From 60674638cdb2525ee779283b25b709ea753b888b Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Thu, 10 Apr 2025 16:42:16 +0000
Subject: [PATCH 1/5] feat: add all disable options

Add all the '--disable-*' CLI flags as options.
---
 src/code-server/README.md                     |  7 ++
 src/code-server/devcontainer-feature.json     | 35 ++++++++++
 src/code-server/install.sh                    | 33 ++++++++-
 .../code-server-disable-file-downloads.sh     | 15 ++++
 .../code-server-disable-file-uploads.sh       | 15 ++++
 ...server-disable-getting-started-override.sh | 15 ++++
 .../code-server-disable-multiple-options.sh   | 22 ++++++
 test/code-server/code-server-disable-proxy.sh | 15 ++++
 .../code-server-disable-telemetry.sh          | 15 ++++
 .../code-server-disable-update-check.sh       | 15 ++++
 .../code-server-disable-workspace-trust.sh    | 15 ++++
 test/code-server/scenarios.json               | 70 +++++++++++++++++++
 12 files changed, 271 insertions(+), 1 deletion(-)
 create mode 100644 test/code-server/code-server-disable-file-downloads.sh
 create mode 100644 test/code-server/code-server-disable-file-uploads.sh
 create mode 100644 test/code-server/code-server-disable-getting-started-override.sh
 create mode 100644 test/code-server/code-server-disable-multiple-options.sh
 create mode 100644 test/code-server/code-server-disable-proxy.sh
 create mode 100644 test/code-server/code-server-disable-telemetry.sh
 create mode 100644 test/code-server/code-server-disable-update-check.sh
 create mode 100644 test/code-server/code-server-disable-workspace-trust.sh

diff --git a/src/code-server/README.md b/src/code-server/README.md
index 46b06ea..efc45e0 100644
--- a/src/code-server/README.md
+++ b/src/code-server/README.md
@@ -16,6 +16,13 @@ VS Code in the browser
 | Options Id | Description | Type | Default Value |
 |-----|-----|-----|-----|
 | auth | The type of authentication to use. When 'password' is selected, code-server will auto-generate a password. 'none' disables authentication entirely. | string | password |
+| disableFileDownloads | Disable file downloads from Code. When enabled, users will not be able to download files from the editor. | boolean | false |
+| disableFileUploads | Disable file uploads to Code. When enabled, users will not be able to upload files to the editor. | boolean | false |
+| disableGettingStartedOverride | Disable the coder/coder override in the Help: Getting Started page. | boolean | false |
+| disableProxy | Disable domain and path proxy routes. | boolean | false |
+| disableTelemetry | Disable telemetry reporting. | boolean | false |
+| disableUpdateCheck | Disable update check. Without this flag, code-server checks every 6 hours against the latest github release and notifies once a week when updates are available. | boolean | false |
+| disableWorkspaceTrust | Disable Workspace Trust feature. This only affects the current session. | boolean | false |
 | extensions | Comma-separated list of VS Code extensions to install. Format: 'publisher.extension[@version]' (e.g., 'ms-python.python,ms-azuretools.vscode-docker'). | string | - |
 | host | The address to bind to for the code-server. Use '0.0.0.0' to listen on all interfaces. | string | 127.0.0.1 |
 | port | The port to bind to for the code-server. | string | 8080 |
diff --git a/src/code-server/devcontainer-feature.json b/src/code-server/devcontainer-feature.json
index aa1f1d7..12e44ac 100644
--- a/src/code-server/devcontainer-feature.json
+++ b/src/code-server/devcontainer-feature.json
@@ -10,6 +10,41 @@
             "default": "password",
             "description": "The type of authentication to use. When 'password' is selected, code-server will auto-generate a password. 'none' disables authentication entirely."
         },
+        "disableFileDownloads": {
+            "type": "boolean",
+            "default": false,
+            "description": "Disable file downloads from Code. When enabled, users will not be able to download files from the editor."
+        },
+        "disableFileUploads": {
+            "type": "boolean",
+            "default": false,
+            "description": "Disable file uploads to Code. When enabled, users will not be able to upload files to the editor."
+        },
+        "disableGettingStartedOverride": {
+            "type": "boolean",
+            "default": false,
+            "description": "Disable the coder/coder override in the Help: Getting Started page."
+        },
+        "disableProxy": {
+            "type": "boolean",
+            "default": false,
+            "description": "Disable domain and path proxy routes."
+        },
+        "disableTelemetry": {
+            "type": "boolean",
+            "default": false,
+            "description": "Disable telemetry reporting."
+        },
+        "disableUpdateCheck": {
+            "type": "boolean",
+            "default": false,
+            "description": "Disable update check. Without this flag, code-server checks every 6 hours against the latest github release and notifies once a week when updates are available."
+        },
+        "disableWorkspaceTrust": {
+            "type": "boolean",
+            "default": false,
+            "description": "Disable Workspace Trust feature. This only affects the current session."
+        },
         "extensions": {
             "type": "string",
             "default": "",
diff --git a/src/code-server/install.sh b/src/code-server/install.sh
index 2224b9c..3ac7b89 100644
--- a/src/code-server/install.sh
+++ b/src/code-server/install.sh
@@ -23,12 +23,43 @@ if [[ -n $WORKSPACE ]]; then
     CODE_SERVER_WORKSPACE="$WORKSPACE"
 fi
 
