Add openvscode-server flavor of the CPU image

Layer Gitpod's openvscode-server on top of ghcr.io/boettiger-lab/k8s:latest
and point jupyter-vscode-proxy at it via CODE_EXECUTABLE, published as the
:openvscode tag. Tests whether openvscode's closer-to-upstream WebSocket
layer works under iOS WebKit, where code-server's patched layer leaves the
terminal, files, and Claude extension dead (shell renders, nothing connects).

Author: cboettig

.github/workflows/docker-openvscode-image.yml

@@ -0,0 +1,44 @@
+name: openvscode Image
+on:
+  workflow_dispatch: null
+  schedule:
+    # Weekly, like the default CPU image, so this flavor tracks :latest.
+    - cron: '0 0 * * 0'
+  push:
+    # Trigger on the files this flavor consumes. It layers on the published
+    # :latest image, so it does NOT depend on the base Dockerfile / install-*.sh
+    # here — only on its own Dockerfile, install script, and this workflow.
+    paths:
+      - 'images/Dockerfile.openvscode'
+      - 'images/install-openvscode.sh'
+      - '.github/workflows/docker-openvscode-image.yml'
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions: write-all
+    steps:
+      - name: cleanup disk space
+        run: |
+          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc
+          df -h
+      - uses: actions/checkout@v3
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to GitHub Container Registry
+        if: github.repository == 'boettiger-lab/k8s'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{github.actor}}
+          password: ${{secrets.GITHUB_TOKEN}}
+      - name: Build and push
+        if: github.repository == 'boettiger-lab/k8s'
+        uses: docker/build-push-action@v6
+        with:
+          context: images/
+          file: images/Dockerfile.openvscode
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ghcr.io/boettiger-lab/k8s:openvscode

images/Dockerfile.openvscode

@@ -0,0 +1,21 @@
+# openvscode-server "flavor" of the default CPU image.
+#
+# Built as a thin layer ON TOP of the already-published default image
+# (images/Dockerfile -> ghcr.io/boettiger-lab/k8s:latest) rather than a full
+# rebuild, and pushed as the :openvscode tag. That keeps it identical to the
+# default image except for the one variable under test: it adds Gitpod's
+# openvscode-server and points jupyter-vscode-proxy at it via CODE_EXECUTABLE,
+# so the "VS Code" launcher tile spawns openvscode-server instead of code-server.
+# Purpose: check whether openvscode's closer-to-upstream WebSocket/reconnection
+# layer survives iOS WebKit, where code-server's patched layer leaves the
+# terminal, files, and Claude extension dead.
+FROM ghcr.io/boettiger-lab/k8s:latest
+
+USER root
+COPY install-openvscode.sh /tmp/install-openvscode.sh
+RUN bash /tmp/install-openvscode.sh && rm /tmp/install-openvscode.sh
+
+# Make jupyter-vscode-proxy launch openvscode-server instead of code-server.
+ENV CODE_EXECUTABLE=openvscode-server
+
+USER ${NB_USER}

images/install-openvscode.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# openvscode-server is Gitpod's build of VS Code's *upstream* web server, offered
+# as an alternative backend to code-server (Coder's fork) for jupyter-vscode-proxy.
+# The proxy chooses the backend from $CODE_EXECUTABLE and launches whichever of
+# `code-server` / `openvscode-server` is named; both accept --port/--socket and
+# --extensions-dir, so the "VS Code" launcher tile is otherwise unchanged.
+#
+# Why we test it: terminal, file explorer, and the Claude extension all hang off
+# code-server's WebSocket + reconnection layer, which is one of the most heavily
+# *patched* parts of Coder's fork. Under iOS/iPadOS WebKit (which every iOS
+# browser is forced to use) that layer fails — the shell renders but nothing
+# interactive connects. openvscode-server stays close to the upstream VS Code-web
+# code Microsoft actually exercises on Safari for vscode.dev, so swapping it in
+# isolates that single variable.
+
+# Pin with OPENVSCODE_VERSION (e.g. 1.109.5); the default resolves the latest
+# release tag so the test image tracks upstream without a hardcoded version.
+VERSION="${OPENVSCODE_VERSION:-latest}"
+if [ "${VERSION}" = "latest" ]; then
+  TAG="$(curl -fsSL https://api.github.com/repos/gitpod-io/openvscode-server/releases/latest \
+          | grep '"tag_name"' | head -1 \
+          | sed -E 's/.*"openvscode-server-v([^"]+)".*/\1/')"
+else
+  TAG="${VERSION}"
+fi
+[ -n "${TAG}" ] || { echo "ERROR: could not resolve openvscode-server version" >&2; exit 1; }
+
+# Map Docker's arch to the release asset suffix. The CI workflow builds
+# linux/amd64,linux/arm64 just like the other images, so both must resolve.
+case "$(uname -m)" in
+  x86_64)  ARCH=x64 ;;
+  aarch64) ARCH=arm64 ;;
+  *) echo "ERROR: unsupported arch $(uname -m)" >&2; exit 1 ;;
+esac
+
+NAME="openvscode-server-v${TAG}-linux-${ARCH}"
+URL="https://github.com/gitpod-io/openvscode-server/releases/download/openvscode-server-v${TAG}/${NAME}.tar.gz"
+echo "Installing ${NAME}"
+
+mkdir -p /opt
+curl -fsSL "${URL}" | tar -xz -C /opt
+mv "/opt/${NAME}" /opt/openvscode-server
+ln -sf /opt/openvscode-server/bin/openvscode-server /usr/local/bin/openvscode-server
+
+# Fail the build loudly if the binary doesn't run on this arch, rather than
+# shipping an image whose "VS Code" tile dies at spawn time.
+openvscode-server --version
+
+# The base CPU image already installed Anthropic.claude-code into the shared
+# extensions dir that jupyter-vscode-proxy passes via --extensions-dir
+# (${CODE_EXTENSIONSDIR}). openvscode-server reads that same dir with the same
+# standard VSIX layout, so the Claude extension is inherited — no reinstall here
+# (avoids a marketplace round-trip in CI). Confirm it's present so a missing
+# extension surfaces at build time, not when a user opens the panel on a tablet.
+EXT_DIR="${CODE_EXTENSIONSDIR:-/opt/share/code-server}"
+ls "${EXT_DIR}" | grep -qi 'anthropic.claude-code' \
+  || { echo "ERROR: Anthropic.claude-code not found in ${EXT_DIR}" >&2; \
+       ls -la "${EXT_DIR}" 2>&1 || true; exit 1; }