Coder

Coder is an open-source platform that lets organizations deploy secure, self-hosted cloud development environments on their own infrastructure — whether public cloud, private data centers, or air-gapped networks. Workspaces are defined as code using Terraform, provisioned on EC2 VMs, Kubernetes Pods, Docker containers, or any custom infrastructure target, and connected to developers through an encrypted WireGuard tunnel managed by Coder’s tailnet system.

Unlike managed CDE services, Coder runs entirely on infrastructure you control. The control plane is a single Go binary that embeds the API server, web dashboard, built-in PostgreSQL (for quick starts), provisioner daemon, and DERP relay. Developers get consistent, reproducible environments in seconds — without VDI overhead, lengthy onboarding scripts, or shared cloud credentials.

Coder’s latest capability is native AI agent execution. The Coder Agents feature runs AI coding agents directly in the control plane on your infrastructure. Models from Anthropic, OpenAI, Google, Bedrock, or self-hosted providers execute with user identity on every action, no LLM credentials leak into workspaces, and centralized cost tracking and audit logging give platform teams full governance over AI-assisted development.

Automatic idle shutdown reduces cloud compute costs significantly — teams report up to 90% savings — while the Coder Registry provides community and official Terraform templates for common stacks, making it easy to publish reusable environment definitions across a whole organization.

What You Get

• Terraform-based workspace templates - Define development environments as infrastructure-as-code using Terraform to provision EC2 VMs, Kubernetes Pods, Docker containers, OpenShift resources, or any custom provider with full version control and reuse across teams.
• Native AI coding agent execution - Run AI coding agents (Anthropic, OpenAI, Google, Bedrock, self-hosted) directly in the Coder control plane on your infrastructure, with user identity on every action, no API keys exposed in workspaces, and centralized model cost tracking and audit logging.
• WireGuard-based secure networking - Every workspace connects through Coder’s tailnet — a WireGuard overlay network with DERP relay fallback — enabling encrypted peer-to-peer access from any client without VPN configuration or open firewall ports.
• Automatic idle workspace shutdown - Workspaces shut down after configurable inactivity periods, cutting cloud compute costs by eliminating always-on environments; teams report reductions of up to 90% compared to traditional VDI.
• VS Code and JetBrains IDE integration - Open any Coder workspace in VS Code via the official extension, or in JetBrains IDEs via Toolbox and Gateway plugins, with full port forwarding, SSH access, and terminal support.
• Dev Container support (envbuilder) - Build development environments from devcontainer.json files on Docker, Kubernetes, and OpenShift without manual image management, using Coder’s open-source envbuilder component.
• Coder Registry for reusable templates - Browse and publish community and official Terraform workspace templates, modules, and integrations via the Coder Registry, making environment definitions shareable across organizations.

Common Use Cases

• Governing AI coding agents at the enterprise scale - A platform team uses Coder Agents to let developers delegate tasks to Claude or GPT-4 running on company infrastructure, with per-user identity, centralized cost dashboards, and full audit trails — no credentials ever touch developer workspaces.
• Replacing VDI for regulated development - A financial services firm migrates from expensive virtual desktop infrastructure to Coder workspaces on AWS, cutting per-seat costs while maintaining air-gap compliance and source code sovereignty.
• Standardizing developer onboarding - A government agency provisions Terraform-defined, compliant development environments for hundreds of engineers, reducing onboarding from days of manual setup to seconds of template instantiation.
• Providing GPU-accelerated ML workspaces - A machine learning team allocates cloud GPU instances to data scientists via Coder workspace templates, spinning up and tearing down CUDA environments on demand without shared credentials or persistent costs.
• Air-gapped and regulated network deployments - A defense contractor deploys Coder on a fully isolated network using private DERP servers, offline Docker registries, and the self-hosted VS Code marketplace — giving developers full IDE tooling with zero external internet dependency.