+# Build disable flags based on boolean options
+DISABLE_FLAGS=""
+
+if [[ "$DISABLEFILEDOWNLOADS" == "true" ]]; then
+    DISABLE_FLAGS="$DISABLE_FLAGS --disable-file-downloads"
+fi
+
+if [[ "$DISABLEFILEUPLOADS" == "true" ]]; then
+    DISABLE_FLAGS="$DISABLE_FLAGS --disable-file-uploads"
+fi
+
+if [[ "$DISABLEGETTINGSTARTEDOVERRIDE" == "true" ]]; then
+    DISABLE_FLAGS="$DISABLE_FLAGS --disable-getting-started-override"
+fi
+
+if [[ "$DISABLEPROXY" == "true" ]]; then
+    DISABLE_FLAGS="$DISABLE_FLAGS --disable-proxy"
+fi
+
+if [[ "$DISABLETELEMETRY" == "true" ]]; then
+    DISABLE_FLAGS="$DISABLE_FLAGS --disable-telemetry"
+fi
+
+if [[ "$DISABLEUPDATECHECK" == "true" ]]; then
+    DISABLE_FLAGS="$DISABLE_FLAGS --disable-update-check"
+fi
+
+if [[ "$DISABLEWORKSPACETRUST" == "true" ]]; then
+    DISABLE_FLAGS="$DISABLE_FLAGS --disable-workspace-trust"
+fi
+
 cat > /usr/local/bin/code-server-entrypoint \
 << EOF
 #!/usr/bin/env bash
 set -e
 
-su $_REMOTE_USER -c 'code-server --auth "$AUTH" --bind-addr "$HOST:$PORT" "$CODE_SERVER_WORKSPACE"'
+su $_REMOTE_USER -c 'code-server --auth "$AUTH" --bind-addr "$HOST:$PORT" $DISABLE_FLAGS "$CODE_SERVER_WORKSPACE"'
 EOF
 
