111 lines
4.6 KiB
Markdown
111 lines
4.6 KiB
Markdown
# Coder — workspace manager (pilot)
|
||
|
||
Self-hosted control plane at <http://framework:7080> that creates
|
||
per-project dev containers from Terraform templates. Each workspace:
|
||
its own container, browser code-server with the Claude Code extension
|
||
pre-installed, no host-port bookkeeping (everything tunnels through the
|
||
dashboard), and idle autostop so parked projects give their RAM back to
|
||
the inference stacks.
|
||
|
||
**Pilot status.** Evaluating against the standalone code-server stack
|
||
(`/srv/docker/code-server`, kept as-is meanwhile). Verdict after a week
|
||
of real use: does the dashboard + autostop + create-from-template earn
|
||
an always-on control plane + Postgres? If yes, the standalone stack
|
||
retires; if no, Coder goes and a thin `workspace` spawner script
|
||
replaces it.
|
||
|
||
## Bring-up
|
||
|
||
```sh
|
||
cd /srv/docker/coder && docker compose up -d
|
||
```
|
||
|
||
The sibling `.env` (DOCKER_GROUP_ID, CODER_ACCESS_URL, random Postgres
|
||
password) is generated by deploy.py on first `./run.sh` — no hand-fill
|
||
needed. First visit to <http://framework:7080> creates the admin
|
||
account (pick anything; it's local to the box).
|
||
|
||
> **HTTPS is required for extension panels.** VS Code webviews (the
|
||
> Claude Code panel, markdown preview, etc.) run on service workers,
|
||
> which browsers only allow in a secure context — over plain
|
||
> `http://framework:7080` the editor works but webview panels render
|
||
> blank. Fix via Tailscale Serve (real Let's Encrypt cert for the
|
||
> tailnet name; enable "HTTPS Certificates" once in the Tailscale
|
||
> admin console):
|
||
>
|
||
> ```sh
|
||
> sudo tailscale serve --bg 7080
|
||
> # then in .env: CODER_ACCESS_URL=https://framework.<tailnet>.ts.net
|
||
> docker compose up -d # recreate server with new access URL
|
||
> # restart any existing workspace — app URLs derive from the access URL
|
||
> ```
|
||
>
|
||
> Localhost is also a secure context, so
|
||
> `ssh -L 7080:localhost:7080 framework` + http://localhost:7080 works
|
||
> in a pinch.
|
||
|
||
## Push the template (one-time + after edits)
|
||
|
||
The `coder` CLI ships inside the server image; authenticate it once:
|
||
|
||
```sh
|
||
docker compose exec coder coder login http://localhost:7080
|
||
# prints a /cli-auth URL — open http://framework:7080/cli-auth in your
|
||
# browser, copy the session token, paste it back
|
||
```
|
||
|
||
Then push:
|
||
|
||
```sh
|
||
docker compose exec coder coder templates push code-server \
|
||
--directory /templates/code-server --yes
|
||
```
|
||
|
||
Template source of truth is the repo
|
||
(`pyinfra/framework/compose/coder/templates/code-server/main.tf`) —
|
||
edit there, `./run.sh`, re-push. Edits on the box get overwritten.
|
||
|
||
## First workspace
|
||
|
||
Dashboard → Workspaces → Create → `code-server` template → name it
|
||
after the project. Open the code-server app tile, then one-time
|
||
Claude sign-in: the extension shows an OAuth URL → open in another tab
|
||
→ approve → paste the code back. Credentials live in `~/.claude` on
|
||
the workspace's home volume and survive stop/start and rebuilds.
|
||
|
||
Set **idle autostop** under Template → Settings → Schedule (suggest
|
||
1–2 h inactivity). Activity = open code-server tab, SSH, web terminal.
|
||
|
||
## What persists where
|
||
|
||
| Thing | Where |
|
||
| -------------------------------- | -------------------------------------------- |
|
||
| Workspace home (repos, ~/.claude, extensions) | named volume `coder-<workspace-id>-home` |
|
||
| Control-plane state (users, templates, workspace defs) | Postgres → `/srv/docker/coder/postgres` |
|
||
| Template source | this repo, shipped to `/srv/docker/coder/templates` |
|
||
|
||
A stopped workspace's container is deleted; only the home volume
|
||
remains. `docker volume ls | grep coder-` to audit.
|
||
|
||
## Security
|
||
|
||
Same posture as OpenHands: the server container holds the docker
|
||
socket and spawns code-running containers — root-equivalent on the
|
||
box. Tailscale-only exposure is the mitigation; never forward :7080
|
||
anywhere else. Coder does have real auth (the admin account), but
|
||
treat that as defense-in-depth, not as permission to expose it.
|
||
|
||
## Notes
|
||
|
||
- Workspaces reach the sibling services via `host.docker.internal`
|
||
(Ollama :11434, LiteLLM :4000, Phoenix :6006, ...).
|
||
- Long Claude runs: same rules as anywhere — the process lives in the
|
||
workspace container, so it survives laptop/browser disconnects, but
|
||
**autostop will kill an idle-looking workspace mid-run**. For
|
||
multi-hour unattended tasks either bump the workspace's TTL in the
|
||
dashboard or use the host-side tmux + `claude remote-control`
|
||
pattern (framework README, "Claude Code on the box").
|
||
- The base image is `codercom/enterprise-base:ubuntu` (sudo-enabled,
|
||
common toolchain). Per-project images are a later refinement —
|
||
swap the `image` in main.tf or parameterize with `coder_parameter`.
|