How code-server is put together
code-server runs VS Code as a service on a remote machine and exposes the editor through the browser. It is a Node.js/TypeScript application that wraps and patches upstream VS Code, adding an Express-based HTTP/S server (with WebSocket upgrade handling for the editor's socket protocol), authentication, a reverse proxy for user apps/ports, and a parent/child process wrapper that supports graceful relaunch and hot-swapping. Incoming HTTP requests are routed through Express middleware into route handlers (login, logout, health, proxy, update, and the VS Code bridge), while websocket upgrades are dispatched via a custom wsRouter; the VS Code server itself is loaded as an ESM module out of the bundled lib/vscode. Distribution is handled through shell-based CI build scripts, Docker release images, and a Helm chart.
Languages
Frameworks
Infrastructure
Major components
HTTP/WS server (src/node/app.ts, wsRouter.ts)
Creates the Express app and HTTP/HTTPS server (via httpolyglot), handles socket/fd/port binding and dispatches WebSocket upgrades.
Route handlers (src/node/routes/)
Registers and serves the login, logout, health, update, domain/path proxy, and VS Code editor routes.
CLI & argument handling (src/node/cli.ts, main.ts, entry.ts)
Parses user-provided arguments/config, defaults them, and drives startup, the Code CLI, and open-in-existing-instance behavior.
Process wrapper (src/node/wrapper.ts)
Parent/child process management with handshake, IPC, log rotation, and SIGUSR relaunch/hot-swap support.
Reverse proxy (src/node/proxy.ts, routes/domainProxy.ts, routes/pathProxy.ts)
Proxies HTTP/WebSocket traffic to user applications by subdomain or path prefix.
VS Code integration & patches (src/node/routes/vscode.ts, patches/)
Loads the bundled VS Code server module and applies a large set of diffs to adapt upstream VS Code for browser/remote use.
Internationalization (src/node/i18n/)
Loads locale strings and supports custom string overrides via i18next.
Build & release tooling (ci/, install.sh, Helm chart)
Shell-based build, packaging, Docker image, and Kubernetes/Helm deployment automation.
Packaged and released version 4.134.0 for deployment.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
Packaged and released version 4.134.0 for deployment.
Week of 2026-08-17
A busy week updating to Code 1.134.0, adding new startup options, and refreshing dependencies and tooling.
Week of 2026-08-10
Released version 4.132.0 and tidied up documentation.
Week of 2026-08-03
Updated to Code 1.132.0 while hardening security and cleaning up code.
Week of 2026-07-27
Released version 4.131.0, updated to Code 1.131.0, and improved docs and automation.
Over the last few weeks code-server tracked upstream VS Code closely, shipping regular version bumps up to 1.134.0 alongside matching Helm chart and changelog releases. Notable new capabilities included systemd socket activation support and a way to pass options through to VS Code, while security and dependency hygiene received steady attention. The cadence reflects a mature project focused on keeping current, tightening auth, and routine maintenance.
Week by week
2026-08-24Packaged and released version 4.134.0 for deployment.latest2 changes
Chore
Release 4.134.0
Updated the Helm chart and changelog to publish version 4.134.0 for users deploying code-server.
Docs
Fixed a changelog typo
Corrected wording in the release notes for clarity.
2026-08-17A busy week updating to Code 1.134.0, adding new startup options, and refreshing dependencies and tooling.6 changes
Feature
Update to Code 1.134.0
Brought code-server in line with the latest upstream VS Code release.
Feature
New --socket-fd option
Added the ability to listen on a passed-in file descriptor, enabling systemd socket activation.
Feature
Pass options through to VS Code
Added --vscode-option and a VSCODE_OPTIONS variable so users can forward flags directly to the underlying editor.
Chore
Move to Node.js v24
Updated project files and the runtime to reflect the newer Node.js version.
Chore
Remove --unsafe-perm flag
Dropped an obsolete install-script flag that modern npm no longer supports.
Chore
Refresh dependencies and CI actions
Bumped several libraries and GitHub Actions to newer versions for security and maintenance.
2026-08-10Released version 4.132.0 and tidied up documentation.2 changes
Chore
Release 4.132.0
Updated the Helm chart and changelog to publish version 4.132.0.
Docs
Fixed a Helm doc typo
Removed a duplicated word in the persistence example of the Helm documentation.
2026-08-03Updated to Code 1.132.0 while hardening security and cleaning up code.5 changes
Feature
Update to Code 1.132.0
Synced code-server with the latest upstream VS Code release.
Fix
Require authentication for the mint key endpoint
Closed a gap by requiring auth on an endpoint that was previously accessible.
Fix
Fix cookie encoding when proxying
Stopped cookies from being incorrectly encoded when passed to the proxy.
Chore
Update Node types and dependencies
Refreshed Node type definitions to v24 and bumped several supporting libraries.
Refactor
Small code cleanups
Switched an unchanged variable to a constant for clearer code.
2026-07-27Released version 4.131.0, updated to Code 1.131.0, and improved docs and automation.4 changes
Feature
Update to Code 1.131.0
Brought code-server up to the latest upstream VS Code release.
Chore
Release 4.131.0
Updated the Helm chart and changelog to publish version 4.131.0.
Docs
Document opening a file at a line
Explained how to open a file at a specific line using the payload query parameter.
Chore
Add cooldown to dependency automation
Tuned the dependabot config to space out automated dependency updates.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 482 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required