Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsTo self-host code-server, install it on a Linux VPS under a non-root account, keep its listener on 127.0.0.1:8080, and choose either an SSH tunnel or an authenticated HTTPS reverse proxy for remote access. For a public deployment, point a domain at the VPS, obtain a trusted TLS certificate, and verify WebSocket upgrades end to end. Never publish code-server directly to the internet without authentication and encryption.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What self-hosting code-server on a VPS provides
code-server runs the Visual Studio Code browser interface on your own server. The editor, integrated terminal, extensions, and workspace files live on the VPS, while you connect from a desktop or mobile browser. This is useful when projects need a persistent Linux environment, when several devices must reach the same workspace, or when local hardware is unsuitable for development.
As an Amazon Associate I earn from qualifying purchases.
A VPS deployment is not automatically a secure deployment. The server exposes a terminal and can access every file available to its Unix account. The official secure-access guidance states: “Never expose code-server directly to the internet without some form of authentication and encryption, otherwise someone can take over your machine via the terminal.” Treat that as the design requirement, not an optional hardening step.
Choose the access model before installing
There are two sensible baseline architectures. Keep code-server private and use SSH when one administrator or a small number of trusted users need access. Use a public HTTPS endpoint when browser access without an SSH client, external identity controls, or team distribution is required.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
| Design | Network exposure | Identity and TLS | Operational effort | Best fit |
|---|---|---|---|---|
| SSH port forwarding | Only SSH is public; code-server remains on loopback | SSH keys plus code-server authentication; encryption is provided by SSH | Low | One user or administrators who can use an SSH client |
| Caddy reverse proxy | HTTPS and SSH are public; code-server stays private | Password authentication plus automated Let’s Encrypt certificate | Low to moderate | A convenient browser URL with automatic certificate renewal |
| NGINX reverse proxy | HTTPS and SSH are public; code-server stays private | Password authentication plus a separately managed certificate | Moderate | Existing NGINX estates or teams needing detailed proxy policy |
| External identity proxy | HTTPS is public; an identity layer sits in front of code-server | SSO or access policy from Pomerium, oauth2-proxy, or Cloudflare Access, with code-server authentication retained unless the trust boundary is deliberately redesigned | Moderate to high | Teams requiring centralized identity and policy |
| Self-signed certificate | HTTPS is public or private, depending on the network | Clients must be configured to trust the certificate | Higher | Testing or controlled networks where public certificate issuance is unsuitable |
If you are unsure, start with SSH forwarding. You can add a reverse proxy later without changing the code-server workspace or installation.
VPS requirements and sizing
The official requirements guidance recommends at least 1 GB of RAM and two CPU cores for a code-server machine and requires WebSocket support. Those figures are vendor recommendations, not an independently benchmarked performance guarantee. Actual capacity depends on the language servers, extensions, repositories, builds, and number of simultaneous sessions you run.
| Requirement | What to verify | Why it matters |
|---|---|---|
| Operating system | A supported Linux distribution, such as Debian or Ubuntu; the documentation also lists Fedora, CentOS, RHEL, SUSE, Arch, Docker, and Helm installation paths | Determines the package method and service integration |
| Memory | At least 1 GB recommended by the vendor | The editor, extensions, language servers, and builds share RAM |
| CPU | At least 2 cores recommended by the vendor | Improves responsiveness during indexing, compilation, and extension work |
| Network | Stable connectivity and a firewall you control | Browser editing depends on persistent connections and WebSockets |
| Storage | Enough for the operating system, repositories, dependencies, extensions, logs, and backups | Full disks can stop builds, updates, and the service itself |
| DNS and TLS for public access | A domain record pointing to the VPS and a certificate provider such as Let’s Encrypt | Browsers require a trusted HTTPS endpoint for a safe public deployment |
Do not treat the minimum as a concurrency promise. Monitor memory, CPU, disk usage, and process logs after your first real workload; increase the VPS size when those measurements show sustained pressure rather than choosing a larger plan speculatively.
Prepare the VPS securely
Create a regular administrative account
Use a dedicated, non-root Unix user for code-server. Give that account only the administrative privileges it needs through your distribution’s normal sudo mechanism. Do not run the editor as root: a compromised extension or terminal session would then have unrestricted control of the operating system.
Install SSH keys and restrict the firewall
Configure key-based SSH access before closing the provider’s initial console session. Permit SSH only on the port you actually use, and permit HTTPS only when you have selected a public reverse-proxy design. Do not open port 8080 to the world; code-server should listen on loopback.
- Allow SSH from the administration networks that need it.
- Allow TCP 443 for a public HTTPS proxy. Allow TCP 80 only when your certificate workflow requires an HTTP challenge or redirect.
- Keep the code-server port private; a local listener does not need a firewall rule.
- Apply operating-system security updates before installing additional services.
