PASSWORD is unset by code-server

[hutch3232]

Is there an existing issue for this?

• I have searched the existing issues

OS/Web Information

• Web Browser: Chrome
• Local OS: Windows 10
• Remote OS: Ubuntu 20.04
• Remote Architecture: amd64
• code-server --version: v4.10.0

code-server: v4.10.0
Code: 1.75.1
Commit: 441438abd1ac652551dbe4d408dfcec8a499b8bf
Date: 2023-02-13T16:47:00.619Z
Browser: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[125.0.0.0](http://125.0.0.0/) Safari/537.36

Steps to Reproduce

1. Set an environmental variable PASSWORD in the docker environment
2. Launch code server and open terminal
3. echo $PASSWORD <- does not exist

Expected

My PASSWORD env var should still exist in the launched code-server terminal, like all of my other env vars set in an identical manner.

Actual

I have the PASSWORD environmental variable set for an unrelated tool. When I launch code-server, I no longer have that environmental variable set. Would it be possible to not unset it?

I launch code-server like this:

code-server /mnt/code --user-data-dir /mnt/code/.vscode --auth none --bind-addr 0.0.0.0:8888 --extensions-dir ${HOME}/.local/share/code-server/extensions --disable-telemetry

And this is in a dockerized kubernetes container (lingo might be off...).

Logs

No response

Screenshot/Video

No response

Does this bug reproduce in native VS Code?

No, this works as expected in native VS Code

Does this bug reproduce in GitHub Codespaces?

I did not test GitHub Codespaces

Are you accessing code-server over a secure context?

• I am using a secure context.

Notes

I saw this issue: #6698 which isn't really the same but vaguely related.

[code-asher]

Ahhh yeah we should have called ours CODE_SERVER_PASSWORD or something like that to avoid conflicts.

I think it might be risky not to delete it, users might be relying on that behavior now.

Is it possible you could use a different name or put it into the shell profile?

Maybe if auth is set to none we could avoid deleting PASSWORD, but as mentioned I am not sure if that might cause any security-related issues for folks that might be relying on the current behavior.

[hutch3232]

Thank you for taking a look at this. Understand your concern. I can try to work it out on my end. Just thought I'd report it to see if it was something that could be easily changed. Thanks!

[code-asher]

I left this for a bit to see if an idea would come to me. The best I could think of to maintain backwards compatibility was a new environment variable like CODE_SERVER_UNSET_PASSWORD=no which, if set, would prevent unsetting the password.

[hutch3232]

That is a good idea and would be useful for my situation. If you think it could be useful for more users than just myself, I think it would be nice. Thanks!