Force URL http://localhost:8080/?folder=/ to target /home/coder/workspace/

[stawen]

Hi everyone,

great job you make with code-server 👍

My goal is to provide my student a complet development environment up and ready quickly 👨🏻‍🎓
So, i use code-server in Docker with this image version : codercom/code-server:4.9.1
I deploy it on Azure Container Instance (ACI)

BUT, I wonder if we could custom URL.

Let me explain :

• In your docker image, code-server used user coder in /home/coder.
• I make a folder workspace so we have /home/coder/workspace. In this folder, student can create folder, file, git project, etc.
• i set WORKDIR /home/coder/workspace so, when you go to http://localhost:8080/code-server redirect to http://localhost:8080/?folder=/home/coder/workspace/
• I wouldn't want that my student should be going in parent folder, like /home/coder or /home, nor even in / on the file system.
• I would like blocked them in the folder /home/coder/workspace/, but they code navigate or open coder-server in folder below (ex: /home/coder/workspace/foo /home/coder/workspace/foo/bar)

My idea, to block navigation on the file system for coder-server, is to specify, In ENV VAR, like WORKDIR, the root folder :

• when you have this URL http://localhost:8080/?folder=/ code-server load this folder /home/coder/workspace/
• when you have this http://localhost:8080/?folder=../../../ you are not allowed to go up in the folder 😅

So :

• does this option already exist? ? 🙋
• if not, a workaround is it possible ? By changing something in coder-server file somewhere ? 🍾
• if it's a good idea, will it be put in your roadmap ? 🦾

Thank you !

[jsjoeio]

Hmm...I'm not a Docker expert but I feel like there should be a way to limit what the user has access to in the container, or maybe mount folders differently to get this functionality?

@code-asher do you have any clever ideas?

[code-asher]

Hmm yeah I imagine you could do this with some kind of jail although I am not sure exactly how.

The only other idea I have is to modify upstream Code but that is probably not something we would want to maintain here.

[code-asher]

Although doing it from within Code would not work well because they could still access external files via the terminal and other workarounds so a jail really would be the only complete solution.

[stawen]

Hi, thank you for you reply. Ok i understand.