Can I share a code-server instance for multiple, isolated users?

[Steffen911]

Hello everyone,

We want to use VSCode in the browser to provide users a familiar IDE feeling when they make changes in our application. To save on costs and provisioning time our naive solution would involve a set of dockerized code-server containers behind a load balancer on kubernetes that all users access.

Now my main question is: Can I enforce any isolation between the individual sessions if they use the same underlying host? If two users Alice and Bob use the instance at the same time, what information from Alice could Bob read?

This goes into the direction of this comment, but the conversation was quickly dropped without a satisfactory reply.

[jsjoeio]

Have you checked out coder/coder? That was built with this kind of use case in mind except that each user has their own workspace, which could include code-server.

Link to docs on Kubernetes installation.

[jsjoeio]

Ah, I see. Good question. I wish I could point you to someone in the community who's done this successfully so they could answer 🤔 I'll ask internally too.

Have you checked out this answer?

[Steffen911]

@jsjoeio Thank you a lot. I really appreciate your help.

Regarding the other question: My understanding is that it still recommends one docker container per user for isolation and only covers how to share things between those images. IMO that's the same approach coder/coder uses with less management features. Therefore, I don't think that this solves my problem.

[jsjoeio]

Makes sense! @bpmct is actually working on a blog post to talk about how we use coder at Coder. I think he said we spend roughly $400/month for the engineering team. What's the budget y'all are working with? That'll help me talk to some other engineers to see what might be the most cost-effective solution for you.

[Steffen911]

It is hard to tell in our case. We want to expose VSCode in the browser as a feature to clients. Ideally, our infra costs scale sub-linearly with the number of users, but I assume some single digit dollar amount per user would be our expectation.

[bpmct]

Hey @Steffen911 with templates, you can make each workspace a single container, or multiple containers, still isolated to the user. There's also support for Docker in Docker. We're considering creating a local template that leverages unix users to separate concerns.

How many users do you expect to support? Regardless of Docker or Unix users, it seems like any remote dev solution would scale per user.

[tobycm]

For me, I and another 3 users share a machine so we installed code-server on it, create for each user a Linux account and made a simple python script that when they access the API, it will run code-server on each member's Linux account. This way the user is restricted by default to their home directory and can still use code-server.
I also use caddy to be the reverse proxy.

If you need the code I can push it to GitHub.

[jsjoeio]

Can you push to GitHub? I'd love to see and share with others!

[joergklein]

Is it possible to send the link to the GitHub Repository?

Thank you

[tobycm]

@joergklein Sure, it's https://github.com/tobycm/nginx-vscode-server-classifier and https://github.com/tobycm/code-server-instance-manager-nginx

[dedrisproject]

we try to build similar structure, (cloud developer suite for internal use)

all developer join in a dashboard, on this dashboard he can see the list of task for project and list of project - for every project-user we run a single docker with password in autologin and file of the project repository - every developer have more docker, (1 project = 1 docker ) if 2 developer work on same project we use 2 docker - we have a Nginx reverse proxy for generate a subdomain like -> developer-username-project-name.companyname.com - we have edited the login page - if you try to open directly the url, you get a redirect from company login system, if you have the rigth session you can use this code-space.

Now we try to make other customization to code-space (visual studio code web) for branding and custom link to developer internal resource, like snippet, internal wiki with best pratices, tutorial etc..