On Runtime, the editor sits behind two locks and costs little while you read. The preview address refuses any request without its token. code-server also asks for its own password. The sandbox is billed on the CPU it uses. A 2 vCPU, 4 GiB sandbox with an editor open and idle costs $0.03125 an hour. code-server 4.143.1 was the current release on 25 October 2026.
Install and open it
TypeScriptimport { randomBytes } from "node:crypto";import { Sandbox } from "withruntime";const version = "4.143.1";const password = randomBytes(18).toString("base64url");const sbx = await Sandbox.create({ name: "editor-alice", timeoutSeconds: 3600 });await sbx.exec( `curl -fsSLO https://github.com/coder/code-server/releases/download/v${version}/code-server_${version}_amd64.deb` + ` && sudo dpkg -i code-server_${version}_amd64.deb && rm code-server_${version}_amd64.deb`, { check: true, timeoutMs: 600_000 },);await sbx.files.upload("./project", "/workspace/project");await sbx.spawn( "code-server --bind-addr 127.0.0.1:8080 --disable-telemetry --disable-workspace-trust /workspace/project", { env: { PASSWORD: password } },);await sbx.exec("npx wait-on@9.1.0 tcp:127.0.0.1:8080", { check: true, timeoutMs: 60_000 });const preview = await sbx.previews.create(8080);console.log("open:", preview.urlWithToken);console.log("password:", password);Pythonimport secretsfrom withruntime import SandboxVERSION = "4.143.1"password = secrets.token_urlsafe(18)sbx = Sandbox.create(name="editor-alice", timeout_seconds=3600)sbx.exec(f"curl -fsSLO https://github.com/coder/code-server/releases/download/v{VERSION}/code-server_{VERSION}_amd64.deb" f" && sudo dpkg -i code-server_{VERSION}_amd64.deb && rm code-server_{VERSION}_amd64.deb", check=True, timeout_ms=600_000)sbx.files.upload("./project", "/workspace/project")sbx.spawn("code-server --bind-addr 127.0.0.1:8080 --disable-telemetry --disable-workspace-trust /workspace/project", env={"PASSWORD": password})sbx.exec("npx wait-on@9.1.0 tcp:127.0.0.1:8080", check=True, timeout_ms=60_000)preview = sbx.previews.create(8080)print("open:", preview["urlWithToken"])print("password:", password)- The link:
urlWithTokencarries the preview's token. Anyone who holds it gets in until the token expires. Keep it to yourself, and rotate the token if it leaks. - The password: code-server reads it only from
$PASSWORDor its config file, never from a flag. The password therefore stays out of the process list. It comes fromenv, which Runtime never echoes back. - The address: code-server listens on loopback only. The preview reaches it from inside the sandbox. Nothing else can.
- The flags:
--disable-workspace-trustskips the "Do you trust the authors" prompt for a folder you uploaded yourself.--disable-telemetryturns off code-server's telemetry.
The .deb route is the one that code-server's install guide gives for Debian
and Ubuntu. Its systemctl enable step is not needed here, because spawn
keeps the editor running after your call returns.
Extensions
code-server installs extensions from Open VSX, not from Microsoft's marketplace. Add extensions from the command line before a person opens the editor:
Terminalcode-server --install-extension ms-python.pythonAn extension that exists only on Microsoft's marketplace can be installed from
a .vsix file with the same flag.
Browser editor, desktop editor or terminal
Each way in suits a different person:
| Way in | What the person needs | Extensions from | Good for |
|---|---|---|---|
| code-server via a preview | A browser and the link | Open VSX | A reviewer, a student, a tablet, a locked-down laptop |
| VS Code with Remote - SSH | VS Code and runtime sandboxes ssh config --install |
Microsoft's marketplace | Your own daily work |
| JetBrains Gateway | Gateway and the same SSH config | JetBrains | IntelliJ, PyCharm and GoLand users |
runtime sandboxes ssh |
The Runtime CLI | None | A quick shell |
The desktop routes go through Runtime's API with the person's own key (SSH and editors). code-server needs no Runtime account at all. That is why it suits handing a workspace to someone else.
Keep the workspace between sessions
A sandbox has no time limit. It runs while you work, and it pauses itself when idle. While paused, its files, memory and processes are kept, code-server included. Compute billing stops.
- A longer session: nothing to do. An open editor keeps the sandbox running.
- Done for the day:
sbx.pause(). While paused, the sandbox costs $0.08 per GB per 30-day month for the disk and memory it alone holds, and no compute. - Tomorrow: opening the preview wakes the sandbox. A short "Waking up" page appears, and the editor opens as it was left. From
code,
Sandbox.getOrCreate("editor-alice")finds the same sandbox by name.
Bake code-server into an image
Install it once in a custom image, and every sandbox starts
with the editor ready. Recipe commands run as root, so they need no sudo:
TypeScriptimport { Runtime } from "withruntime";const runtime = new Runtime();const version = "4.143.1";await runtime.images.build({ name: "code-server", recipe: { commands: [ `curl -fsSLO https://github.com/coder/code-server/releases/download/v${version}/code-server_${version}_amd64.deb`, `dpkg -i code-server_${version}_amd64.deb && rm code-server_${version}_amd64.deb`, ], },});const sbx = await runtime.sandboxes.create({ image: "code-server" });await sbx.spawn("code-server --bind-addr 127.0.0.1:8080 --disable-telemetry /workspace", { env: { PASSWORD: process.env.EDITOR_PASSWORD ?? "" },});Keep the password out of the image. Pass it to spawn for each sandbox, so
two workspaces never share one.
Related
- Give every user their own cloud dev environment
- Share a port
- Git over HTTPS or SSH in a sandbox
- Pause and resume a sandbox
Sources
Checked 25 October 2026.
- code-server install guide:
the Debian and Ubuntu
.debsteps - code-server FAQ: Open VSX,
--install-extension, and password settings - code-server CLI source:
--bind-addr,--disable-telemetry,--disable-workspace-trust, and the password only from$PASSWORDor the config file - code-server on npm: version 4.143.1
Facts on this page were checked on 25 October 2026.