mirror of
https://github.com/coder/coder.git
synced 2026-09-23 22:20:22 +08:00
Jeremy Ruppel
10717572ac
Surface base template prerequisites to admins before they create a
template in the Template Builder wizard.
Today, template prerequisites (Docker socket setup, Kubernetes auth, AWS
IAM policies) are only visible in the registry README after import.
Admins hit opaque provisioner errors and have to hunt for docs. This
change extracts the prerequisites from the README and serves them via
the API so the frontend can display them inline.
## How it works
Each base template README uses HTML comment markers (`<!--
prerequisites:start -->` / `<!-- prerequisites:end -->`) to delimit the
prerequisites section. At boot time, the base catalog loader reads the
README, extracts the content between markers via `strings.Index`, and
caches both the full README and the prerequisites string.
The prerequisites are served via a new `prerequisites` field on `GET
/api/v2/templatebuilder/bases`. The full README is included in the
composed template tar bundle and stored as the template version readme.
## Changes
- Add `README.md` with prerequisite markers to
`coderd/templatebuilder/bases/{docker,kubernetes,aws-linux}/`
- New `ExtractPrerequisites()` in `prerequisites.go` using literal
string matching
- `bases.go`: load README at boot, fail loudly if missing, extract
prerequisites
- `compose.go`: include README in `ComposeResult` and tar bundle
- `codersdk`: add `Prerequisites` field to `TemplateBuilderBase`
- Handler: populate prerequisites in bases response, set readme on
template version
<details>
<summary>Implementation notes</summary>
- Prerequisites extraction uses `strings.Index` for exact literal marker
matching; no regex or AST parser needed since we control the markers.
- YAML frontmatter is deliberately retained in the stored README. The
frontend `TemplateDocsPage` already strips it at render time via
`front-matter`.
- The prerequisite markers are HTML comments, invisible in rendered
markdown.
- The `RejectsMissingReadme` test enforces that every base template must
include a README.
- AWS Linux prerequisites span two H2 sections (`## Prerequisites` and
`## Required permissions / policy`), which is why heading-based parsing
was rejected in favor of explicit markers.
*Generated with the assistance of an AI coding agent. Reviewed by
@jeremyruppel.*
</details>
Relates to https://linear.app/codercom/issue/DEVEX-446
99 lines
3.1 KiB
Markdown
99 lines
3.1 KiB
Markdown
---
|
|
display_name: AWS EC2 (Linux)
|
|
description: Provision AWS EC2 VMs as Coder workspaces
|
|
icon: ../../../site/static/icon/aws.svg
|
|
maintainer_github: coder
|
|
verified: true
|
|
tags: [vm, linux, aws, persistent-vm]
|
|
---
|
|
|
|
# Remote Development on AWS EC2 VMs (Linux)
|
|
|
|
Provision AWS EC2 VMs as [Coder workspaces](https://coder.com/docs/user-guides/workspace-management) with this example template.
|
|
|
|
<!-- prerequisites:start -->
|
|
|
|
## Prerequisites
|
|
|
|
### Authentication
|
|
|
|
By default, this template authenticates to AWS using the provider's default [authentication methods](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#authentication-and-configuration).
|
|
|
|
The simplest way (without making changes to the template) is via environment variables (e.g. `AWS_ACCESS_KEY_ID`) or a [credentials file](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html#cli-configure-files-format). If you are running Coder on a VM, this file must be in `/home/coder/aws/credentials`.
|
|
|
|
To use another [authentication method](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#authentication), edit the template.
|
|
|
|
## Required permissions / policy
|
|
|
|
The following sample policy allows Coder to create EC2 instances and modify
|
|
instances provisioned by Coder:
|
|
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "VisualEditor0",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ec2:GetDefaultCreditSpecification",
|
|
"ec2:DescribeIamInstanceProfileAssociations",
|
|
"ec2:DescribeTags",
|
|
"ec2:DescribeInstances",
|
|
"ec2:DescribeInstanceTypes",
|
|
"ec2:DescribeInstanceStatus",
|
|
"ec2:CreateTags",
|
|
"ec2:RunInstances",
|
|
"ec2:DescribeInstanceCreditSpecifications",
|
|
"ec2:DescribeImages",
|
|
"ec2:ModifyDefaultCreditSpecification",
|
|
"ec2:DescribeVolumes"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "CoderResources",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ec2:DescribeInstanceAttribute",
|
|
"ec2:UnmonitorInstances",
|
|
"ec2:TerminateInstances",
|
|
"ec2:StartInstances",
|
|
"ec2:StopInstances",
|
|
"ec2:DeleteTags",
|
|
"ec2:MonitorInstances",
|
|
"ec2:CreateTags",
|
|
"ec2:RunInstances",
|
|
"ec2:ModifyInstanceAttribute",
|
|
"ec2:ModifyInstanceCreditSpecification"
|
|
],
|
|
"Resource": "arn:aws:ec2:*:*:instance/*",
|
|
"Condition": {
|
|
"StringEquals": {
|
|
"aws:ResourceTag/Coder_Provisioned": "true"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
<!-- prerequisites:end -->
|
|
|
|
## Architecture
|
|
|
|
This template provisions the following resources:
|
|
|
|
- AWS Instance
|
|
|
|
Coder uses `aws_ec2_instance_state` to start and stop the VM. This example template is fully persistent, meaning the full filesystem is preserved when the workspace restarts. See this [community example](https://github.com/bpmct/coder-templates/tree/main/aws-linux-ephemeral) of an ephemeral AWS instance.
|
|
|
|
> **Note**
|
|
> This template is designed to be a starting point! Edit the Terraform to extend the template to support your use case.
|
|
|
|
## code-server
|
|
|
|
`code-server` is installed via the `startup_script` argument in the `coder_agent`
|
|
resource block. The `coder_app` resource is defined to access `code-server` through
|
|
the dashboard UI over `localhost:13337`.
|