Coder

Self-hosted cloud development environments. Full support; install via the template.

Coder provisions development workspaces on your own infrastructure. The extension host runs in the workspace, so scanning is fully supported.

Install via the template

Coder workspaces are Terraform, so the extension belongs in the template rather than in each developer’s setup:

module "vscode-web" {
  source         = "registry.coder.com/modules/vscode-web/coder"
  agent_id       = coder_agent.main.id
  extensions     = ["vulnetix.vulnetix"]
  accept_license = true
}

resource "coder_script" "vulnetix_cli" {
  agent_id     = coder_agent.main.id
  display_name = "Install Vulnetix CLI"
  run_on_start = true
  script       = <<-EOT
    curl -fsSL https://cli.vulnetix.com/install.sh | sh
  EOT
}

Baking the CLI into the workspace image is better still, because a startup script runs per workspace while an image layer is built once.

Extension source

Coder deployments pull from Open VSX by default. Air-gapped installations often run a private registry instead; Vulnetix installs from either, and the .vsix on GitHub releases can be uploaded to a private registry directly.

Air-gapped deployments

If workspaces have no route to the internet, two things need attention.

The CLI binary. Mirror the release assets internally and point the extension at your mirror. It must serve the same layout, including checksums.txt, because verification is not optional:

{ "vulnetix.cli.downloadBaseUrl": "https://artifacts.internal/vulnetix" }

Or install the binary in the image and set vulnetix.cli.path.

Vulnerability data. Matching dependencies to advisories needs the vulnerability database. Without a route to api.vdb.vulnetix.com, code, secret, container and infrastructure scanning still work fully, because those are local rule evaluation, but dependency findings will be unavailable. Talk to us about an on-premises option.

Credentials

Set a service-account credential as a workspace environment variable in the template rather than having each developer sign in:

resource "coder_agent" "main" {
  env = {
    VULNETIX_API_TOKEN = data.coder_parameter.vulnetix_token.value
  }
}