Runtime

How to run VS Code in the browser from a cloud sandbox with code-server

Install code-server's .deb in the sandbox, start it on 127.0.0.1:8080 with spawn, and open it through a private HTTPS preview.

On Runtime the editor sits behind two locks and costs little while you read. The preview address refuses any request without its token, and code-server asks for its own password as well. The sandbox is billed on the CPU it uses, so a 2 vCPU, 4 GiB sandbox with an editor open and idle costs $0.03125 an hour. code-server 4.138.0 was the current release on 25 September 2026.

Install and open it

TypeScriptimport { randomBytes } from "node:crypto";import { Sandbox } from "withruntime";const version = "4.138.0";const password = randomBytes(18).toString("base64url");const sbx = await Sandbox.create({ name: "editor-alice", timeoutSeconds: 3600 });await sbx.exec(  `curl -fsSLO https://github.com/coder/code-server/releases/download/v${version}/code-server_${version}_amd64.deb` +    ` && sudo dpkg -i code-server_${version}_amd64.deb && rm code-server_${version}_amd64.deb`,  { check: true, timeoutMs: 600_000 },);await sbx.files.upload("./project", "/workspace/project");await sbx.spawn(  "code-server --bind-addr 127.0.0.1:8080 --disable-telemetry --disable-workspace-trust /workspace/project",  { env: { PASSWORD: password } },);await sbx.exec("npx wait-on@9.1.0 tcp:127.0.0.1:8080", { check: true, timeoutMs: 60_000 });const preview = await sbx.previews.create(8080);console.log("open:", preview.urlWithToken);console.log("password:", password);
Pythonimport secretsfrom withruntime import SandboxVERSION = "4.138.0"password = secrets.token_urlsafe(18)sbx = Sandbox.create(name="editor-alice", timeout_seconds=3600)sbx.exec(f"curl -fsSLO https://github.com/coder/code-server/releases/download/v{VERSION}/code-server_{VERSION}_amd64.deb"         f" && sudo dpkg -i code-server_{VERSION}_amd64.deb && rm code-server_{VERSION}_amd64.deb",         check=True, timeout_ms=600_000)sbx.files.upload("./project", "/workspace/project")sbx.spawn("code-server --bind-addr 127.0.0.1:8080 --disable-telemetry --disable-workspace-trust /workspace/project",          env={"PASSWORD": password})sbx.exec("npx wait-on@9.1.0 tcp:127.0.0.1:8080", check=True, timeout_ms=60_000)preview = sbx.previews.create(8080)print("open:", preview["urlWithToken"])print("password:", password)
  • The link: urlWithToken is a one-time link for one browser. Open it where the editor will be used and keep it to yourself.
  • The password: code-server reads it only from $PASSWORD or its config file, never from a flag, so it stays out of the process list. It comes from env, which Runtime never echoes back.
  • The address: code-server listens on loopback only. The preview reaches it from inside the sandbox; nothing else can.
  • The flags: --disable-workspace-trust skips the "Do you trust the authors" prompt for a folder you uploaded yourself; --disable-telemetry turns off code-server's telemetry.

The .deb route is the one code-server's install guide gives for Debian and Ubuntu. Its systemctl enable step is not needed here: spawn keeps the editor running after your call returns.

Extensions

code-server installs extensions from Open VSX, not Microsoft's marketplace. Add them from the command line before a person opens the editor:

Terminalcode-server --install-extension ms-python.python

An extension that exists only on Microsoft's marketplace can be installed from a .vsix file with the same flag.

Browser editor, desktop editor or terminal

Each way in suits a different person:

Way in What the person needs Extensions from Good for
code-server via a preview A browser and the link Open VSX A reviewer, a student, a tablet, a locked-down laptop
VS Code with Remote - SSH VS Code and runtime sandbox ssh config --install Microsoft's marketplace Your own daily work
JetBrains Gateway Gateway and the same SSH config JetBrains IntelliJ, PyCharm and GoLand users
runtime sandbox ssh The Runtime CLI None A quick shell

The desktop routes go through Runtime's API with the person's own key (SSH and editors). code-server needs no Runtime account at all, which is why it suits handing a workspace to someone else.

Keep the workspace between sessions

A sandbox runs for its lease, timeoutSeconds, which is at most an hour ahead. When the lease ends, the sandbox pauses: its files, its memory and its processes are kept, code-server included, and compute billing stops.

  • A longer session: sbx.extend(1800) adds half an hour, as often as needed. keepAlive in your own process extends the lease while that process runs.
  • Done for the day: sbx.pause(). Paused, the sandbox costs $0.08 per GB per 30-day month for the disk and memory it alone holds, and no compute.
  • Tomorrow: opening the preview wakes the sandbox, usually in about half a second, behind a short "Waking up" page, with the editor as it was left. From code, Sandbox.getOrCreate("editor-alice") finds the same sandbox by name.

Bake code-server into an image

Install it once in a custom image and every sandbox starts with the editor ready. Recipe commands run as root, so they need no sudo:

TypeScriptimport { Runtime } from "withruntime";const runtime = new Runtime();const version = "4.138.0";await runtime.images.build({  name: "code-server",  recipe: {    commands: [      `curl -fsSLO https://github.com/coder/code-server/releases/download/v${version}/code-server_${version}_amd64.deb`,      `dpkg -i code-server_${version}_amd64.deb && rm code-server_${version}_amd64.deb`,    ],  },});const sbx = await runtime.sandboxes.create({ image: "code-server" });await sbx.spawn("code-server --bind-addr 127.0.0.1:8080 --disable-telemetry /workspace", {  env: { PASSWORD: process.env.EDITOR_PASSWORD ?? "" },});

Keep the password out of the image: pass it to spawn for each sandbox, so two workspaces never share one.

Sources

Checked 25 September 2026.

Facts on this page were checked on 25 September 2026.

Claim 50 hours free