Set the hostname and DNS plan
For public access, choose a hostname such as ide.example.com and create an A or AAAA record pointing to the VPS address. Wait for the record to resolve before requesting a certificate. A certificate covers the hostname, not an arbitrary IP address, so browsing directly to the IP will produce a name mismatch.
Free tools Windows power users keep installed
One-click scans. No signup required.
Install code-server
The project documents several supported installation paths. Select one method and record the installed version in your change log; the reviewed official pages did not provide a stable current version number suitable for a universal command or recommendation.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Option 1: preview and run the official installer
The official Linux installer can be previewed with --dry-run before execution. Previewing lets you inspect the actions and package choice for your distribution.
- Download or invoke the installer in dry-run mode and review the commands it proposes.
- Run the installer after confirming that it targets the intended non-root account and distribution.
- Check that the executable is available to the account that will own the service.
- Record the version printed by the installed binary.
Because the installer is distribution-aware, it is usually the shortest route on a standard Linux VPS. Keep the script invocation in your deployment notes so that a future rebuild is repeatable.
Option 2: distribution packages
Debian and Ubuntu packages integrate with the documented per-user systemd service. After installation, enable and start the service with:
systemctl enable --now code-server@$USERThe documentation also lists packages for Fedora, CentOS, RHEL, and SUSE, along with an Arch/AUR route. Package names and repository setup differ by distribution, so use the commands documented for the exact operating system rather than mixing package instructions between distributions.
Option 3: release archive, Docker, or Helm
Standalone release archives are available when you want to control the binary location yourself. Docker and Helm are documented alternatives when code-server belongs inside an existing container or Kubernetes operating model. These approaches add image, volume, ingress, and upgrade responsibilities; they do not remove the need for authentication, TLS, or WebSocket support.
Inspect the initial configuration
After installation, confirm the generated configuration at ~/.config/code-server/config.yaml for the service-owning user. The default configuration binds to 127.0.0.1:8080, enables password authentication, and leaves TLS disabled. That default is appropriate for local testing behind an SSH tunnel or reverse proxy.
Verify the listener before exposing anything:
ss -ltnp | grep 8080The address should be loopback, such as 127.0.0.1:8080 or the IPv6 loopback equivalent, not 0.0.0.0:8080. If it is bound publicly, stop the service, correct the configuration, and restart it before continuing.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Remote access with SSH port forwarding
SSH forwarding is the smallest attack surface because no code-server port is reachable from the internet. With the service listening on the VPS loopback address, run this command on your local computer:
ssh -N -L 8080:127.0.0.1:8080 user@your-vps-hostname- Replace
userand the host name with your SSH account and VPS address. - Keep that SSH process running;
-Ncreates forwarding without opening a remote shell. - Open
http://127.0.0.1:8080in your local browser. - Enter the password configured in
config.yaml.
The browser connection is local, while SSH carries the traffic over its encrypted session. If the page does not load, check that the systemd service is active, that the local port is unused, and that the SSH account can reach the VPS. A tunnel disconnect also disconnects the browser; use a managed SSH client or a supervised session when you need automatic reconnection.
Publish code-server through Caddy and Let’s Encrypt
Caddy is a practical public-facing option because it can obtain and renew a trusted Let’s Encrypt certificate when DNS points at the VPS and ports 80/443 are reachable as required by the certificate workflow.
- Install Caddy using the package method supported by your Linux distribution.
- Create a site definition for the public hostname and proxy it to the private listener.
- Reload Caddy and inspect its logs for certificate issuance and upstream connectivity.
- Open the HTTPS hostname and complete the code-server login.
ide.example.com {
reverse_proxy 127.0.0.1:8080
}The reverse proxy must pass WebSocket traffic. Caddy’s standard reverse proxy handles WebSocket upgrades, but you should still test a workspace load, terminal, extension installation, and a reconnect rather than assuming the proxy is correct. Keep code-server bound to loopback; Caddy, not code-server, should be the internet-facing process.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Publish code-server through NGINX
NGINX works when it is already part of your server stack or when you need explicit control over headers and access rules. A minimal server block needs HTTPS termination, a proxy to 127.0.0.1:8080, HTTP/1.1, and the WebSocket upgrade headers.
server {
listen 443 ssl;
server_name ide.example.com;
ssl_certificate /path/to/fullchain.pem;
ssl_certificate_key /path/to/privkey.pem;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}The proxy_set_header Host $host line makes the address shown inside code-server reflect the public hostname. Use your certificate provider’s actual certificate paths, validate the NGINX configuration, reload it, and then test the browser session over HTTPS. A plain page load is not enough: a missing upgrade header often appears only when the terminal or live editor connection starts.
Authentication, certificates, and trust boundaries
Keep code-server authentication enabled
The default password authentication is an important second layer even when an identity-aware proxy is present. Disable it only when you have deliberately documented the complete trust boundary, verified that the proxy always enforces identity, and ensured that no alternate route reaches code-server.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Use a trusted certificate for public URLs
Let’s Encrypt integration provides browser-trusted certificates without manually distributing trust material. A self-signed certificate can work for testing or a controlled private network, but every client must trust it and certificate replacement becomes an operational task. Never train users to bypass browser certificate warnings on an internet-facing editor.