 chmod +x /usr/local/bin/code-server-entrypoint
diff --git a/test/code-server/code-server-disable-file-downloads.sh b/test/code-server/code-server-disable-file-downloads.sh
new file mode 100644
index 0000000..9efca53
--- /dev/null
+++ b/test/code-server/code-server-disable-file-downloads.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+set -e
+
+# Optional: Import test library bundled with the devcontainer CLI
+source dev-container-features-test-lib
+
+# Feature-specific tests
+check "code-server version" code-server --version
+check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
+check "code-server listening" lsof -i "@127.0.0.1:8080"
+
+check "code-server disable-file-downloads" grep $'\'code-server.* --disable-file-downloads .*' < /usr/local/bin/code-server-entrypoint
+
+# Report results
+reportResults
diff --git a/test/code-server/code-server-disable-file-uploads.sh b/test/code-server/code-server-disable-file-uploads.sh
new file mode 100644
index 0000000..0cfb081
--- /dev/null
+++ b/test/code-server/code-server-disable-file-uploads.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+set -e
+
+# Optional: Import test library bundled with the devcontainer CLI
+source dev-container-features-test-lib
+
+# Feature-specific tests
+check "code-server version" code-server --version
+check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
+check "code-server listening" lsof -i "@127.0.0.1:8080"
+
+check "code-server disable-file-uploads" grep $'\'code-server.* --disable-file-uploads .*' < /usr/local/bin/code-server-entrypoint
+
+# Report results
+reportResults
diff --git a/test/code-server/code-server-disable-getting-started-override.sh b/test/code-server/code-server-disable-getting-started-override.sh
new file mode 100644
index 0000000..9ce59cb
--- /dev/null
+++ b/test/code-server/code-server-disable-getting-started-override.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+set -e
+
+# Optional: Import test library bundled with the devcontainer CLI
+source dev-container-features-test-lib
+
+# Feature-specific tests
+check "code-server version" code-server --version
+check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
+check "code-server listening" lsof -i "@127.0.0.1:8080"
+
+check "code-server disable-getting-started-override" grep $'\'code-server.* --disable-getting-started-override .*' < /usr/local/bin/code-server-entrypoint
+
+# Report results
+reportResults
diff --git a/test/code-server/code-server-disable-multiple-options.sh b/test/code-server/code-server-disable-multiple-options.sh
new file mode 100644
index 0000000..671e2e9
--- /dev/null
+++ b/test/code-server/code-server-disable-multiple-options.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+set -e
+
+# Optional: Import test library bundled with the devcontainer CLI
+source dev-container-features-test-lib
+
+# Feature-specific tests
+check "code-server version" code-server --version
+check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
+check "code-server listening" lsof -i "@127.0.0.1:8080"
+
+# Check for all three flags we enabled in this scenario
+check "code-server disable-file-downloads" grep $'\'code-server.* --disable-file-downloads .*' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-file-uploads" grep $'\'code-server.* --disable-file-uploads .*' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-getting-started-override" grep $'\'code-server.* --disable-getting-started-override .*' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-proxy" grep $'\'code-server.* --disable-proxy .*' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-telemetry" grep $'\'code-server.* --disable-telemetry .*' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-update-check" grep $'\'code-server.* --disable-update-check .*' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-workspace-trust" grep $'\'code-server.* --disable-workspace-trust .*' < /usr/local/bin/code-server-entrypoint
+
+# Report results
+reportResults
diff --git a/test/code-server/code-server-disable-proxy.sh b/test/code-server/code-server-disable-proxy.sh
new file mode 100644
index 0000000..16da45c
--- /dev/null
+++ b/test/code-server/code-server-disable-proxy.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+set -e
+
+# Optional: Import test library bundled with the devcontainer CLI
+source dev-container-features-test-lib
+
+# Feature-specific tests
+check "code-server version" code-server --version
+check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
+check "code-server listening" lsof -i "@127.0.0.1:8080"
+
+check "code-server disable-proxy" grep $'\'code-server.* --disable-proxy .*' < /usr/local/bin/code-server-entrypoint
+
+# Report results
+reportResults
