Self hosted codespaces

[OneCyrus]

Couldn't find this as an official feedback here. so posting this here too.

Codespaces is an awesome tool as was the predecessor "Visual Studio Online". One of the key features in Visual Studio Online was the self hosting part. It enabled us to develop in an enterprise environment where we needed to access data and services inside the company perimeter. Unfortunately this feature was dropped when VSO was transformed to Codespaces.
There are many devs in the same situation and it would be great to have this feature back.

see also:
https://github.community/t/self-hosted-codespaces/194278
https://github.community/t/self-hosted-codespaces/131361

[tanmayeekamath]

Thanks for your feedback! We have don't have a timeline for self hosted codespaces just yet, but we're thinking about this scenario.
Just curious, if the current product supported accessing on-prem company data and resources securely from your codespace, would that address your need or are there other requirements around support for self hosted codespaces that you would like to share?

[numbsafari]

One consideration is the potential need for a BAA with GitHub, or similar kinds of compliance issues.

Running our dev tooling inside our corporate perimeter would mean it is running on the trusted platform we already work with, or enabling it to run within our own datacenter.

I think it would be helpful to view CodeSpaces no differently than Actions from this standpoint. Certainly, that's how I think about it and I'm pretty sure how our auditors will be thinking about it.

[BitPatty]

Running our dev tooling inside our corporate perimeter would mean it is running on the trusted platform we already work with, or enabling it to run within our own datacenter.

+1, in most projects we are legally obliged to store as well as process all data within a corporate perimeter or geographical boundaries. Thus connecting from GHC to coporate networks and/or services/APIs is not an option. We can sell the stakeholders the idea of paying for on-prem Codespaces but not for an unsupervised remote solution.

[metaskills]

@BitPatty Agreed, but would like to make a counter point. Does that mean you have no remote engineers or do you consider their hardware and/or perhaps a VPN connection from said hardware to be more secure? And if so why? I'm struggling with this as well and am interested in other's thoughts. For example: I can somewhat make a point that containerized dev environment hosted in the cloud would be more secure, no email client, patched more often, etc?

[numbsafari]

In my case, based on how we isolate our production resources and user accounts, what would help eliminate the direct need for self-hosted instances would be if Codespaces supported OIDC similar to how GH Actions does. With this, we could use Workload Identity Federation in order to bind user identity from GH to our cloud provider without having to separately expose or manage long-lived credentials outside of our perimeter.

[BitPatty]

@metaskills

Do you consider their hardware and/or perhaps a VPN connection from said hardware to be more secure?

Yes, since the data only travels within the respective security zone. And even if it were possible, the implications of allowing Codespaces to establish a VPN connection into a corporate environment heavily outweigh its advantages.

---

There are a bunch of other security concerns that haven't been brought up yet regarding the use of Codespaces, but I feel like listing them here wouldn't necessarily help advance the discussion.

While anyone can use dev containers (and a lot of our projects do), on-prem Codespaces would be yet another an upgrade to allow our developers to efficiently switch between projects without having to set up anything at all on their local. If anything, I'd claim that it would help us improve security since we wouldn't have to exchange application secrets with yet another tool - especially in the age of clipboard grabbers and whatnot.

The point is, we don't need Codespaces - and alternative solutions covering this scenario do exist. At the same time, I've been using this very tool we're talking about a lot, and I assume most developers would enjoy having a uniform dev environment across all projects no matter where they are, what they do and what the project is for (isn't that the whole point?). I therefore think corporate environments / on prem solutions would be something Github should at least consider branching out to.

[numbsafari]

Another consideration to address with self-hosted codespaces is the cost/overhead of network egress for accessing development resources from within the codespace environment.

With the way docker images are these days, it's going to add up.

[froblesmartin]

This was requested again at #27426