compose.yaml

name: code-server

x-daemonless:
  title: "code-server"
  icon: ":material-microsoft-visual-studio-code:"
  category: "Development"
  description: "VS Code in the browser — run a full development environment on your FreeBSD server and access it from anywhere."
  notes: |
    !!! warning "Work in Progress"
        This image is functional but may change significantly in a future release.

    Common dev tools (gcc, clang, llvm, python, gmake, git, ssh) are baked into the image for now.

    ## Running commands as `root` in Terminal
    `doas` works out of the box -- it is setuid and configured with
    `permit nopass keepenv bsd`:
    ```sh
    doas pkg install rust cargo
    ```
    `sudo` is a shim that execs `doas`, so it works too. `-E` and `-H` are accepted
    and ignored (`doas.conf` already uses `keepenv`); other flags pass through.

    `su` works as well: the image ships `FreeBSD-pam`, without which it fails with
    `su: pam_start: System error`.

    !!! note "Requires Podman 5.8.4 or newer"
        Older Podman dropped the setuid bit while unpacking images on FreeBSD, so
        `doas`, `sudo` and `su` all failed in the container. Fixed by
        [container-libs#935](https://github.com/podman-container-tools/container-libs/pull/935).
        On older Podman, use `mdo` below.

    As an alternative that does not depend on the setuid bit, FreeBSD's MAC framework
    provides the `mdo` command.
    The `mac_do` kernel module has to be loaded on the host which runs Podman before the container is started.  
    You can load the module at runtime by running
    ```sh
    kldload mac_do
    ```
    To load the module automatically during boot you can add it to `rc.conf` with
    ```sh
    sysrc kld_list+=mac_do
    ```

    If the `mac_do` module is loaded when the container starts, it will automatically install a rule that allows the `bsd` user to execute commands as root by running `mdo <command>`.

    To disable the installation of the `mac_do` rule that allows the privilege elevation, you can set the `DISABLE_MDO` environment variable to `true` or `yes`:
    ```yaml
    services:
      code-server:
        environment:
          - DISABLE_MDO=true
    ```    

    ## Installing Packages
    In the terminal:
    ```sh
    doas pkg install rust cargo
    ```
    Or, if the `mac_do` module is loaded on the host:
    ```sh
    mdo pkg install...
    ```

    You can also install packages from the host using `podman exec`:
    ```sh
    # Podman
    doas podman exec -it -u root code-server pkg install rust cargo

    # AppJail
    doas appjail cmd jexec code_server pkg install rust cargo
    ```

    !!! warning "Packages are not persistent"
        If you recreate the container, you will need to reinstall any packages you have added.
  upstream_url: "https://github.com/coder/code-server"
  web_url: "https://coder.com/docs/code-server"
  upstream_binary: true
  user: "bsd"
  mlock: false
  community: ""

  appjail: true

  docs:
    env:
      PUID: "User ID for the application process"
      PGID: "Group ID for the application process"
      TZ: "Timezone for the container"
      PASSWORD: "Password for web UI (leave unset to disable auth)"
      DEFAULT_WORKSPACE: "Default folder opened in the editor (default: /config/workspace)"
      DISABLE_MDO: "Do not use FreeBSD's mac_do facility to allow executing commands as root from the terminal (optional)"
    volumes:
      /config: "Configuration directory"
    ports:
      8080: "Web UI"

services:
  code-server:
    image: ghcr.io/daemonless/code-server:latest
    container_name: code-server
    restart: unless-stopped
    
    

    environment:
      - PUID=1000
      - PGID=1000
      - TZ=UTC

    volumes:
      - /path/to/containers/code-server:/config

    ports:
      - 8080:8080