🩺 Vitals
- 🟢 Last active: 2026-07-24
- 📦 Latest release: v2.34.6 (2026-07-14)
- 🐞 Open issues: 932
- 🌟 Stars: 13.9k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: coder.com
- Source: github.com/coder/coder
- License: AGPL 3.0
- Deployment: Kubernetes | Docker
- Data Model: PostgreSQL
- Jurisdiction: United States 🇺🇸 (Coder Technologies, Inc., VC-backed)
- Compliance (SaaS): SOC 2 Type II
- Compliance (Self-Hosted): HIPAA Eligible | GDPR Ready | FedRAMP Ready
- Complexity: High (4/5) - Kubernetes, PostgreSQL & Terraform templates
- Maintenance: High (4/5) - Helm upgrades, DB migrations, template upkeep
- Enterprise Ready: High (5/5) - SSO, advanced RBAC, audit logs, multi-org
1. The Executive Summary
What is it? Coder is a self-hosted platform for provisioning cloud development environments (CDEs) — full remote workspaces defined as code with HashiCorp Terraform and scheduled onto infrastructure you own, from Kubernetes clusters to bare metal to fully air-gapped networks. Developers get a consistent, instantly reproducible environment in the browser or their local IDE; the platform team gets centralized control over compute, credentials, and access. Its newer differentiator is acting as the governed runtime for AI coding agents (the same OSS agents on this hub — Cline, opencode, Goose — run inside Coder workspaces with audit logging and cost controls), so a security team can give engineers AI tooling without source code or prompts leaving the perimeter.
The Strategic Verdict:
- 🔴 For small teams without a platform function: Caution. Coder assumes you can run Kubernetes and PostgreSQL and author Terraform. A five-person shop will spend more on operating it than it saves over local development or a lighter CDE.
- 🟢 For regulated, air-gapped, or AI-governance-driven enterprises: Strong Buy. When source code cannot touch a vendor cloud — defense, finance, healthcare, public sector — Coder centralizes dev environments and AI agents behind your own RBAC and audit trail, with no phone-home and no per-seat licence on the core.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | GitHub Codespaces (SaaS) | Coder (Self-Hosted) |
|---|---|---|
| Compute & Seats | Metered per-hour compute plus per-GB storage, billed monthly per developer | Runs on infrastructure you already own; the AGPL core carries no per-seat licence |
| Data Residency | Hosted in the GitHub / Microsoft cloud (US jurisdiction) | Your own VPC, on-premises, or fully air-gapped network |
| Enterprise Controls | Bundled into GitHub Enterprise pricing | Free core (SSO, templates); advanced RBAC, multi-org, audit logs, and AI governance gated behind Coder Premium |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: Helm chart onto Kubernetes (the recommended path) or a single-node Docker install for evaluation; provision an external PostgreSQL database and author workspace templates in Terraform. The control plane validates its licence offline via signed JWTs, so air-gapped installs never need outbound connectivity.
- Scalability: Horizontal. Workspaces are scheduled across Kubernetes nodes and scale with the cluster; the control plane scales with PostgreSQL. Resource quotas can be set per organization for chargeback.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & the CLOUD Act: Coder Technologies, Inc. is a US corporation and therefore within reach of the CLOUD Act. Because the product is 100% self-hosted, supports fully air-gapped operation, and never phones home, that exposure is structurally neutralized — there is no vendor-held data for a foreign subpoena to reach.
- The Compliance Shift: Coder ships the technical controls — database encryption, RBAC, comprehensive audit logging — but achieving HIPAA, GDPR, or FedRAMP authorization is entirely on you. The burden of securing the underlying Kubernetes clusters, PostgreSQL, and host infrastructure moves to your platform and security teams, not the vendor.
- The AGPL Trap & Enterprise Tax: The core is AGPL-3.0. Consuming it as-is through Terraform templates is safe, but if a platform team modifies the Coder orchestrator itself and exposes it over a network, the AGPL network-copyleft clause obliges them to publish those modifications. Separately, the controls most enterprises need — advanced RBAC, multi-organization isolation, and the AI Governance add-on — sit behind the proprietary Coder Premium licence.
4. Market Landscape
🏢 Proprietary Incumbents
- GitHub Codespaces: Microsoft-hosted CDEs billed per-hour. Frictionless inside the GitHub ecosystem, but source code and compute live in the US cloud with no air-gapped option.
- Gitpod: Pioneered the browser-based CDE and has since pivoted toward an enterprise, self-hosted commercial model — sovereignty comes at a per-seat licence rather than an open core.
🤝 Open Source Ecosystem
- Eclipse Che: Kubernetes-native CDE under the vendor-neutral Eclipse Foundation. More browser-IDE-centric and less Terraform-driven than Coder, with weaker enterprise governance tooling.
- DevPod: Apache-2.0 client-side tool that spins up devcontainer-spec workspaces without a central control plane — lighter to adopt, but it lacks the org-wide RBAC, audit, and quota layer that defines Coder.