# How to run VS Code in the browser from a cloud sandbox with code-server

Install code-server's .deb in the sandbox. Start it on 127.0.0.1:8080 with spawn, and open it through a private HTTPS preview.

**On Runtime, the editor sits behind two locks and costs little while you
read.** The preview address refuses any request without its token. code-server
also asks for its own password. The sandbox is billed on the CPU it uses. A 2
vCPU, 4 GiB sandbox with an editor open and idle costs $0.03125 an hour.
code-server 4.143.1 was the current release on 25 October 2026.

## Install and open it

```ts check
import { randomBytes } from "node:crypto";
import { Sandbox } from "withruntime";

const version = "4.143.1";
const password = randomBytes(18).toString("base64url");

const sbx = await Sandbox.create({ name: "editor-alice", timeoutSeconds: 3600 });
await sbx.exec(
  `curl -fsSLO https://github.com/coder/code-server/releases/download/v${version}/code-server_${version}_amd64.deb` +
    ` && sudo dpkg -i code-server_${version}_amd64.deb && rm code-server_${version}_amd64.deb`,
  { check: true, timeoutMs: 600_000 },
);
await sbx.files.upload("./project", "/workspace/project");

await sbx.spawn(
  "code-server --bind-addr 127.0.0.1:8080 --disable-telemetry --disable-workspace-trust /workspace/project",
  { env: { PASSWORD: password } },
);
await sbx.exec("npx wait-on@9.1.0 tcp:127.0.0.1:8080", { check: true, timeoutMs: 60_000 });

const preview = await sbx.previews.create(8080);
console.log("open:", preview.urlWithToken);
console.log("password:", password);
```

```python check
import secrets
from withruntime import Sandbox

VERSION = "4.143.1"
password = secrets.token_urlsafe(18)

sbx = Sandbox.create(name="editor-alice", timeout_seconds=3600)
sbx.exec(f"curl -fsSLO https://github.com/coder/code-server/releases/download/v{VERSION}/code-server_{VERSION}_amd64.deb"
         f" && sudo dpkg -i code-server_{VERSION}_amd64.deb && rm code-server_{VERSION}_amd64.deb",
         check=True, timeout_ms=600_000)
sbx.files.upload("./project", "/workspace/project")

sbx.spawn("code-server --bind-addr 127.0.0.1:8080 --disable-telemetry --disable-workspace-trust /workspace/project",
          env={"PASSWORD": password})
sbx.exec("npx wait-on@9.1.0 tcp:127.0.0.1:8080", check=True, timeout_ms=60_000)

preview = sbx.previews.create(8080)
print("open:", preview["urlWithToken"])
print("password:", password)
```

- **The link:** `urlWithToken` carries the preview's token. Anyone who holds it
  gets in until the token expires. Keep it to yourself, and rotate the token if
  it leaks.
- **The password:** code-server reads it only from `$PASSWORD` or its config
  file, never from a flag. The password therefore stays out of the process list.
  It comes from `env`, which Runtime never echoes back.
- **The address:** code-server listens on loopback only. The preview reaches it
  from inside the sandbox. Nothing else can.
- **The flags:** `--disable-workspace-trust` skips the "Do you trust the
  authors" prompt for a folder you uploaded yourself. `--disable-telemetry`
  turns off code-server's telemetry.

The `.deb` route is the one that code-server's install guide gives for Debian
and Ubuntu. Its `systemctl enable` step is not needed here, because `spawn`
keeps the editor running after your call returns.

## Extensions

code-server installs extensions from Open VSX, not from Microsoft's
marketplace. Add extensions from the command line before a person opens the editor:

```bash no-run
code-server --install-extension ms-python.python
```

An extension that exists only on Microsoft's marketplace can be installed from
a `.vsix` file with the same flag.

## Browser editor, desktop editor or terminal

Each way in suits a different person:

| Way in                    | What the person needs                                | Extensions from         | Good for                                              |
| ------------------------- | ---------------------------------------------------- | ----------------------- | ----------------------------------------------------- |
| code-server via a preview | A browser and the link                               | Open VSX                | A reviewer, a student, a tablet, a locked-down laptop |
| VS Code with Remote - SSH | VS Code and `runtime sandboxes ssh config --install` | Microsoft's marketplace | Your own daily work                                   |
| JetBrains Gateway         | Gateway and the same SSH config                      | JetBrains               | IntelliJ, PyCharm and GoLand users                    |
| `runtime sandboxes ssh`   | The Runtime CLI                                      | None                    | A quick shell                                         |

The desktop routes go through Runtime's API with the person's own key
([SSH and editors](/docs/editors)). code-server needs no Runtime account at
all. That is why it suits handing a workspace to someone else.

## Keep the workspace between sessions

A sandbox has no time limit. It runs while you work, and it pauses itself when
idle. While paused, its files, memory and processes are kept, code-server
included. Compute billing stops.

- **A longer session:** nothing to do. An open editor keeps the sandbox running.
- **Done for the day:** `sbx.pause()`. While paused, the sandbox costs $0.08 per GB
  per 30-day month for the disk and memory it alone holds, and no compute.
- **Tomorrow:** opening the preview wakes the sandbox. A short "Waking up" page appears, and the editor opens as it was left. From
  code, `Sandbox.getOrCreate("editor-alice")` finds the same sandbox by name.

## Bake code-server into an image

Install it once in a [custom image](/docs/images), and every sandbox starts
with the editor ready. Recipe commands run as root, so they need no `sudo`:

```ts check
import { Runtime } from "withruntime";

const runtime = new Runtime();
const version = "4.143.1";
await runtime.images.build({
  name: "code-server",
  recipe: {
    commands: [
      `curl -fsSLO https://github.com/coder/code-server/releases/download/v${version}/code-server_${version}_amd64.deb`,
      `dpkg -i code-server_${version}_amd64.deb && rm code-server_${version}_amd64.deb`,
    ],
  },
});

const sbx = await runtime.sandboxes.create({ image: "code-server" });
await sbx.spawn("code-server --bind-addr 127.0.0.1:8080 --disable-telemetry /workspace", {
  env: { PASSWORD: process.env.EDITOR_PASSWORD ?? "" },
});
```

Keep the password out of the image. Pass it to `spawn` for each sandbox, so
two workspaces never share one.

## Related

- [Give every user their own cloud dev environment](/use-cases/per-user-dev-environments)
- [Share a port](/docs/javascript#share-a-port)
- [Git over HTTPS or SSH in a sandbox](/integrations/git)
- [Pause and resume a sandbox](/how-to/pause-and-resume-a-sandbox)

## Sources

Checked 25 October 2026.

- [code-server install guide](https://coder.com/docs/code-server/install):
  the Debian and Ubuntu `.deb` steps
- [code-server FAQ](https://coder.com/docs/code-server/FAQ): Open VSX,
  `--install-extension`, and password settings
- [code-server CLI source](https://github.com/coder/code-server/blob/main/src/node/cli.ts):
  `--bind-addr`, `--disable-telemetry`, `--disable-workspace-trust`, and the
  password only from `$PASSWORD` or the config file
- [code-server on npm](https://www.npmjs.com/package/code-server): version
  4.143.1

Facts on this page were checked on 25 October 2026.