vscode-web

code-server, the browser IDE — installed, autostarted, and preloaded with the Claude Code extension.

Installs code-server: VS Code in a browser tab, running on the workstation.

devtools:
  - name: vscode-web

The version field is not used by this recipe.

What it does

  1. Installs the code-server binary — from the official installer on Debian and Ubuntu, from npm on Alpine.
  2. Installs the Claude Code extension for the login user (best-effort; a failure here is logged and does not fail provisioning).
  3. Registers a Ringleader-managed service that starts code-server as the login user on boot.

By default code-server listens on port 8080, bound to loopback. It generates its own random password on first start unless you configure it.

Ringleader branding

The browser IDE is served under Ringleader’s mark: the browser tab icon, the favicon.ico fallback, and the app-install (PWA) icons are all the Ringleader ring, and the web-app manifest names the app Ringleader — so your browser’s install prompt reads “Install Ringleader app” rather than naming the underlying editor build. Nothing else about the editor is changed.

Reaching it from your laptop

code-server binds to the VM’s loopback interface, so it is never exposed on a network. Forward it to your machine with a defaultLocalBinding and open the forwarded port:

ports:
  - 8080
defaultLocalBinding:
  enabled: true
  autoForward:
    forwardAll: true

Then http://127.0.0.1:8080 on your laptop is the IDE.

Configuring it

The devtool installs; the vscode-web toolconfig configures. Use it to set the port, choose password or no authentication, or push editor settings.

Installing the devtool alone still gets you Ringleader’s editor defaults: the Claude Code panel opens in bypass-permissions mode with onboarding hidden.

Example

The zero-prerequisite browser IDE — no Secret to create, no password to manage, reachable only on your laptop’s loopback:

apiVersion: workstations.ringleader.dev/v1
kind: WorkstationConfig
metadata:
  name: ide
  namespace: local
spec:
  selector:
    matchLabels:
      tier: dev
  identity:
    shell: /bin/bash
  packages:
    - git
    - curl
  devtools:
    - name: nodejs
    - name: claude-code
    - name: codex
    - name: vscode-web
  toolconfigs:
    - id: vscode-web
      name: vscode-web
      config:
        port: 8080
        auth: none        # safe: the bind is loopback, fronted by the forward
  ports:
    - 8080
  defaultLocalBinding:
    enabled: true
    autoForward:
      forwardAll: true

To add a password instead, layer a higher-priority config that replaces the vscode-web tool entry:

toolconfigs:
  - id: vscode-web
    name: vscode-web
    config:
      port: 8080
      auth: password
      password: "${secret:vscode-web-password}"

Tool entries merge last-wins by id, so the higher-priority layer’s entry replaces the lower one entirely — re-declare port alongside auth.

Notes

  • If you also run a service on 8080, move code-server: set port: 8081 in the toolconfig. Tool configuration is applied before your provisioning scripts run, so code-server has already vacated 8080 by the time a script tries to bind it.
  • Changing the password restarts code-server, which reads it only at startup.
  • Attaching desktop VS Code over SSH instead? That needs no devtool — see the vscode-server toolconfig.