diff --git a/test/code-server/code-server-disable-telemetry.sh b/test/code-server/code-server-disable-telemetry.sh
new file mode 100644
index 0000000..9cd9257
--- /dev/null
+++ b/test/code-server/code-server-disable-telemetry.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+set -e
+
+# Optional: Import test library bundled with the devcontainer CLI
+source dev-container-features-test-lib
+
+# Feature-specific tests
+check "code-server version" code-server --version
+check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
+check "code-server listening" lsof -i "@127.0.0.1:8080"
+
+check "code-server disable-telemetry" grep $'\'code-server.* --disable-telemetry .*' < /usr/local/bin/code-server-entrypoint
+
+# Report results
+reportResults
diff --git a/test/code-server/code-server-disable-update-check.sh b/test/code-server/code-server-disable-update-check.sh
new file mode 100644
index 0000000..8022f1a
--- /dev/null
+++ b/test/code-server/code-server-disable-update-check.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+set -e
+
+# Optional: Import test library bundled with the devcontainer CLI
+source dev-container-features-test-lib
+
+# Feature-specific tests
+check "code-server version" code-server --version
+check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
+check "code-server listening" lsof -i "@127.0.0.1:8080"
+
+check "code-server disable-update-check" grep $'\'code-server.* --disable-update-check .*' < /usr/local/bin/code-server-entrypoint
+
+# Report results
+reportResults
diff --git a/test/code-server/code-server-disable-workspace-trust.sh b/test/code-server/code-server-disable-workspace-trust.sh
new file mode 100644
index 0000000..b97943e
--- /dev/null
+++ b/test/code-server/code-server-disable-workspace-trust.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+set -e
+
+# Optional: Import test library bundled with the devcontainer CLI
+source dev-container-features-test-lib
+
+# Feature-specific tests
+check "code-server version" code-server --version
+check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
+check "code-server listening" lsof -i "@127.0.0.1:8080"
+
+check "code-server disable-workspace-trust" grep $'\'code-server.* --disable-workspace-trust .*' < /usr/local/bin/code-server-entrypoint
+
+# Report results
+reportResults
diff --git a/test/code-server/scenarios.json b/test/code-server/scenarios.json
index 26fb59b..493b770 100644
--- a/test/code-server/scenarios.json
+++ b/test/code-server/scenarios.json
@@ -54,5 +54,75 @@
                 "auth": "password"
             }
         }
+    },
+    "code-server-disable-file-downloads": {
+        "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
+        "features": {
+            "code-server": {
+                "disableFileDownloads": true
+            }
+        }
+    },
+    "code-server-disable-file-uploads": {
+        "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
+        "features": {
+            "code-server": {
+                "disableFileUploads": true
+            }
+        }
+    },
+    "code-server-disable-getting-started-override": {
+        "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
+        "features": {
+            "code-server": {
+                "disableGettingStartedOverride": true
+            }
+        }
+    },
+    "code-server-disable-proxy": {
+        "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
+        "features": {
+            "code-server": {
+                "disableProxy": true
+            }
+        }
+    },
+    "code-server-disable-telemetry": {
+        "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
+        "features": {
+            "code-server": {
+                "disableTelemetry": true
+            }
+        }
+    },
+    "code-server-disable-update-check": {
+        "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
+        "features": {
+            "code-server": {
+                "disableUpdateCheck": true
+            }
+        }
+    },
+    "code-server-disable-workspace-trust": {
+        "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
+        "features": {
+            "code-server": {
+                "disableWorkspaceTrust": true
+            }
+        }
+    },
+    "code-server-disable-multiple-options": {
+        "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
+        "features": {
+            "code-server": {
+                "disableFileDownloads": true,
+                "disableFileUploads": true,
+                "disableGettingStartedOverride": true,
+                "disableProxy": true,
+                "disableTelemetry": true,
+                "disableUpdateCheck": true,
+                "disableWorkspaceTrust": true
+            }
+        }
     }
 }

