Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Coder Desktop Integration #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ThomasK33 opened this issue Mar 6, 2025 · 10 comments · Fixed by coder/coder#17572
Closed

Coder Desktop Integration #21

ThomasK33 opened this issue Mar 6, 2025 · 10 comments · Fixed by coder/coder#17572
Assignees

Comments

@ThomasK33
Copy link
Member

Implement an enhancement making this extension aware of Coder Desktop. With Coder Desktop running, there is already an established tunnel to a workspace; thus, the extension does not need to create another tunnel.

The extension should prioritize the existing tunnel rather than creating a new one and should be able to display tunnel statistics related to the VPN within the editor.

@matifali
Copy link
Member

Hi @fioan89. Can you start looking into this? I think the initial launch should contain this functionality.

@matifali
Copy link
Member

@ThomasK33 and I can help with how Coder Desktop works here.

@fioan89
Copy link
Collaborator

fioan89 commented Mar 14, 2025

Sure. Right now I was working on integrating uri handling. It's slowly progressing as Toolbox API is not as flexilblle as Gateway's API. Should I put it on hold?

@matifali
Copy link
Member

No that's a higher priorty. This is something we can look into after that.

@fioan89
Copy link
Collaborator

fioan89 commented Mar 14, 2025

OK, so I'll continue with uri handling if my understanding is correct.

@matifali
Copy link
Member

matifali commented Apr 3, 2025

This depends on coder/coder#16828 otherwise it would be too complex to handle different URIs for Coder desktop and existing Coder CLI.

@Kira-Pilot Kira-Pilot assigned sreya and matifali and unassigned sreya and matifali Apr 10, 2025
@matifali
Copy link
Member

We have a reference VS Code implementation at coder/vscode-coder#482

@matifali matifali assigned fioan89 and unassigned matifali Apr 17, 2025
@ethanndickson
Copy link
Member

ethanndickson commented Apr 18, 2025

I'm not too familiar with the Jetbrains plugins, but I'd recommend actually not using the VSCode implementation as a reference, since it looks like you don't use wildcard SSH configs, you can probably just config something like (not exact, haven't tested):

Match host coder-jetbrains-toolbox-foo--test.coder.bar exec "/path/to/coder connect exists agent1.foo.owner.coder"
  HostName agent1.foo.owner.coder
Host coder-jetbrains-toolbox-foo--test.coder.bar
  ProxyCommand /path/to/coder ssh owner/foo.agent1
  ConnectTimeout 0
  StrictHostKeyChecking no
  UserKnownHostsFile /dev/null
  LogLevel ERROR
  SetEnv CODER_SSH_SESSION_TYPE=JetBrains

Where the ProxyCommand is only used if the agent wasn't available at agent1.foo.owner.coder (also keeping in mind that the .coder suffix is configurable deployment-wide)

For that reason, a better reference implementation would be coder/coder#17419

@fioan89
Copy link
Collaborator

fioan89 commented Apr 18, 2025

Thank you for the feedback @ethanndickson. Wildcard config support was added no too long ago.

@matifali
Copy link
Member

since it looks like you don't use wildcard SSH configs

@ethanndickson, we do have wildcard configs on by default with the option to opt out.

@matifali matifali assigned ethanndickson and unassigned fioan89 Apr 29, 2025
ethanndickson added a commit to coder/coder that referenced this issue Apr 30, 2025
…7572)

Closes coder/vscode-coder#447
Closes coder/jetbrains-coder#543
Closes coder/coder-jetbrains-toolbox#21

This PR adds Coder Connect support to `coder ssh --stdio`. 

When connecting to a workspace, if `--force-new-tunnel` is not passed, the CLI will first do a DNS lookup for `<agent>.<workspace>.<owner>.<hostname-suffix>`. If an IP address is returned, and it's within the Coder service prefix, the CLI will not create a new tailnet connection to the workspace, and instead dial the SSH server running on port 22 on the workspace directly over TCP.

This allows IDE extensions to use the Coder Connect tunnel, without requiring any modifications to the extensions themselves. 

Additionally, `using_coder_connect` is added to the `sshNetworkStats` file, which the VS Code extension (and maybe Jetbrains?) will be able to read, and indicate to the user that they are using Coder Connect.

