Add npm package to make code-server super simple to install

[nhooyr]

No description provided.

[nhooyr]

See #1306

[brandonkal]

Please don't use npm for global binaries.

[nhooyr]

Can you elaborate?

[brandonkal]

There are better options. In Linux we have apt-get. In macOS and Linux we have Homebrew.

• npm installs are slow.
• npm is non-deterministic
• The package is not signed. This is a big issue.
• The only integrity check performed is a basic SHA1 hash, which is a security risk when installing system-wide apps.
• Upgrades are not handled the same way as all other software on your system (apt-get upgrade)
• The track record isn't great
• It's insecure and not designed for global packages. In Homebrew I can look at the actual formula file. With npm you are downloading a tarball from some server which then runs any arbitrary code. Nothing is stopping people from packaging different minimized code than what is in GitHub.

Given all the above, even a shell script would be better.

[nhooyr]

I think there's some confusion. This issue isn't about making it the sole way to distribute code-server. We'll still keep our releases, docker images and work towards deb/rpm packages #1395. Having an npm package just reduces friction for users who want to try it out.

[michael-dm]

Hello @nhooyr, do you know when this issue might be addressed ? I'd like to install coder on alpine and it seems npm would be the simplest way.

[brandonkal]

There's no confusion here. Releasing an npm package just encourages bad practices and there's not a case where it would be easier for your users vs using a proper package manager or a simple install shell script.

@micodeyt why bother? Code Server + a reasonable amount of extensions will put you at about 1-2 GB. Support more than one language, and that grows more. At that point, why go through the hassle of using Alpine for your base image to save 7 MB?
If you throw in adding npm to then install code server, you've already lost the small size advantage that is Alpine.

[nhooyr]

There's no confusion here. Releasing an npm package just encourages bad practices and there's not a case where it would be easier for your users vs using a proper package manager or a simple install shell script.

A proper package manager is always better yes, but npm/node is everywhere. Compared to a shell script, you can easily uninstall, list installed global binaries etc and have it already in your $PATH so it is an improvement.

We're still moving forward with the Debian releases/repo and a PPA but this will be a nice crutch for when you just want to quickly install.

You can test it out now:

yarn global add code-server

[gyzerok]

For me the build is failing on installation.

Have you considered installing already built version with npm/yarn? That would also make installation faster.

[nhooyr]

@gyzerok Can you try again, it's been merged and in the README.md now: https://github.com/cdr/code-server#npm

Re installing build versions with npm/yarn see #1641