From 267eeebb5c5a8a2d7f87e8f7843548098688a9dd Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Mon, 14 Apr 2025 08:22:01 +0000
Subject: [PATCH 2/5] chore: remove ai fluff comment

---
 src/code-server/install.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/code-server/install.sh b/src/code-server/install.sh
index 3ac7b89..ba21b66 100644
--- a/src/code-server/install.sh
+++ b/src/code-server/install.sh
@@ -23,7 +23,6 @@ if [[ -n $WORKSPACE ]]; then
     CODE_SERVER_WORKSPACE="$WORKSPACE"
 fi
 
-# Build disable flags based on boolean options
 DISABLE_FLAGS=""
 
 if [[ "$DISABLEFILEDOWNLOADS" == "true" ]]; then

From f33c545ac5936ece4354a5365feafb69a21feb12 Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Mon, 14 Apr 2025 09:22:11 +0000
Subject: [PATCH 3/5] chore: capitalize GitHub

---
 src/code-server/README.md                 | 2 +-
 src/code-server/devcontainer-feature.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/code-server/README.md b/src/code-server/README.md
index efc45e0..28cc698 100644
--- a/src/code-server/README.md
+++ b/src/code-server/README.md
@@ -21,7 +21,7 @@ VS Code in the browser
 | disableGettingStartedOverride | Disable the coder/coder override in the Help: Getting Started page. | boolean | false |
 | disableProxy | Disable domain and path proxy routes. | boolean | false |
 | disableTelemetry | Disable telemetry reporting. | boolean | false |
-| disableUpdateCheck | Disable update check. Without this flag, code-server checks every 6 hours against the latest github release and notifies once a week when updates are available. | boolean | false |
+| disableUpdateCheck | Disable update check. Without this flag, code-server checks every 6 hours against the latest GitHub release and notifies once a week when updates are available. | boolean | false |
 | disableWorkspaceTrust | Disable Workspace Trust feature. This only affects the current session. | boolean | false |
 | extensions | Comma-separated list of VS Code extensions to install. Format: 'publisher.extension[@version]' (e.g., 'ms-python.python,ms-azuretools.vscode-docker'). | string | - |
 | host | The address to bind to for the code-server. Use '0.0.0.0' to listen on all interfaces. | string | 127.0.0.1 |
diff --git a/src/code-server/devcontainer-feature.json b/src/code-server/devcontainer-feature.json
index 12e44ac..509bcc4 100644
--- a/src/code-server/devcontainer-feature.json
+++ b/src/code-server/devcontainer-feature.json
@@ -38,7 +38,7 @@
         "disableUpdateCheck": {
             "type": "boolean",
             "default": false,
-            "description": "Disable update check. Without this flag, code-server checks every 6 hours against the latest github release and notifies once a week when updates are available."
+            "description": "Disable update check. Without this flag, code-server checks every 6 hours against the latest GitHub release and notifies once a week when updates are available."
         },
         "disableWorkspaceTrust": {
             "type": "boolean",

From 0eda689d093ef9a046d2169b8001104e37a86a01 Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Mon, 14 Apr 2025 11:28:12 +0000
Subject: [PATCH 4/5] chore: use array instead of string

---
 src/code-server/install.sh | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/code-server/install.sh b/src/code-server/install.sh
index ba21b66..c6d3835 100644
--- a/src/code-server/install.sh
+++ b/src/code-server/install.sh
@@ -23,34 +23,34 @@ if [[ -n $WORKSPACE ]]; then
     CODE_SERVER_WORKSPACE="$WORKSPACE"
 fi
 
-DISABLE_FLAGS=""
+DISABLE_FLAGS=()
 
 if [[ "$DISABLEFILEDOWNLOADS" == "true" ]]; then
-    DISABLE_FLAGS="$DISABLE_FLAGS --disable-file-downloads"
+    DISABLE_FLAGS+=(--disable-file-downloads)
 fi
 
 if [[ "$DISABLEFILEUPLOADS" == "true" ]]; then
-    DISABLE_FLAGS="$DISABLE_FLAGS --disable-file-uploads"
+    DISABLE_FLAGS+=(--disable-file-uploads)
 fi
 
 if [[ "$DISABLEGETTINGSTARTEDOVERRIDE" == "true" ]]; then
-    DISABLE_FLAGS="$DISABLE_FLAGS --disable-getting-started-override"
+    DISABLE_FLAGS+=(--disable-getting-started-override)
 fi
 
 if [[ "$DISABLEPROXY" == "true" ]]; then
-    DISABLE_FLAGS="$DISABLE_FLAGS --disable-proxy"
+    DISABLE_FLAGS+=(--disable-proxy)
 fi
 
 if [[ "$DISABLETELEMETRY" == "true" ]]; then
-    DISABLE_FLAGS="$DISABLE_FLAGS --disable-telemetry"
+    DISABLE_FLAGS+=(--disable-telemetry)
 fi
 
 if [[ "$DISABLEUPDATECHECK" == "true" ]]; then
-    DISABLE_FLAGS="$DISABLE_FLAGS --disable-update-check"
+    DISABLE_FLAGS+=(--disable-update-check)
 fi
 
 if [[ "$DISABLEWORKSPACETRUST" == "true" ]]; then
-    DISABLE_FLAGS="$DISABLE_FLAGS --disable-workspace-trust"
+    DISABLE_FLAGS+=(--disable-workspace-trust)
 fi
 
 cat > /usr/local/bin/code-server-entrypoint \
@@ -58,7 +58,7 @@ cat > /usr/local/bin/code-server-entrypoint \
 #!/usr/bin/env bash
 set -e
 
-su $_REMOTE_USER -c 'code-server --auth "$AUTH" --bind-addr "$HOST:$PORT" $DISABLE_FLAGS "$CODE_SERVER_WORKSPACE"'
+su $_REMOTE_USER -c 'code-server --auth "$AUTH" --bind-addr "$HOST:$PORT" ${DISABLE_FLAGS[*]} "$CODE_SERVER_WORKSPACE"'
 EOF
 
 chmod +x /usr/local/bin/code-server-entrypoint

From 360e865543a495b6650390ab3a6ab098d99047f8 Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Mon, 14 Apr 2025 12:45:50 +0000
Subject: [PATCH 5/5] chore: slight rewrite on install script and tests

