[coder]

Adds registry/coder/templates/kubernetes-airgapped, a Kubernetes starter template that makes no outbound internet calls during template push, workspace build, or workspace startup.

The existing Kubernetes template looks like a good fit for air-gapped POCs, but it pulls from Docker Hub, registry.coder.com, and code-server.dev on the first build. Each of those then has to be found and worked around during a customer POC.

What's different from coder/kubernetes

	coder/kubernetes	coder/kubernetes-airgapped
Providers	Unpinned	Pinned (coder ~> 2.0, kubernetes ~> 3.0) so they can be mirrored
Modules	code-server from registry.coder.com (installs code-server at runtime)	None
Image	Defaults to codercom/example-base:ubuntu (Docker Hub)	Required variable, no default; optional image_pull_secret
IDE	Downloaded at startup	coder_script starts the code-server already baked into the image (--disable-telemetry --disable-update-check); can be turned off
Extensions	open-vsx.org	Optional extensions_gallery for an internal mirror
Agent	From the access URL	From the access URL (unchanged)

The README covers:

• Mirroring providers with terraform providers mirror plus a .terraformrc
• A Dockerfile that bakes code-server into the base image
• The Coder server settings needed for air-gapped installs (linked to the docs)
• A NetworkPolicy that blocks all egress except DNS and Coder, so you can prove the workspace works offline
• Client-side caveats for VS Code Desktop and JetBrains
• Adding modules without registry.coder.com: vendoring them into the template as local modules, mirroring the registry through a Terraform registry (e.g. Artifactory), or hosting a copy of coder/registry on an internal Git server

Testing

• terraform init && terraform validate pass (coder 2.x, kubernetes 3.x)
• bun run fmt made no changes; go run ./cmd/readmevalidation passes
• Built the README's example Dockerfile and ran the template's code-server startup script with docker run --network none. code-server started and /healthz responded.
• Module examples: a vendored ./modules/code-server and a git:: source pinned to release/coder/code-server/v1.6.0 both pass terraform init && terraform validate
• Not yet tested: an end-to-end workspace build on a cluster with egress blocked. That's worth doing before merge.

Follow-up

Air-gapped deployments can't reach registry.coder.com, so the in-product starter templates (embedded from coder/coder/examples/templates) are what these customers actually see. Embedding a copy there would be a separate PR in coder/coder.

---

Generated with Superblink (Coder's Slack assistant) using Claude, at the request of @stirby.

[bpmct]

Let's move to coder-labs! Solid template. is this you @stirby

[matifali]

Template looks great except it is missing the parameter and the script to clone an internal git repo. It also hardcodes the path for code-server to /home/coder instead of a project inside that.