vscode-web | Ringleader Docs

Configures code-server, the browser IDE. Install it with the vscode-web devtool.

toolconfigs:
  - id: vscode-web
    name: vscode-web
    config:
      port: 8081
      auth: none

`config` fields

Field	Type	Default	Description
`port`	`int`	`8080`	The port code-server listens on.
`auth`	`string`	`password`	`password` or `none`.
`password`	`string`	—	The password. Write it as a `${secret:NAME}` reference.
`bindAddr`	`string`	`127.0.0.1`	A bare IP literal or `localhost`. No port — that is `port`.
`cert`	`bool` or `string`	—	`true` for a self-signed certificate, or a path to one.
`settings`	`object`	—	Editor settings, written to code-server’s user `settings.json`.

Two files are written, both owned by the login user: the server configuration (~/.config/code-server/config.yaml, mode 0600 — it holds the password) and the editor settings (~/.local/share/code-server/User/settings.json, mode 0644).

The server file is written only if you ask

If you declare any server field — port, auth, password, bindAddr, or cert — Ringleader writes config.yaml. If you declare only settings, or no toolconfig at all, code-server keeps its own self-generated config.yaml with its own random password, and only the editor settings are written.

That distinction matters: a defaults-only config.yaml would say auth: password with no password, locking you out.

Declaring `port` alone locks you out

Once you declare any server field, the others take their defaults — and the default for auth is password. A config that says only port: 8081 writes auth: password with no password. Whenever you set port, also set either auth: none (on a loopback bind) or a password.

Editor defaults

The editor settings file is always written, whether or not you declare settings. Ringleader merges in these Claude Code panel defaults for any key you did not set yourself:

{
  "claudeCode.allowDangerouslySkipPermissions": true,
  "claudeCode.initialPermissionMode": "bypassPermissions",
  "claudeCode.hideOnboarding": true
}

The panel ignores the CLI’s managed settings, so these editor keys are the only lever for it. initialPermissionMode selects bypass on open; allowDangerouslySkipPermissions is what makes that mode selectable at all. A workstation is the sandbox the warning refers to.

When the workstation declares any trusted folders, the workspace-trust prompt is disabled as well, again per-key: any value you set yourself wins.

Every other key you write is passed through untouched.

The `auth: none` rule

An unauthenticated browser IDE has a terminal in it. Ringleader therefore refuses auth: none on any non-loopback bind address, and the workstation fails to finish setting up rather than writing that file. auth: none on 127.0.0.1 is fine: the port is only reachable through the forward Ringleader sets up to your laptop.

config:
  bindAddr: 0.0.0.0
  auth: none          # rejected

Example

Move the IDE off 8080 (a Compose stack owns it), skip the password because the bind is loopback, and pin the Claude Code panel’s behaviour explicitly:

apiVersion: workstations.ringleader.dev/v1
kind: WorkstationConfig
metadata:
  name: ide
  namespace: local
spec:
  selector:
    matchLabels:
      tier: dev
  devtools:
    - name: nodejs
    - name: claude-code
    - name: vscode-web
  toolconfigs:
    - id: vscode-web
      name: vscode-web
      config:
        port: 8081
        auth: none
        settings:
          claudeCode.allowDangerouslySkipPermissions: true
          claudeCode.initialPermissionMode: bypassPermissions
          claudeCode.hideOnboarding: true
          workbench.colorTheme: Default Dark Modern
  ports:
    - 8080          # your app
    - 8081          # the IDE
  defaultLocalBinding:
    enabled: true
    autoForward:
      forwardAll: true

Tool configuration is applied before provisioning scripts run, so code-server has already moved to 8081 by the time a script publishes an app on 8080.

With a password

toolconfigs:
  - id: vscode-web
    name: vscode-web
    config:
      port: 8080
      auth: password
      password: "${secret:vscode-web-password}"

Create the Secret first:

rl secret create vscode-web-password -n local \
  --from-string vscode-web-password=<choose-a-password>

Notes

code-server reads its password only at startup. When Ringleader writes a new one, it restarts the service for you.
The port you declare is checked on every configuration pass, not just the first. If the IDE is not actually serving it — because it started before the configuration landed, or crashed, or was restarted by hand — Ringleader restarts the service so it comes back on the declared port. A workstation already serving the right port is left alone, so this costs no restarts once it is healthy.
Because tool entries merge last-wins by id, a config layer that changes auth must re-declare port too — the whole entry is replaced, not merged.