OpenVSCode Server on Ubuntu 24.04 on Azure User Guide

Overview

OpenVSCode Server (by Gitpod) runs the full Visual Studio Code editor as a service you reach from any browser. You get the same VS Code experience - the editor, the extension marketplace, the integrated terminal and workspace state - hosted on your own cloud VM, so you can develop from a Chromebook, a tablet or a locked-down workstation while the code, tools and compute stay on the server. Because a browser IDE with an integrated terminal is effectively remote code execution on the VM, the cloudimg image is secure by default: OpenVSCode Server 1.109.5 runs as a dedicated unprivileged openvscode account bound to the loopback connector 127.0.0.1:3000, and nginx fronts it over TLS on port 443 with the WebSocket upgrade the editor requires. A unique, high-entropy connection token is generated on the first boot of every VM - there is no default login - and the token gates all access to the editor. Backed by 24/7 cloudimg support.

What is included:

• OpenVSCode Server 1.109.5 (Gitpod's open-source VS Code in the browser) managed by systemd
• The VS Code web IDE fronted by nginx on :443 over TLS, with :80 redirecting to HTTPS and the WebSocket upgrade proxied
• OpenVSCode Server running as the unprivileged openvscode user, bound to 127.0.0.1:3000
• A unique connection token generated on first boot and recorded in a root-only file (no default login)
• A per-VM self-signed TLS certificate generated on first boot, ready to be replaced with your own
• openvscode-server.service + nginx.service as systemd units, enabled and active
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a reasonable starting point; size up for heavier extensions, language servers or multiple concurrent workspaces. NSG inbound: allow 22/tcp from your management network, 443/tcp for the editor and optionally 80/tcp (which only redirects to HTTPS). The raw editor port 3000 stays on loopback and is never exposed. The image ships with a self-signed certificate, so your browser will warn on first connection; see Maintenance to install a real certificate. Because the integrated terminal can run arbitrary code (including outbound network calls), keep inbound access restricted to trusted networks.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for OpenVSCode Server by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTPS (443). Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name openvscode-server \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name openvscode-server --port 443 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active openvscode-server.service nginx.service

Both report active. OpenVSCode Server runs as the dedicated unprivileged openvscode user and listens only on the loopback connector 127.0.0.1:3000; nginx fronts it on port 443 over TLS with the WebSocket upgrade the editor requires. Running the editor as a non-root account means a browser terminal session never has needless privilege on the VM.

Step 5 - Retrieve your connection token

The connection token is generated uniquely on the first boot of your VM and written to a root-only file, along with the URL to open:

sudo cat /root/openvscode-credentials.txt

This file contains OPENVSCODE_CONNECTION_TOKEN and OPENVSCODE_URL. There is no username - the token alone gates access, and anyone with the URL has an interactive shell on the VM as the openvscode user, so treat it like a password and store it somewhere safe.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/healthz

It returns ok. This endpoint never requires the token, so it is safe for an Azure Load Balancer health probe, while every editor request still requires authentication.

Step 7 - Verify the token gates access from the command line

OpenVSCode Server rejects any request with no token or a wrong token (HTTP 403) and accepts the per-VM token with a redirect into the workbench (HTTP 302). Because the command embeds your unique token, run it interactively rather than from a script - substitute the value of OPENVSCODE_CONNECTION_TOKEN from Step 5 for <OPENVSCODE_TOKEN>:

curl -sk -o /dev/null -w 'no token    -> %{http_code}\n' https://127.0.0.1/
curl -sk -o /dev/null -w 'per-VM tok  -> %{http_code}\n' "https://127.0.0.1/?tkn=<OPENVSCODE_TOKEN>"

The first line prints 403 (denied), the second prints 302 (accepted). The -k flag tells curl to accept the image's self-signed certificate.

Step 8 - Open the editor in your browser

Browse to the OPENVSCODE_URL from Step 5 - https://<vm-public-ip>/?tkn=<your-token>. Your browser will warn once about the self-signed certificate; accept it (or install a real certificate first, see Maintenance). OpenVSCode Server validates the token, sets a session cookie and opens a full Visual Studio Code editor running in your browser.

Use the Explorer to open a file in the workspace and start editing. The default workspace folder is /var/lib/openvscode-server/workspace, owned by the openvscode user.

Open the integrated terminal with Terminal -> New Terminal to run commands on the VM without leaving the editor. The terminal runs as the unprivileged openvscode user.

Open the Extensions panel from the activity bar to browse and install extensions from the marketplace - language support, linters, themes and more.

Maintenance

• Connection token: the per-VM token lives in /etc/openvscode-server/connection-token. To rotate it, write a new secret (for example openssl rand -hex 24 | sudo tee /etc/openvscode-server/connection-token) and run sudo systemctl restart openvscode-server, then update OPENVSCODE_URL for your users.
• TLS certificate: the image ships a per-VM self-signed certificate at /etc/nginx/tls/openvscode.crt. For production, replace it with a certificate for your own domain - for example with certbot:

text sudo apt-get install -y certbot python3-certbot-nginx sudo certbot --nginx -d ide.example.com

• Extensions: install from the Extensions panel in the IDE; they persist under the openvscode user's home at /var/lib/openvscode-server.
• Storage: the workspace and editor state live under /var/lib/openvscode-server; back up that directory to protect your files, settings and extensions, and grow the OS disk if you need more room.
• Network egress: the integrated terminal can run arbitrary code that reaches the internet. Restrict outbound rules on the NSG if you need to limit what the editor can contact.
• Tuning: the service is defined in /etc/systemd/system/openvscode-server.service (with sane memory and task limits); after any change run sudo systemctl daemon-reload && sudo systemctl restart openvscode-server.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.