One advantage of this approach is that running `coder ssh --stdio` on an offline workspace with Coder Connect enabled will have the CLI wait for the workspace to build, the agent to connect (and optionally, for the startup scripts to finish), before finally connecting using the Coder Connect tunnel.

As a result, `coder ssh --stdio` has the overhead of looking up the workspace and agent, and checking if they are running. On my device, this meant `coder ssh --stdio <workspace>` was approximately a second slower than just connecting to the workspace directly using `ssh <workspace>.coder` (I would assume anyone serious about their Coder Connect usage would know to just do the latter anyway).
 
To ensure this doesn't come at a significant performance cost, I've also benchmarked this PR.

<details>
<summary>Benchmark</summary>

## Methodology
All tests were completed on `dev.coder.com`, where a Linux workspace running in AWS `us-west1` was created.
The machine running Coder Desktop (the 'client') was a Windows VM running in the same AWS region and VPC as the workspace.

To test the performance of specifically the SSH connection, a port was forwarded between the client and workspace using:
```
ssh -p 22 -L7001:localhost:7001 <host>
```
where `host` was either an alias for an SSH ProxyCommand that called `coder ssh`, or a Coder Connect hostname.

For latency, [`tcping`](https://www.elifulkerson.com/projects/tcping.php) was used against the forwarded port:
```
tcping -n 100 localhost 7001
```

For throughput, [`iperf3`](https://iperf.fr/iperf-download.php) was used:
```
iperf3 -c localhost -p 7001
```
where an `iperf3` server was running on the workspace on port 7001.

## Test Cases

### Testcase 1: `coder ssh` `ProxyCommand` that bicopies from Coder Connect
This case tests the implementation in this PR, such that we can write a config like:
```
Host codercliconnect
    ProxyCommand /path/to/coder ssh --stdio workspace
```
With Coder Connect enabled, `ssh -p 22 -L7001:localhost:7001 codercliconnect` will use the Coder Connect tunnel. The results were as follows:

**Throughput, 10 tests, back to back:**
- Average throughput across all tests: 788.20 Mbits/sec
- Minimum average throughput: 731 Mbits/sec
- Maximum average throughput: 871 Mbits/sec
- Standard Deviation: 38.88 Mbits/sec

**Latency, 100 RTTs:**
- Average: 0.369ms
- Minimum: 0.290ms
- Maximum: 0.473ms

### Testcase 2: `ssh` dialing Coder Connect directly without a `ProxyCommand`

This is what we assume to be the 'best' way to use Coder Connect

**Throughput, 10 tests, back to back:**
- Average throughput across all tests: 789.50 Mbits/sec
- Minimum average throughput: 708 Mbits/sec
- Maximum average throughput: 839 Mbits/sec
- Standard Deviation: 39.98 Mbits/sec

**Latency, 100 RTTs:**
- Average: 0.369ms
- Minimum: 0.267ms
- Maximum: 0.440ms

### Testcase 3:  `coder ssh` `ProxyCommand` that creates its own Tailnet connection in-process

This is what normally happens when you run `coder ssh`:

**Throughput, 10 tests, back to back:**
- Average throughput across all tests: 610.20 Mbits/sec
- Minimum average throughput: 569 Mbits/sec
- Maximum average throughput: 664 Mbits/sec
- Standard Deviation: 27.29 Mbits/sec

**Latency, 100 RTTs:**
- Average: 0.335ms
- Minimum: 0.262ms
- Maximum: 0.452ms

## Analysis

Performing a two-tailed, unpaired t-test against the throughput of testcases 1 and 2, we find a P value of `0.9450`. This suggests the difference between the data sets is not statistically significant. In other words, there is a 94.5% chance that the difference between the data sets is due to chance.

## Conclusion

From the t-test, and by comparison to the status quo (regular `coder ssh`, which uses gvisor, and is noticeably slower), I think it's safe to say any impact on throughput or latency by the `ProxyCommand` performing a bicopy against Coder Connect is negligible. Users are very much unlikely to run into performance issues as a result of using Coder Connect via `coder ssh`, as implemented in this PR.

Less scientifically, I ran these same tests on my home network with my Sydney workspace, and both throughput and latency were consistent across testcases 1 and 2.

</details>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants