AI Governance & Security Vendor Wiki

10 min read

Coder

Primary category: ephemeral-environments. Also listed in ai-gateway and agent-runtime-security.

One-liner — Self-hosted cloud development environments: developers and coding agents work in disposable workspaces that run on the firm’s own cloud, on-prem or air-gapped infrastructure, with source code kept off laptops. Recent versions add an LLM gateway and a per-agent egress firewall.

What it does — An admin writes templates, usually Terraform, that define a workspace: a container, VM or Kubernetes pod, plus its image, network, and the credentials it gets. Developers, or agents launched through Coder Tasks, create workspaces from those templates on infrastructure the firm runs. A control plane (coderd) manages them. Users connect from VS Code, JetBrains, Cursor, a browser IDE or SSH. Workspaces can stop automatically when idle, go dormant, and be deleted after a set period, so environments do not pile up.

Since 2026, a paid AI Governance layer adds two controls for coding agents:

  • AI Gateway (called AI Bridge until July 2026) sits between agents or IDEs and model providers: OpenAI, Anthropic, and AWS Bedrock, including through a corporate gateway. Users sign in with their Coder identity and coderd calls the provider for them, so developers never hold provider API keys. It can log prompts, token usage and tool calls, each attributed to a named user. Admins set which MCP servers and tools are allowed. It works for clients outside Coder workspaces as well as inside.
  • Agent Firewall (called Agent Boundaries until July 2026) is a process-level network jail around an agent running in a workspace. It allows only listed domains, HTTP methods and paths, and blocks everything else. Every HTTP request is logged centrally with the allow or deny decision, workspace, owner, template, method, URL and the rule that matched. It works with any terminal-based agent (Claude Code, Codex CLI, custom agents).

Why a CTO would use it for isolation — Coder is the self-hosted way to turn the trust-zone-segmentation design into real infrastructure for developers and coding agents:

  • Zone-scoped by template. Each template fixes the network, data access and credentials a workspace gets. You can have a research-data template with warehouse access and no internet, and an open-source template with internet and no internal data. Developers choose a template; they cannot widen what it allows.
  • Short-lived. Autostop, dormancy and auto-delete stop workspaces from accumulating months of credentials and drift.
  • Agent-specific egress. Agent Firewall applies a tighter allowlist to the agent process than to the human in the same workspace. This is the main difference from github-codespaces and google-cloud-workstations, which control the network only at workspace or VPC level.
  • One audit trail for model calls (AI Gateway) and agent network requests (Agent Firewall), streamed to the SIEM.

Naming / provenance — Founded in 2017 in Austin, Texas, as Coder Technologies, and sold as “Coder” at coder.com. The earlier code-server project, which runs VS Code in a browser, is also Coder’s. The governance features were renamed in July 2026 with no change in function: AI Bridge became AI Gateway and Agent Boundaries became Agent Firewall. Some configuration options still use the old “boundary” name. Older documents and comparisons use the old names.

Ownership & viability — independent, Series C. $90M Series C announced 2026-04-01, led by funds managed by KKR (mainly its Next Generation Technology Growth Fund III), with Qube Research & Technologies (QRT), Uncork Capital and existing investors. Third-party trackers put the earlier Series B at $65M in total, including a $35M extension in June 2024, and total funding near $175M. Those figures are unverified and funding_total stays null. The company says bookings grew 300% year on year over four quarters and net dollar retention was 184%. These are vendor figures. Releases ship frequently: v2.36 to v2.38 patch releases all came out on 2026-10-23, and the AGPL repo is active. Viability risk looks low for a Series C company. As a likely acquisition target, the plausible buyers are a cloud, a developer-platform vendor or an AI lab. Ona went to OpenAI in 2026 (ona), which shows the pattern. Because the core is AGPL and self-hosted, an acquisition would not cut off running deployments, though roadmap and Premium support could change.

Positioning & differentiators — leader in ephemeral-environments, in the self-hosted segment. After ona’s acquisition by OpenAI and the shutdown of its hosted service, and with DevPod unmaintained, Coder is the main independent self-hosted cloud-development-environment vendor. It also has named hedge-fund and asset-manager deployments. platform-module in ai-gateway and agent-runtime-security: those features are part of Coder Premium and are not sold on their own.

  • vs. github-codespaces: Codespaces runs on GitHub’s Azure infrastructure. Coder runs on yours, including air-gapped networks, and works with any Git host and any cloud. Codespaces needs no infrastructure team. Coder needs one.
  • vs. google-cloud-workstations: both put workspaces in your own network. Cloud Workstations is a managed service on Google Cloud only. Coder runs on any cloud or on-prem, and adds an LLM gateway and agent-level egress control.
  • vs. agent sandboxes (daytona, modal, docker-sandboxes): those are API-created sandboxes for code an agent generates, often lasting seconds. Coder workspaces are full development environments that last hours or days, shared between a human and the agents that person runs. Docker Sandboxes’ microVM isolation per session on a laptop is a stronger boundary than a namespace jail. Coder’s advantage is running centrally, on server infrastructure, under one policy.
  • vs. a standalone ai-gateway: Coder’s AI Gateway knows which workspace, template and user a request came from. A standalone gateway has broader provider routing, guardrails and cost features. Firms that already run a gateway can chain Coder’s gateway to it.

