VS Code 1.139 Remote Dev Containers for AI Agents: SSH, Tunnel & WSL Guide

Work from the safest step to the harder repair.

1. Step 1. Confirm the desktop VS Code client is on 1.139 or later and treat the remote Dev Container capability as experimental. Do not promise identical availability across every installation because Microsoft says the rollout is gradual.
2. Step 2. Verify the remote connection first. For SSH, use the organization's approved SSH access. For dev tunnels, require GitHub or Microsoft authentication; do not use an anonymous tunnel for agent access.
3. Step 3. Verify Docker is installed and running on the machine that contains the project folder. For a remote folder, that means the remote host rather than merely the developer's laptop.
4. Step 4. Verify the workspace contains a supported Dev Container configuration at .devcontainer/devcontainer.json or .devcontainer.json. Review the image, features, mounts, forwarded services and lifecycle commands before allowing an agent to execute inside it.
5. Step 5. Enable chat.agentHost.devContainer.enabled only where the organization has approved the experimental capability, then select Use Dev Container for the eligible SSH, Tunnel or WSL workspace in the desktop Agents window.
6. Step 6. Choose the agent harness separately from the execution environment. A Dev Container determines where project operations run; it does not by itself grant a model or harness permission to perform every repository, network or deployment action.
7. Step 7. Start with a low-risk validation task. Confirm the agent can read the intended workspace, run approved build/test commands and write only expected files before broadening approvals or credentials.
8. Step 8. Keep auto-approval narrow. VS Code specifically warns that an unauthenticated dev tunnel combined with auto-approval can expose AI-assisted command execution to an unauthorized user.
9. Step 9. Keep production credentials and deployment authority outside the container unless the task genuinely requires them and the user, repository and environment have been authorized for that action. Prefer least-privilege test credentials for build and QA workflows.
10. Step 10. Run the normal typecheck, tests, review and branch-protection process on agent-authored changes. Container isolation does not prove the code is correct or safe to merge.
11. Step 11. Remember that Dev Container sessions cannot be combined with New Worktree in the current Agents window flow. Choose the isolation/workspace strategy deliberately instead of assuming both apply.
12. Step 12. If the container fails to start or the remote host disconnects, diagnose the Dev Container and remote connection rather than weakening authentication or approval controls to force the session through.

Need the actual code? Go to GenesisCodeDoctor.com to search the Code Store or request code for the exact platform, error, and repair you are working on.

Use evidence to decide the next move.

1. 1. Is the project local rather than remote? Use the existing local Dev Container agent workflow instead of this remote-host path.
2. 2. Is the remote folder reached through an anonymous dev tunnel? Stop and require authenticated access before starting an agent session.
3. 3. Does the remote host lack Docker or the repository lack a supported Dev Container configuration? Fix the environment first rather than running an improvised privileged container.
4. 4. Does the task need a different harness? Select the harness separately; do not assume Dev Container choice determines the model or agent implementation.
5. 5. Does the task require production credentials or deployment? Apply the normal authorization and approval process independently of the Dev Container.
6. 6. Do you need New Worktree at the same time? Current VS Code documentation says Dev Container sessions cannot be combined with New Worktree, so choose the appropriate workflow rather than claiming both are active.

A visual path from symptom to verified production.

Protect the working site first.

• Keep the remote host and container on least-privilege credentials and review any mounted secrets, sockets or host paths before agent execution.
• Validate generated changes as ordinary source-control diffs with typecheck, tests, code review and a rollback path.
• Separate remote connectivity, container isolation, agent-harness choice and consequential-action approval in both policy and incident review.

Do not turn a repair into a larger outage.

• Do not run agent sessions through an anonymous dev tunnel. VS Code warns that anyone who discovers the URL could reach the machine and start sessions.
• Do not interpret a Dev Container as an authorization boundary for repository secrets, cloud credentials, production databases or deployments.
• Do not describe the experimental remote Dev Container capability as universally enabled or guaranteed stable while Microsoft documents gradual rollout and possible change.
• Do not weaken Workspace Trust, SSH/tunnel authentication, code review or branch protection merely to make a remote agent task complete.

Diagnose the exact failure before choosing a repair.

Genesis separates the visible symptom from the underlying technical cause. Run the supported diagnostic first, review the evidence, and then use a matching repair only when the failure is actually verified.

Platform scope

Visual Studio Code 1.139 · Agents window · Agent Host · Dev Containers · SSH · Dev Tunnels · WSL

Category

Agentic coding · Remote development · Dev Containers · Production safety

Last updated

2026-09-25

Know the complexity before you edit.

Difficulty

Intermediate

Change risk

High

These labels describe implementation complexity and blast radius, not a guaranteed repair time.

Verify time-sensitive platform details at the source.

• Visual Studio Code 1.139 release notes — Remote Dev Container agent sessions
• VS Code Docs — Run and manage remote agent sessions
• VS Code Docs — Use the Agents window

Before you make the change

Continue from easy to harder.

• GitHub Copilot App Local Sandboxing: Production Safety Guide
• Authentication vs Authorization: Production Access-Control Guide
• GitHub Copilot App OpenTelemetry: Agent Observability Guide