, not opens from the menu.

Fixed Copy Section

• Fix web sockets not connecting when using --cert.
• Prevent workspace state collisions when opening a workspace that shares the
  same file path with another workspace on a different machine that shares the
  same domain. This was causing files opened in one workspace to be "re-"opened
  in the other workspace when the other workspace is opened.
• Pin the Express version which should make installing from npm work again.
• Propagate signals to code-server in the Docker image which means it should
  stop more quickly and gracefully.
• Fix missing argon binaries in the standalone releases on arm machines.

[4.0.2](https://github.com/coder/code-server/releases/tag/v4.0.2) - 2022-01-27 Copy Chapter

Code v1.63.0

Fixed Copy Section

• Unset the BROWSER environment variable. This fixes applications that hard
  exit when trying to spawn the helper script BROWSER points to because the
  file is missing. While we do include the script now we are leaving the
  variable omitted because the script does not work yet.

[4.0.1](https://github.com/coder/code-server/releases/tag/v4.0.1) - 2022-01-04 Copy Chapter

Code v1.63.0

code-server has been rebased on upstream's newly open-sourced server
implementation (#4414).

Changed Copy Section

• Web socket compression has been made the default (when supported). This means
  the --enable flag will no longer take permessage-deflate as an option.
• The static endpoint can no longer reach outside code-server. However the
  vscode-remote-resource endpoint still can.
• OpenVSX has been made the default marketplace.
• The last opened folder/workspace is no longer stored separately in the
  settings file (we rely on the already-existing query object instead).
• The marketplace override environment variables SERVICE_URL and ITEM_URL
  have been replaced with a single EXTENSIONS_GALLERY variable that
  corresponds to extensionsGallery in Code's product.json.

Added Copy Section

• VSCODE_PROXY_URI env var for use in the terminal and extensions.

Removed Copy Section

• Extra extension directories have been removed. The --extra-extensions-dir
  and --extra-builtin-extensions-dir flags will no longer be accepted.
• The --install-source flag has been removed.

Deprecated Copy Section

• --link is now deprecated (#4562).

Security Copy Section

• We fixed a XSS vulnerability by escaping HTML from messages in the error page (#4430).

[3.12.0](https://github.com/coder/code-server/releases/tag/v3.12.0) - 2021-09-15 Copy Chapter

Code v1.60.0

Changed Copy Section

• Upgrade Code to 1.60.0.

Fixed Copy Section

• Fix logout when using a base path (#3608).

[3.11.1](https://github.com/coder/code-server/releases/tag/v3.11.1) - 2021-08-06 Copy Chapter

Undocumented (see releases page).

[3.11.0](https://github.com/coder/code-server/releases/tag/v3.11.0) - 2021-06-14 Copy Chapter

Undocumented (see releases page).

[3.10.2](https://github.com/coder/code-server/releases/tag/v3.10.2) - 2021-05-21 Copy Chapter

Code v1.56.1

Added Copy Section

• Support extraInitContainers in helm chart values (#3393).

Changed Copy Section

• Change extraContainers to support templating in helm chart (#3393).

Fixed Copy Section

• Fix "Open Folder" on welcome page (#3437).

[3.10.1](https://github.com/coder/code-server/releases/tag/v3.10.1) - 2021-05-17 Copy Chapter

Code v1.56.1

Fixed Copy Section

• Check the logged user instead of $USER (#3330).
• Fix broken node_modules.asar symlink in npm package (#3355).
• Update cloud agent to fix version issue (#3342).

Changed Copy Section

• Use xdgBasedir.runtime instead of tmp (#3304).

[3.10.0](https://github.com/coder/code-server/releases/tag/v3.10.0) - 2021-05-10 Copy Chapter

Code v1.56.0

Changed Copy Section

• Update to Code 1.56.0 (#3269).
• Minor connections refactor (#3178). Improves connection stability.
• Use ptyHostService (#3308). This brings us closer to upstream Code.

Added Copy Section

• Add flag for toggling permessage-deflate (#3286). The default is off so
  compression will no longer be used by default. Use the --enable flag to
  toggle it back on.

Fixed Copy Section

• Make rate limiter not count against successful logins (#3141).
• Refactor logout (#3277). This fixes logging out in some scenarios.
• Make sure directories exist (#3309). This fixes some errors on startup.

Security Copy Section

• Update dependencies with CVEs (#3223).

Previous versions Copy Chapter

This was added with 3.10.0, which means any previous versions are not
documented in the changelog.

To see those, please visit the Releases page.