Who should choose them / anti-fit — Fits a firm that wants developers, quants and coding agents to work inside its own perimeter: code and data stay in its VPC or data centre, egress is controlled per template and per agent, and every model call can be audited. That describes most hedge funds with proprietary strategy code. KKR and QRT are reference customers and investors. Anti-fit: a small team without platform engineers to run Kubernetes or Terraform and operate a control plane; a firm content with SaaS-hosted dev environments (use Codespaces); and teams whose only need is thousands of short API-created sandboxes for agent-generated code (use an agent-sandbox product).

Known weaknesses / gotchas —

  • The governance features are paid. AI Gateway, Agent Firewall, dormancy and auto-delete, and autostop requirements are Premium features. The free AGPL edition gives you workspaces, not the agent controls.
  • Agent Firewall bypass limits are documented. The default nsjail mode needs CAP_NET_ADMIN and may need seccomp changes. Its PID namespace and UDP controls are listed as in progress. The landjail mode is rated by Coder itself as “medium bypass resistance”: a process can connect directly to the proxy port, there is no UDP control, and tools that ignore HTTP_PROXY are blocked rather than filtered. The use_real_dns option allows DNS-based data exfiltration. Treat it as a strong guardrail, not a hard security boundary on the level of a microVM.
  • The firewall covers HTTP and HTTPS. Coder describes workspace network policy plus HTTP allowlists for agents. Lock down non-HTTP egress at the template or VPC level.
  • Telemetry is on by default. It can be turned off. Do so before treating the deployment as fully in-tenant.
  • The SOC 2 claim is vendor-stated. The report’s scope was not seen.

Deployment & data handling — Self-hosted only in its standard form, on any cloud, on-prem, or fully air-gapped. Workspaces run on the firm’s own compute: Kubernetes, VMs or Docker. An AWS Marketplace listing labelled SaaS delivery appears to be a billing route, not a Coder-hosted service. That is unverified. Source code, credentials and model traffic stay inside the firm’s infrastructure, and Coder says it has no access to workspaces or source code. Hence data_leaves_tenancy: "false", provided default product telemetry is disabled. AI Gateway is inline between agents and model providers, so prompts still go to whichever provider you configure, under your own contract with that provider. Where AI Gateway stores prompt logs and how long it keeps them is configurable but was not reviewed. That is an open question.

Integrations & partnerships — Terraform-based templates on Kubernetes, Docker, AWS, Azure and GCP. IDEs: VS Code, JetBrains, Cursor and browser-based IDEs. Model providers through AI Gateway: OpenAI, Anthropic, AWS Bedrock, and corporate gateways in front of them. MCP: admin-approved MCP server and tool lists (mcp_support: gateway). Audit events stream to a SIEM. Coder’s Series C release names Claude Code, Cursor and OpenClaw as tools its customers use. Available on AWS Marketplace.

Compliance & FS traction — SOC 2 Type II, stated by the vendor as “independently audited annually”. Report not seen. Financial-services evidence is strong and on the record. In Coder’s 2026-04-01 announcement, KKR said Coder runs for more than 500 of its engineers, and more than half of its commits come from Coder-managed environments with AI assistance. QRT (Qube Research & Technologies, a quantitative hedge fund) said it has rolled Coder out to half of its 2,000-plus employees, including engineers, data scientists and analysts. QRT’s Zohar Melamed is quoted saying Coder lets it “audit every LLM request”. Both firms also invested in the round. That is customer evidence, but both are also shareholders. Other named users include a US defence-intelligence organisation (2,500+ developers), Square and Palantir.

Commercial — Open core. The Community edition is free under AGPL-3.0. Premium is contact-sales, and per the July 2026 update all newly purchased Premium licences include AI Governance. Earlier Premium licences bought it as an add-on. No public price. Third-party sites quote figures from about $35 per user per month, which is unverified, so pricing_model stays null.

Open questions

  • Premium pricing band, and whether it is per seat or per workspace.
  • Scope and date of the SOC 2 Type II report, and whether it covers anything beyond Coder’s corporate controls, since the product is self-hosted.
  • Whether there is a genuinely Coder-hosted SaaS option, given the “SaaS” label on an AWS Marketplace listing.
  • Where AI Gateway stores prompts and tool-call logs, and the default retention.
  • Agent Firewall’s roadmap for PID namespace and UDP controls in nsjail, and for egress control beyond HTTP.
  • Total funding to date.

Sources

History

  • [2026-10-26] Page created via wiki-create + wiki-research (dev-environment products batch for ephemeral-environments).

Graph View

Backlinks