# How to run VS Code in the browser from a cloud sandbox with code-server

Install code-server's .deb in the sandbox, start it on 127.0.0.1:8080 with spawn, and open it through a private HTTPS preview.

**On Runtime the editor sits behind two locks and costs little while you
read.** The preview address refuses any request without its token, and
code-server asks for its own password as well. The sandbox is billed on the CPU
it uses, so a 2 vCPU, 4 GiB sandbox with an editor open and idle costs
$0.03125 an hour. code-server 4.138.0 was the current release on
25 September 2026.

## Install and open it

```ts check
import { randomBytes } from "node:crypto";
import { Sandbox } from "withruntime";

const version = "4.138.0";
const password = randomBytes(18).toString("base64url");

const sbx = await Sandbox.create({ name: "editor-alice", timeoutSeconds: 3600 });
await sbx.exec(
  `curl -fsSLO https://github.com/coder/code-server/releases/download/v${version}/code-server_${version}_amd64.deb` +
    ` && sudo dpkg -i code-server_${version}_amd64.deb && rm code-server_${version}_amd64.deb`,
  { check: true, timeoutMs: 600_000 },
);
await sbx.files.upload("./project", "/workspace/project");

await sbx.spawn(
  "code-server --bind-addr 127.0.0.1:8080 --disable-telemetry --disable-workspace-trust /workspace/project",
  { env: { PASSWORD: password } },
);
await sbx.exec("npx wait-on@9.1.0 tcp:127.0.0.1:8080", { check: true, timeoutMs: 60_000 });

const preview = await sbx.previews.create(8080);
console.log("open:", preview.urlWithToken);
console.log("password:", password);
```

```python check
import secrets
from withruntime import Sandbox

VERSION = "4.138.0"
password = secrets.token_urlsafe(18)

sbx = Sandbox.create(name="editor-alice", timeout_seconds=3600)
sbx.exec(f"curl -fsSLO https://github.com/coder/code-server/releases/download/v{VERSION}/code-server_{VERSION}_amd64.deb"
         f" && sudo dpkg -i code-server_{VERSION}_amd64.deb && rm code-server_{VERSION}_amd64.deb",
         check=True, timeout_ms=600_000)
sbx.files.upload("./project", "/workspace/project")

sbx.spawn("code-server --bind-addr 127.0.0.1:8080 --disable-telemetry --disable-workspace-trust /workspace/project",
          env={"PASSWORD": password})
sbx.exec("npx wait-on@9.1.0 tcp:127.0.0.1:8080", check=True, timeout_ms=60_000)

preview = sbx.previews.create(8080)
print("open:", preview["urlWithToken"])
print("password:", password)
```

- **The link:** `urlWithToken` is a one-time link for one browser. Open it
  where the editor will be used and keep it to yourself.
- **The password:** code-server reads it only from `$PASSWORD` or its config
  file, never from a flag, so it stays out of the process list. It comes from
  `env`, which Runtime never echoes back.
- **The address:** code-server listens on loopback only. The preview reaches
  it from inside the sandbox; nothing else can.
- **The flags:** `--disable-workspace-trust` skips the "Do you trust the
  authors" prompt for a folder you uploaded yourself; `--disable-telemetry`
  turns off code-server's telemetry.

The `.deb` route is the one code-server's install guide gives for Debian and
Ubuntu. Its `systemctl enable` step is not needed here: `spawn` keeps the
editor running after your call returns.

## Extensions

code-server installs extensions from Open VSX, not Microsoft's marketplace. Add
them from the command line before a person opens the editor:

```bash no-run
code-server --install-extension ms-python.python
```

An extension that exists only on Microsoft's marketplace can be installed from
a `.vsix` file with the same flag.

## Browser editor, desktop editor or terminal

Each way in suits a different person:

| Way in                    | What the person needs                              | Extensions from         | Good for                                              |
| ------------------------- | -------------------------------------------------- | ----------------------- | ----------------------------------------------------- |
| code-server via a preview | A browser and the link                             | Open VSX                | A reviewer, a student, a tablet, a locked-down laptop |
| VS Code with Remote - SSH | VS Code and `runtime sandbox ssh config --install` | Microsoft's marketplace | Your own daily work                                   |
| JetBrains Gateway         | Gateway and the same SSH config                    | JetBrains               | IntelliJ, PyCharm and GoLand users                    |
| `runtime sandbox ssh`     | The Runtime CLI                                    | None                    | A quick shell                                         |

The desktop routes go through Runtime's API with the person's own key
([SSH and editors](/docs/editors)). code-server needs no Runtime account at
all, which is why it suits handing a workspace to someone else.

## Keep the workspace between sessions

A sandbox runs for its lease, `timeoutSeconds`, which is at most an hour
ahead. When the lease ends, the sandbox pauses: its files, its memory and its
processes are kept, code-server included, and compute billing stops.

- **A longer session:** `sbx.extend(1800)` adds half an hour, as often as
  needed. `keepAlive` in your own process extends the lease while that process
  runs.
- **Done for the day:** `sbx.pause()`. Paused, the sandbox costs $0.08 per GB
  per 30-day month for the disk and memory it alone holds, and no compute.
- **Tomorrow:** opening the preview wakes the sandbox, usually in about half a
  second, behind a short "Waking up" page, with the editor as it was left. From
  code, `Sandbox.getOrCreate("editor-alice")` finds the same sandbox by name.

## Bake code-server into an image

Install it once in a [custom image](/docs/images) and every sandbox starts
with the editor ready. Recipe commands run as root, so they need no `sudo`:

```ts check
import { Runtime } from "withruntime";

const runtime = new Runtime();
const version = "4.138.0";
await runtime.images.build({
  name: "code-server",
  recipe: {
    commands: [
      `curl -fsSLO https://github.com/coder/code-server/releases/download/v${version}/code-server_${version}_amd64.deb`,
      `dpkg -i code-server_${version}_amd64.deb && rm code-server_${version}_amd64.deb`,
    ],
  },
});

const sbx = await runtime.sandboxes.create({ image: "code-server" });
await sbx.spawn("code-server --bind-addr 127.0.0.1:8080 --disable-telemetry /workspace", {
  env: { PASSWORD: process.env.EDITOR_PASSWORD ?? "" },
});
```

Keep the password out of the image: pass it to `spawn` for each sandbox, so
two workspaces never share one.

## Related

- [Give every user their own cloud dev environment](/use-cases/per-user-dev-environments)
- [Share a port](/docs/javascript#share-a-port)
- [Git over HTTPS or SSH in a sandbox](/integrations/git)
- [Pause and resume a sandbox](/how-to/pause-and-resume-a-sandbox)

## Sources

Checked 25 September 2026.

- [code-server install guide](https://coder.com/docs/code-server/install):
  the Debian and Ubuntu `.deb` steps
- [code-server FAQ](https://coder.com/docs/code-server/FAQ): Open VSX,
  `--install-extension`, and password settings
- [code-server CLI source](https://github.com/coder/code-server/blob/main/src/node/cli.ts):
  `--bind-addr`, `--disable-telemetry`, `--disable-workspace-trust`, and the
  password only from `$PASSWORD` or the config file
- [code-server on npm](https://www.npmjs.com/package/code-server): version
  4.138.0

Facts on this page were checked on 25 September 2026.