---
 src/code-server/install.sh                       |  4 +++-
 .../code-server-disable-file-downloads.sh        |  2 +-
 .../code-server-disable-file-uploads.sh          |  2 +-
 ...de-server-disable-getting-started-override.sh |  2 +-
 .../code-server-disable-multiple-options.sh      | 16 ++++++++--------
 test/code-server/code-server-disable-proxy.sh    |  2 +-
 .../code-server/code-server-disable-telemetry.sh |  2 +-
 .../code-server-disable-update-check.sh          |  2 +-
 .../code-server-disable-workspace-trust.sh       |  2 +-
 9 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/src/code-server/install.sh b/src/code-server/install.sh
index c6d3835..8a453a8 100644
--- a/src/code-server/install.sh
+++ b/src/code-server/install.sh
@@ -58,7 +58,9 @@ cat > /usr/local/bin/code-server-entrypoint \
 #!/usr/bin/env bash
 set -e
 
-su $_REMOTE_USER -c 'code-server --auth "$AUTH" --bind-addr "$HOST:$PORT" ${DISABLE_FLAGS[*]} "$CODE_SERVER_WORKSPACE"'
+$(declare -p DISABLE_FLAGS)
+
+su $_REMOTE_USER -c 'code-server --auth "$AUTH" --bind-addr "$HOST:$PORT" "\${DISABLE_FLAGS[@]}" "$CODE_SERVER_WORKSPACE"'
 EOF
 
 chmod +x /usr/local/bin/code-server-entrypoint
diff --git a/test/code-server/code-server-disable-file-downloads.sh b/test/code-server/code-server-disable-file-downloads.sh
index 9efca53..d534585 100644
--- a/test/code-server/code-server-disable-file-downloads.sh
+++ b/test/code-server/code-server-disable-file-downloads.sh
@@ -9,7 +9,7 @@ check "code-server version" code-server --version
 check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
 check "code-server listening" lsof -i "@127.0.0.1:8080"
 
-check "code-server disable-file-downloads" grep $'\'code-server.* --disable-file-downloads .*' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-file-downloads" grep '"--disable-file-downloads"' < /usr/local/bin/code-server-entrypoint
 
 # Report results
 reportResults
diff --git a/test/code-server/code-server-disable-file-uploads.sh b/test/code-server/code-server-disable-file-uploads.sh
index 0cfb081..8a165fd 100644
--- a/test/code-server/code-server-disable-file-uploads.sh
+++ b/test/code-server/code-server-disable-file-uploads.sh
@@ -9,7 +9,7 @@ check "code-server version" code-server --version
 check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
 check "code-server listening" lsof -i "@127.0.0.1:8080"
 
-check "code-server disable-file-uploads" grep $'\'code-server.* --disable-file-uploads .*' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-file-uploads" grep '"--disable-file-uploads"' < /usr/local/bin/code-server-entrypoint
 
 # Report results
 reportResults
diff --git a/test/code-server/code-server-disable-getting-started-override.sh b/test/code-server/code-server-disable-getting-started-override.sh
index 9ce59cb..422a24e 100644
--- a/test/code-server/code-server-disable-getting-started-override.sh
+++ b/test/code-server/code-server-disable-getting-started-override.sh
@@ -9,7 +9,7 @@ check "code-server version" code-server --version
 check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
 check "code-server listening" lsof -i "@127.0.0.1:8080"
 
-check "code-server disable-getting-started-override" grep $'\'code-server.* --disable-getting-started-override .*' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-getting-started-override" grep '"--disable-getting-started-override"' < /usr/local/bin/code-server-entrypoint
 
 # Report results
 reportResults
diff --git a/test/code-server/code-server-disable-multiple-options.sh b/test/code-server/code-server-disable-multiple-options.sh
index 671e2e9..b81f6f1 100644
--- a/test/code-server/code-server-disable-multiple-options.sh
+++ b/test/code-server/code-server-disable-multiple-options.sh
@@ -9,14 +9,14 @@ check "code-server version" code-server --version
 check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
 check "code-server listening" lsof -i "@127.0.0.1:8080"
 
