[coder]

Adds registry/coder/templates/kubernetes-airgapped, a Kubernetes starter template that makes no outbound internet calls during template push, workspace build, or workspace startup.

The existing Kubernetes template looks like a good fit for air-gapped POCs, but it pulls from Docker Hub, registry.coder.com, and code-server.dev on the first build. Each of those then has to be found and worked around during a customer POC.

What's different from coder/kubernetes

	coder/kubernetes	coder/kubernetes-airgapped
Providers	Unpinned	Pinned (coder ~> 2.0, kubernetes ~> 3.0) so they can be mirrored
Modules	code-server from registry.coder.com (installs code-server at runtime)	None
Image	Defaults to codercom/example-base:ubuntu (Docker Hub)	Required variable, no default; optional image_pull_secret
IDE	Downloaded at startup	coder_script starts the code-server already baked into the image (--disable-telemetry --disable-update-check); can be turned off
Extensions	open-vsx.org	Optional extensions_gallery for an internal mirror
Agent	From the access URL	From the access URL (unchanged)

The README covers:

• Mirroring providers with terraform providers mirror plus a .terraformrc
• A Dockerfile that bakes code-server into the base image
• The Coder server settings needed for air-gapped installs (linked to the docs)
• A NetworkPolicy that blocks all egress except DNS and Coder, so you can prove the workspace works offline
• Client-side caveats for VS Code Desktop and JetBrains

Testing

• terraform init && terraform validate pass (coder 2.x, kubernetes 3.x)
• bun run fmt made no changes; go run ./cmd/readmevalidation passes
• Built the README's example Dockerfile and ran the template's code-server startup script with docker run --network none. code-server started and /healthz responded.
• Not yet tested: an end-to-end workspace build on a cluster with egress blocked. That's worth doing before merge.

Follow-up

Air-gapped deployments can't reach registry.coder.com, so the in-product starter templates (embedded from coder/coder/examples/templates) are what these customers actually see. Embedding a copy there would be a separate PR in coder/coder.

---

Generated with Superblink (Coder's Slack assistant) using Claude, at the request of @stirby.