Code Server in Docker.
VS Code in your browser.

Architecture at a glance

• code-server serves plain HTTP on port 8080. TLS is terminated upstream by a reverse proxy (Traefik on the RemarkableCloud App Platform), so there is no in-container certificate to manage. WebSockets pass through the proxy for the live editor connection.
• A data volume at /home/coder holds settings, installed extensions, the config.yaml (with the login password), and your project files.
• No external database is required.

Docker Compose walkthrough

The standalone stack is defined in the image’s docker-compose.yml:

name: code-server
services:
  code-server:
    image: ${CS_IMAGE:-ghcr.io/remarkablecloud/code-server:4.137.0-r1}
    restart: unless-stopped
    ports: ["${HTTP_PORT:-8443}:8080"]
    environment:
      PASSWORD: ${PASSWORD:-}
    volumes:
      - cs-data:/home/coder
volumes:
  cs-data:

Step by step:

1. The image is pinned. CS_IMAGE lets you override the tag for a local trial; the default is the published tag.
2. Only the web port is exposed. ${HTTP_PORT:-8443}:8080 is for local use. In production the reverse proxy connects to port 8080 on the internal network and nothing is bound on the host.
3. Password is optional. Leave PASSWORD empty to auto-generate one on first run (printed once to the log); set it to pin a known password.
4. State lives in a volume. cs-data (/home/coder) persists settings, extensions, config.yaml, and projects across restarts and upgrades.

To start it locally:

docker compose up -d

Then browse to http://localhost:8443 and read the generated password from docker compose logs.

For production, put the container behind a TLS-terminating proxy and, if you want a known password, set PASSWORD.

Environment variable reference

Variable	Required	Value / default	Purpose
PASSWORD	no	(generated)	Login password. Leave empty to auto-generate on first run (printed once to the log and stored in config.yaml); set it to pin your own.

The App Platform deploys the catalog tag directly and does not use this compose file; the variable above applies to standalone and self-hosted runs.

Hardening notes

• Non-root runtime. The editor and your shell run as uid 1000, not root.
• No baked credentials. The password is generated at runtime or supplied by you, never stored in an image layer.
• Digest-pinned base. Each build is auditable and reproducible.
• Healthcheck gates traffic. /healthz must return success before the platform routes requests.
• Put it behind auth and TLS. Always run behind the TLS-terminating proxy; the built-in password is the minimum, and the terminal inside code-server has the container’s full access, so treat access as you would shell access.

Backups

The single volume holds everything stateful:

docker run --rm -v code-server_cs-data:/data -v "$PWD":/backup alpine \
  tar czf /backup/code-server-home.tgz -C /data .

Keep your projects in version control (for example a Gitea or GitHub remote) as the primary safety net; the volume backup captures settings, extensions, and anything not yet committed. On the RemarkableCloud App Platform, volume backups follow the platform’s backup schedule.

Upgrades

• New builds ship as new -r tags. Pull the new tag and recreate the container:

  docker compose pull code-server && docker compose up -d code-server

• Settings and extensions persist in the /home/coder volume across the upgrade.
• Read the changelog. Every build is listed in CHANGELOG.md with the upstream version, base image digest, and any behavior changes.