-# Check for all three flags we enabled in this scenario
-check "code-server disable-file-downloads" grep $'\'code-server.* --disable-file-downloads .*' < /usr/local/bin/code-server-entrypoint
-check "code-server disable-file-uploads" grep $'\'code-server.* --disable-file-uploads .*' < /usr/local/bin/code-server-entrypoint
-check "code-server disable-getting-started-override" grep $'\'code-server.* --disable-getting-started-override .*' < /usr/local/bin/code-server-entrypoint
-check "code-server disable-proxy" grep $'\'code-server.* --disable-proxy .*' < /usr/local/bin/code-server-entrypoint
-check "code-server disable-telemetry" grep $'\'code-server.* --disable-telemetry .*' < /usr/local/bin/code-server-entrypoint
-check "code-server disable-update-check" grep $'\'code-server.* --disable-update-check .*' < /usr/local/bin/code-server-entrypoint
-check "code-server disable-workspace-trust" grep $'\'code-server.* --disable-workspace-trust .*' < /usr/local/bin/code-server-entrypoint
+# Check for all flags we enabled in this scenario
+check "code-server disable-file-downloads" grep '"--disable-file-downloads"' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-file-uploads" grep '"--disable-file-uploads"' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-getting-started-override" grep '"--disable-getting-started-override"' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-proxy" grep '"--disable-proxy"' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-telemetry" grep '"--disable-telemetry"' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-update-check" grep '"--disable-update-check"' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-workspace-trust" grep '"--disable-workspace-trust"' < /usr/local/bin/code-server-entrypoint
 
 # Report results
 reportResults
diff --git a/test/code-server/code-server-disable-proxy.sh b/test/code-server/code-server-disable-proxy.sh
index 16da45c..b481702 100644
--- a/test/code-server/code-server-disable-proxy.sh
+++ b/test/code-server/code-server-disable-proxy.sh
@@ -9,7 +9,7 @@ check "code-server version" code-server --version
 check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
 check "code-server listening" lsof -i "@127.0.0.1:8080"
 
-check "code-server disable-proxy" grep $'\'code-server.* --disable-proxy .*' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-proxy" grep '"--disable-proxy"' < /usr/local/bin/code-server-entrypoint
 
 # Report results
 reportResults
diff --git a/test/code-server/code-server-disable-telemetry.sh b/test/code-server/code-server-disable-telemetry.sh
index 9cd9257..45acdc2 100644
--- a/test/code-server/code-server-disable-telemetry.sh
+++ b/test/code-server/code-server-disable-telemetry.sh
@@ -9,7 +9,7 @@ check "code-server version" code-server --version
 check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
 check "code-server listening" lsof -i "@127.0.0.1:8080"
 
-check "code-server disable-telemetry" grep $'\'code-server.* --disable-telemetry .*' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-telemetry" grep '"--disable-telemetry"' < /usr/local/bin/code-server-entrypoint
 
 # Report results
 reportResults
diff --git a/test/code-server/code-server-disable-update-check.sh b/test/code-server/code-server-disable-update-check.sh
index 8022f1a..4f7408f 100644
--- a/test/code-server/code-server-disable-update-check.sh
+++ b/test/code-server/code-server-disable-update-check.sh
@@ -9,7 +9,7 @@ check "code-server version" code-server --version
 check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
 check "code-server listening" lsof -i "@127.0.0.1:8080"
 
-check "code-server disable-update-check" grep $'\'code-server.* --disable-update-check .*' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-update-check" grep '"--disable-update-check"' < /usr/local/bin/code-server-entrypoint
 
 # Report results
 reportResults
diff --git a/test/code-server/code-server-disable-workspace-trust.sh b/test/code-server/code-server-disable-workspace-trust.sh
index b97943e..3872bd4 100644
--- a/test/code-server/code-server-disable-workspace-trust.sh
+++ b/test/code-server/code-server-disable-workspace-trust.sh
@@ -9,7 +9,7 @@ check "code-server version" code-server --version
 check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
 check "code-server listening" lsof -i "@127.0.0.1:8080"
 
-check "code-server disable-workspace-trust" grep $'\'code-server.* --disable-workspace-trust .*' < /usr/local/bin/code-server-entrypoint
+check "code-server disable-workspace-trust" grep '"--disable-workspace-trust"' < /usr/local/bin/code-server-entrypoint
 
 # Report results
 reportResults