Add an external identity layer when needed
Pomerium, oauth2-proxy, and Cloudflare Access can place SSO, multifactor authentication, or policy checks before code-server. These systems introduce their own sessions, callback URLs, headers, and failure modes. Preserve code-server’s password protection unless you have tested every route and intentionally chosen a single, well-documented authentication boundary.
Validate the deployment end to end
Run these checks from a normal client, not only from the VPS shell:
- The public hostname resolves to the intended VPS address.
- The browser shows a valid certificate for that hostname and automatically redirects to HTTPS if your policy requires it.
- The code-server login page appears and rejects an incorrect password.
- A workspace opens, files can be edited, and changes persist after a browser refresh.
- The integrated terminal opens and executes a harmless command.
- An extension can be searched for and installed when your policy permits extensions.
- Closing and reopening the browser reconnects to the workspace.
- Restarting the code-server service does not lose the configuration or project files.
- Direct access to
http://vps-address:8080fails from the internet. - SSH forwarding still works if it is your emergency administrative path.
Test cookies and reconnects through the final HTTPS hostname. A proxy that serves static editor assets can still be broken for WebSockets, authentication callbacks, or long-lived terminal sessions.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Operate and maintain the VPS
Manage the service with systemd
Use the per-user service rather than launching code-server manually from an SSH shell. Check status and logs with the systemd tools appropriate to your distribution, and restart the service after intentional configuration changes. Record the installed version whenever you upgrade so that a rollback decision has a known reference.
Back up the right data
Back up project repositories, deployment files, SSH and proxy configuration, and the code-server configuration directory. A VPS snapshot alone may not satisfy your recovery objective if it is taken while a database or build artifact is changing. Test restoring a representative project and the configuration to a separate environment.
Monitor capacity and logs
Watch memory, CPU, disk consumption, certificate renewal logs, reverse-proxy errors, and systemd journal entries. Language servers and extensions can consume substantially more resources than the editor shell. Investigate sustained swap use, repeated process restarts, full disks, and WebSocket disconnects before they become an outage.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Apply updates predictably
Keep the operating system, code-server package or archive, reverse proxy, and certificate tooling current. Use a maintenance window or staged VPS when the workspace is business-critical. After each update, repeat login, workspace, terminal, extension, reconnect, and restart tests.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Troubleshooting by symptom
The browser cannot connect
- For SSH access, confirm the tunnel command is still running and that local port 8080 is not occupied.
- For HTTPS access, verify DNS, firewall rules, certificate status, and the proxy’s upstream address.
- On the VPS, confirm the service is active and listening on loopback rather than an unexpected address.
The page loads but the terminal or editor hangs
This usually indicates a WebSocket or proxy-header problem. Confirm that the proxy uses HTTP/1.1, forwards Upgrade and Connection, and preserves the host header. Inspect browser developer-console errors and reverse-proxy logs while opening a terminal and reconnecting.
The certificate warning persists
Make sure the browser hostname exactly matches the certificate name, DNS points to the current VPS, and the proxy is serving the renewed certificate rather than an old file. Self-signed certificates require explicit trust on every client; replacing them without updating that trust produces a new warning.
The service starts manually but not after reboot
Check that the per-user systemd unit was enabled for the correct account, that its home directory and configuration path are available at boot, and that the service logs contain no permission or port conflict. Re-run the documented systemctl enable --now code-server@$USER command while logged in as the intended service owner.
The VPS runs out of memory or disk
Identify the extension, language server, build, or process consuming resources; remove unused extensions and artifacts, clean package caches where appropriate, and expand the VPS when the workload genuinely exceeds the recommended baseline. Do not solve persistent memory pressure by exposing additional ports or running the service as root.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Recommended deployment sequence
- Create a non-root account, install SSH keys, and apply operating-system updates.
- Set firewall rules for SSH and, if required, HTTPS; leave port 8080 private.
- Install code-server with the distribution-appropriate official method and record its version.
- Inspect
~/.config/code-server/config.yamland confirm loopback binding, password authentication, and disabled built-in TLS. - Start and enable the per-user systemd service.
- Choose SSH forwarding for private administration or configure Caddy/NGINX for a public HTTPS hostname.
- Point DNS to the VPS, issue a trusted certificate, and verify WebSocket support.
- Test login, workspace editing, terminal access, extensions, reconnects, and restart persistence.
- Back up configuration and projects, monitor resource use, and schedule repeatable updates.
This sequence keeps the highest-risk decision—the internet-facing boundary—until the private service has been verified. It also leaves SSH forwarding available as a recovery path if the reverse proxy or certificate configuration fails.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
