coder/code-server · error · Error

--password can only be set in the config file or passed in v

Error message

--password can only be set in the config file or passed in via $PASSWORD

What it means

code-server refuses the `--password` CLI flag because process arguments are visible to other users via `ps`/`/proc` and leak into shell history. The guard at cli.ts:407 only permits the password when opts.configFile is set (i.e. the value came from the config file), so a bare command-line password is rejected. Use the config file or the $PASSWORD environment variable instead.

Source

Thrown at src/node/cli.ts:407

      let value: string | undefined
      if (arg.startsWith("--")) {
        const split = splitOnFirstEquals(arg.replace(/^--/, ""))
        key = split[0] as keyof UserProvidedArgs
        value = split[1]
      } else {
        const short = arg.replace(/^-/, "")
        const pair = Object.entries(options).find(([, v]) => v.short === short)
        if (pair) {
          key = pair[0] as keyof UserProvidedArgs
        }
      }

      if (!key || !options[key]) {
        throw error(`Unknown option ${arg}`)
      }

      if (key === "password" && !opts?.configFile) {
        throw new Error("--password can only be set in the config file or passed in via $PASSWORD")
      }

      if (key === "hashed-password" && !opts?.configFile) {
        throw new Error("--hashed-password can only be set in the config file or passed in via $HASHED_PASSWORD")
      }

      if (key === "github-auth" && !opts?.configFile) {
        throw new Error("--github-auth can only be set in the config file or passed in via $GITHUB_TOKEN")
      }

      if (key === "idle-timeout-seconds" && Number(value) <= 60) {
        throw new Error("--idle-timeout-seconds must be greater than 60 seconds.")
      }

      const option = options[key]
      if (option.type === "boolean") {
        ;(args[key] as boolean) = true
        continue

View on GitHub (pinned to 51f90a376b)

Solutions

1. Move the password into the config file (~/.config/code-server/config.yaml) under `password:`
2. Export it as an environment variable: `export PASSWORD=secret` then run `code-server`
3. For Docker/k8s, set the PASSWORD env var on the container instead of a CLI arg

Example fix

# before
code-server --password=secret

# after
export PASSWORD=secret
code-server
# or in ~/.config/code-server/config.yaml:
# password: secret

// Before spawning code-server, ensure no secret CLI flags are present
const SECRET_FLAGS = ["--password", "--hashed-password", "--github-auth"]
const leaked = process.argv.filter((a) =>
  SECRET_FLAGS.some((f) => a === f || a.startsWith(f + "="))
)
if (leaked.length) {
  throw new Error(
    `Refusing to run: ${leaked.join(", ")} on the CLI. Use $PASSWORD / config file.`
  )
}

When it happens

Trigger: Invoking `code-server --password=secret`, `code-server --password secret`, or any form that places the password key in argv while parsing the command line (not the config file).

Common situations: Quick local testing where a developer passes the password inline; copy-pasting from outdated tutorials that predate the security restriction; Docker entrypoints that pass `--password` in the CMD.

Related errors

• --hashed-password can only be set in the config file or pass
• --github-auth can only be set in the config file or passed i
• --cert-key is missing
• --idle-timeout-seconds must be greater than 60 seconds.
• No opened code-server instances found to handle ${paths[0]}

AI-assisted analysis of coder/code-server@51f90a376b (2026-08-12). Data as JSON: /api/errors/c3d85e95b66607e9. Report an issue: GitHub.