VS Code 1.139 Runs Your Coding Agent Inside a Remote Dev Container

In September 2026, VS Code 1.139 shipped something that looks small and is actually pivotal: Dev Container sessions stopped being a local-only affair. Until this release, an agent session in the Agents window could only run inside a Dev Container on your own machine. Starting with 1.139, projects on SSH, Tunnel, and WSL hosts can run the agent inside the Dev Container the project expects. That finally lets an agent use the exact toolchain, dependency versions, and system libraries your project defines, instead of running on your laptop and hoping it guesses the right Node version.

1. What Actually Shipped

The release notes are restrained about it: this version makes large agent session lists faster, extends Dev Container support to remote projects, and improves everyday editing. The load-bearing line is the first feature: Remote Dev Container sessions, which run agents inside the project's Dev Container on SSH, Tunnel, and WSL hosts. It arrives alongside session list improvements, where large lists load faster, more sessions fit on screen, and sessions can be renamed in place, plus editor polish such as a marker for wrapped lines and avoiding duplicate closing brackets as you type. This is not a novelty feature; it closes the last gap in a year of agent infrastructure work.

// .devcontainer/devcontainer.json — the agent runs here, not on your laptop.
// Pin the toolchain once and every agent session inherits it, whether the
// host is your machine, an SSH box, a dev tunnel, or WSL.
{
  "name": "agent-workspace",
  "image": "mcr.microsoft.com/devcontainers/base:ubuntu-24.04",
  "features": {
    "ghcr.io/devcontainers/features/node:1": { "version": "22" },
    "ghcr.io/devcontainers/features/python:1": { "version": "3.12" },
    "ghcr.io/devcontainers/features/docker-in-docker:2": {}
  },
  "postCreateCommand": "npm ci && pip install -r requirements.txt",
  "remoteUser": "vscode",
  "containerEnv": { "AGENT_ID": "vscode-agent", "CI": "false" }
}

1.139 extends Dev Container sessions from local folders to remote hosts

2. Why a Dev Container, Not a Bare Remote Machine

Why a Dev Container rather than just a remote machine? Because the container is the smallest reproducible unit. The host is only a location; the container is the contract. The image, features, initialisation command, and environment variables all live in devcontainer.json under version control. When an agent executes inside a declarative container, the toolchain it sees, the dependencies it installs, and the commands it runs match what your CI runs. Code sample 1 is that contract: pin Node 22, Python 3.12, and Docker, then do one-time setup in postCreateCommand. The real win is not convenience, it is that the question of what environment changed your code finally has a deterministic answer.

// settings.json — the one setting 1.139 introduces for this workflow.
// Dev Container sessions are rolling out gradually, so you may need to
// enable it by hand before it appears in your build.
{
  "chat.agentHost.devContainer.enabled": true
}

// Then, in the Agents window, open the folder menu and choose
// "Use Dev Container". Requirements, per the release notes:
//   - the remote folder has a supported Dev Container configuration
//   - Docker is available on the remote host

3. The Agent Host Architecture Behind It

Making a session outlive its window depends on the Agent Host architecture. The official August 2026 blog explains it plainly: the Agent Host is a dedicated process that owns agent sessions, and the Agent Host Protocol (AHP) connects hosts and clients. Previously the local agent harness ran in each editor window's extension host, so closing the window stopped the runtime. Now the session belongs to a separate process, and multiple windows, the Agents window, and even browser clients can connect to the same host. Code sample 3 shows the manual version of that idea: run code agent host on the remote machine, then attach from any client. The protocol is deliberately state-first: the host translates harness events into durable, display-ready state, so a client that reconnects simply catches up.

#!/usr/bin/env bash
# The Agent Host is a real process you can start yourself. Running it as a
# standalone server is what makes a session outlive the window it began in.
set -euo pipefail

# Start a headless host on the remote machine (agent sessions live here).
code agent host --port 8080 --workspace /workspace

# From any client — desktop Agents window, a browser tab, or your own tool
# built against AHP — connect to the same host and watch the same session.
# The session state is the host's, not the client's, so closing a tab
# no longer cancels an agent that is mid-task.

SSH, Tunnel, and WSL hosts can now carry agent sessions

4. Hands On: The Setting and Two Prerequisites

Enabling it is simple, with two prerequisites. First, turn on the chat.agentHost.devContainer.enabled setting. The release notes also note that Dev Container sessions are rolling out gradually, so the setting may not be enabled by default for you yet and you may need to enable it manually. Second, two conditions must hold where you use it: the remote folder must have a supported Dev Container configuration, and Docker must be available on the remote host. After that, open the folder menu in the Agents window and choose Use Dev Container. Code sample 2 spells out the setting and both prerequisites. Note the deliberate wording, gradual rollout, which means you should treat remote Dev Container sessions as a preview capability rather than a stable dependency.

// Guardrail 1: an agent that can reach the internet is an agent that can
// exfiltrate. If it needs a package registry, that is a dependency to name.
// Default deny, then list exactly what the workspace needs.

const egressPolicy = {
  default: "deny",
  allow: [
    { host: "registry.npmjs.org", ports: [443], scope: "workspace" },
    { host: "pypi.org", ports: [443], scope: "workspace" },
    { host: "api.github.com", ports: [443], scope: "agent", ttlMinutes: 30 },
  ],
  // Anything not listed is a finding, not a silent success.
  onDenied: (req) => audit.record({ kind: "egress_denied", ...req }),
};

5. Agent Merge and Remote Access, Shipped Alongside

Two quieter capabilities landed in the same window. The first is Agent Merge: with the experimental feature enabled, an agent can turn it on for the current session, which means you can ask an agent to create a pull request and take it through review and CI. The second is remote access, documented across SSH, dev tunnels, and the browser, so you can connect from a phone or another machine and watch the same session. Put together, the agent's role shifts from writing code to driving a change all the way to merge. That raises the stakes, because you now have to answer what it changed and who approved it.

# Guardrail 2: what did the remote agent actually do while you were asleep?
# Log the session, the tool, the files it touched, and the diff hash, so
# "the agent edited my project" is a record instead of a rumour.

def record_session(session, turn, tool, files, diff_hash):
    ledger.append({
        "ts": time.time(),
        "host": session.host_kind,          # local | ssh | tunnel | wsl
        "agent": session.agent,             # copilot | claude | ...
        "turn": turn,
        "tool": tool,                       # edit, terminal, fetch, ...
        "files": files,                     # workspace-relative only
        "diffHash": diff_hash,              # reproduce, do not re-read
        "approvedBy": session.approver,     # set only when a human gated it
    })

for row in ledger.tail(20):
    print(row["host"], row["agent"], row["tool"], row["diffHash"][:12])

The Agent Host keeps a session alive across windows and devices

6. A Rollout Checklist for Teams

A rollout checklist for teams. First, treat the Dev Container configuration as a product asset: image, features, and setup commands all in version control. Second, name which hosts may carry agent sessions, such as a specific jump host, tunnel host, or WSL distro, and deny everything else. Third, make network egress a deny-by-default allowlist; code sample 4 gives the policy shape, and any undeclared destination should produce an audit record rather than a silent success. Fourth, log provenance per remote session, including host kind, agent, turn, tool, files, diff hash, and approver, as code sample 5 lays out. Fifth, wire Agent Merge into branch protection and required checks so there is a reviewable line between opening a pull request and merging it. Sixth, pilot on the preview channel and treat remote Dev Container sessions as a capability, not a dependency.