Security & Offline Use

QCoder's Docker sandbox mode provides an additional security layer for command execution:

• When enabled, all execute_command tool calls run inside an isolated Docker container.
• The container has limited filesystem access (only the workspace directory is mounted).
• Network access can be restricted or fully disabled.
• If Docker is unavailable, QCoder falls back to direct terminal execution (configurable).

Enable sandbox mode in Settings > Security or by setting qcoder.sandbox.enabled to true.

This is especially useful in enterprise environments where untrusted AI-generated commands should not have direct access to the host system.

Point QCoder at your own model hosting (vLLM, TGI, Ollama, etc.) instead of cloud APIs. With Ollama or LM Studio running locally, AI features work without any cloud API and no data leaves your machine.

QCoder runs fully offline with a local Ollama or LM Studio instance, so it works on networks with no internet access. Install extensions from local packages instead of the marketplace.

Your API keys are stored in VS Code's SecretStorage, which uses the OS keychain (Keychain on macOS, Credential Vault on Windows, libsecret on Linux). QCoder sends no telemetry, and the open source build makes no calls to any QCoder server.