VS Code

Visual Studio Code is an open source code editor for Windows, macOS and Linux. It stays an editor at heart: files, folders and text editing are the core, while language support, debuggers and build tooling come as extensions. That fits how we work, with Windows workstations and remote Linux hosts and containers side by side.

The interface has six main areas: editor, side bars, status bar, activity bar and panel, which holds output, errors and the integrated terminal. Settings live in settings.json at user or workspace level.

Extensions and where they run

Extensions come from the Visual Studio Marketplace, installed from the Extensions view, each identified by its publisher and extension ID. They run in the extension host, which has the same permissions as VS Code itself: it can read and write files, make network requests, run external processes and modify workspace settings. Install only extensions from a publisher you trust.

Since release 1.97 the first third-party install asks for publisher trust, and the trusted publisher list is editable from a command. At organization level the extensions.allowed setting controls which extensions may be installed. In a remote window the extensionKind property decides whether an extension runs locally or on the workspace side.

Workspace trust

Code from an unknown source is not executed on its own. Answering no to the Workspace Trust prompt puts the folder in Restricted Mode, which disables or limits AI agents, the terminal, tasks, debugging, workspace settings and extensions. Trust is per folder, can be inherited from a parent, and attaching to a container counts as trusted. Restricted Mode cannot stop a malicious extension that ignores it, so when in doubt leave the folder restricted.

Tasks and debugging

Tasks are defined in tasks.json in the .vscode folder, and work only with a workspace folder open, not for a single file. VS Code auto-detects tasks for npm, Gulp, Grunt and Jake, and a problem matcher moves compiler output into the problems panel.

• Tasks run in a non-login, non-interactive shell, so a command that only reaches the path through shell startup scripts is not found.
• Simple cases run and debug the active file; complex ones need a launch.json.
• JavaScript, TypeScript and Node.js debugging is built in, other languages need a debugger extension.

Remote development over SSH, WSL and containers

With remote development no source code needs to be local. The Remote Development extension pack has four extensions: SSH, Dev Containers, WSL and Remote - Tunnels. They install VS Code Server on the remote operating system, independent of any existing installation there.

• Our remote Linux hosts work this way: the editor runs locally, files and processes on the server.
• Container development connects to our Docker stacks.
• Settings Sync does not carry extensions to or from a remote window, so the remote side needs its own installs.

Sync and what to watch

Settings Sync is turned on from the Accounts menu with a Microsoft or GitHub account, and covers settings, keyboard shortcuts, snippets, tasks, UI state, extensions and profiles. On a second machine you merge or replace the local and cloud state.

• Telemetry is controlled by one setting that separates crash reports, error telemetry and usage data; extension telemetry is documented by each extension.
• A folder with many files can make VS Code slow to respond while it searches for project files, and files.exclude removes them from that search.
• We also use the Cursor editor and keep most settings in common.

Further reading

• Workspace Trust
• Remote Development
• Extension runtime security

At CyberElectro VS Code is the primary editor on our Windows workstations, and the way we reach remote Linux hosts and containers.