Under The Hood

Architecture Coder’s architecture is a well-structured control plane monolith with clean internal separation across distinct subsystems. The control plane is a single Go binary that embeds the HTTP API server (using Chi for routing), web dashboard (served as static assets), provisioner daemon (communicating with external Terraform runners over gRPC), tailnet coordinator (managing WireGuard overlay connections), and an optional embedded PostgreSQL instance. Workspace agents run inside each provisioned environment and communicate back through the tailnet, reporting health, serving SSH connections, and relaying port-forwarded traffic. Enterprise features — workspace proxies, AI governance, SCIM, audit streaming — are cleanly separated into an enterprise/ package tree with its own license terms, keeping the AGPL core genuinely free.

Tech Stack The backend is written in Go (1.26+) using Chi for HTTP routing and protobuf/gRPC for internal communication between the control plane and provisioner daemons. PostgreSQL is the primary data store, with SQLC generating fully type-safe query code and paired migration files ensuring forward and backward compatibility. Network connectivity uses Tailscale’s WireGuard implementation (tailnet package) with DERP relay servers for NAT traversal fallback. The frontend is React with TypeScript, organized in a site/ directory using Vite for builds and Jest for testing. Workspace infrastructure definitions use HashiCorp Terraform (HCL), and deployment targets include Docker Compose, Helm charts for Kubernetes, or direct binary installation.

Code Quality The codebase demonstrates comprehensive quality practices across a large Go and TypeScript surface. Test files account for roughly 40% of all Go files, with 471 test files in the coderd package alone covering unit, integration, and end-to-end scenarios with dedicated fake/mock packages (dbfake, dbgen, agenttest). Error handling is explicit and structured throughout the Go codebase; the project uses golangci-lint with a well-configured ruleset and pnpm with Biome for TypeScript linting and formatting. CI pipelines run on every PR and the repo holds an OpenSSF Best Practices badge and OpenSSF Scorecard badge, reflecting mature security-aware development practices.

What Makes It Unique Coder’s most distinctive architectural choices are its WireGuard-native connectivity and its approach to AI agent governance. Rather than relying on SSH tunnels or traditional VPNs, the tailnet package implements a full WireGuard overlay with DERP relay fallback, giving every workspace a cryptographically authenticated network identity and enabling direct peer-to-peer connections that work through NAT and firewalls without exposing ports. The AI agent execution model is architecturally novel: Coder Agents runs the LLM’s control loop in the control plane itself (not in the workspace), so the model acts with the user’s identity on every API call, API keys never touch the workspace filesystem, and every model interaction is logged and attributable — a governance model that managed CDE services do not offer.

Self-Hosting

Coder is dual-licensed. The core platform — control plane, provisioner integration, workspace agents, tailnet, REST API, and web dashboard — is released under the GNU Affero General Public License v3.0 (AGPL-3.0). This means you can use, modify, and distribute the core freely, including for commercial internal use, but any modifications to the server-side code that you make available to users over a network must also be released under the AGPL. For organizations that only deploy Coder internally without distributing a modified server to outside parties, the AGPL is generally unproblematic. The enterprise features in the enterprise/ directory are covered by a separate proprietary license from Coder Technologies Inc. that restricts circumventing license key checks; these features require a paid plan and are activated by license key.

Running Coder yourself means you are responsible for the full operations stack. A production deployment requires a PostgreSQL 13+ instance (the embedded SQLite-like fallback is for local testing only), an externally reachable access URL, and TLS termination — typically via a reverse proxy or a managed load balancer. You also own uptime, backups, database maintenance, and version upgrades; Coder releases several patch versions per month across multiple stable branches, so staying current requires a disciplined upgrade process. Resource requirements scale with workspace count and concurrent AI agent tasks; the control plane binary is lightweight but PostgreSQL and the provisioner daemons add operational surface. Kubernetes deployments via the official Helm chart simplify scaling but introduce Helm and cluster management overhead.

Compared to Coder’s own managed cloud offering or competitors like GitHub Codespaces, self-hosting gives you complete data sovereignty, air-gap capability, custom network topologies, and the ability to integrate with on-premises identity providers, private Terraform registries, and internal GPU clusters. What you give up is managed infrastructure, automatic upgrades, Coder’s SLA-backed uptime, and the enterprise support tier. The Premium plan adds workspace proxies for geo-distributed teams, SCIM provisioning, advanced audit streaming, SSO enforcement, and AI governance features including per-user model cost tracking and centralized audit logging — capabilities that are gated behind license keys even in a self-hosted deployment.