diff --git a/nasp-ubuntu/Dockerfile b/nasp-ubuntu/Dockerfile
index 804e93a..3810232 100644
--- a/nasp-ubuntu/Dockerfile
+++ b/nasp-ubuntu/Dockerfile
@@ -8,7 +8,8 @@ RUN ln -fs /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \
     build-essential cmake openssh-server git-all sudo ssh sshpass pciutils \
     python3 python3-dev python3-pip curl ca-certificates vim zsh tmux bash \
     inetutils-ping less wget dialog net-tools dnsutils netcat traceroute \
-    cron htop zip dkms \
+    cron htop zip openssl \
+  && curl -fsSL https://code-server.dev/install.sh | sh \
   && rm -rf /var/lib/apt/list/*
 
 # mlnx ofed
@@ -20,4 +21,5 @@ RUN cd /tmp && wget http://192.168.16.118/MLNX_OFED_LINUX-5.8-3.0.7.0-ubuntu20.0
 
 # startup
 COPY startup.sh /etc/startup.sh
+COPY code.sh /usr/bin/code.sh
 ENTRYPOINT ["/etc/startup.sh"]
diff --git a/nasp-ubuntu/code.sh b/nasp-ubuntu/code.sh
new file mode 100755
index 0000000..b896353
--- /dev/null
+++ b/nasp-ubuntu/code.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -e
+
+FMT_RED=$(printf '\033[31m')
+FMT_GREEN=$(printf '\033[32m')
+FMT_YELLOW=$(printf '\033[33m')
+FMT_BLUE=$(printf '\033[34m')
+FMT_BOLD=$(printf '\033[1m')
+FMT_RESET=$(printf '\033[0m')
+
+if [[ -d /home2/run && -x $(command -v code-server) ]]; then
+    if ps -ef | grep -v grep | grep -q code-server; then
+        sockpath=$(basename $(grep "socket:" ~/.config/code-server/config.yaml | awk -F' ' '{print $2}') .sock)
+        password=$(grep "password:" ~/.config/code-server/config.yaml | awk -F' ' '{print $2}')
+        echo "${FMT_GREEN}code-server is running${FMT_RESET}"
+        echo "visit: https://proxy.nasp.fit/$(hostname)/$sockpath/"
+        echo "password: $password"
+    else
+        echo "${FMT_RED}code-server is not running${FMT_RESET}"
+    fi
+else
+    echo "${FMT_RED}code-server is not set up${FMT_RESET}"
+fi
diff --git a/nasp-ubuntu/startup.sh b/nasp-ubuntu/startup.sh
index 93657e0..5d7e383 100755
--- a/nasp-ubuntu/startup.sh
+++ b/nasp-ubuntu/startup.sh
@@ -1,5 +1,28 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 
+error() {
+    echo $@
+    return 1
+}
+
 /etc/init.d/ssh start || echo "Failed to start sshd. Maybe the port is already in use, and please check your sshd_config. This is not an error if it's the first time you run this container."
-bash
+if [[ ! -e /root/.config/code-server/config.yaml ]]; then
+    mkdir -p /root/.config/code-server
+    sockname=$(openssl rand -hex 12)
+    test "${#sockname}" = "24" || error "invalid sock name: ${sockname}"
+    password=$(openssl rand -base64 15)
+    test -n "$password" || error "invalid password: ${password}"
+    cat << EOF > /root/.config/code-server/config.yaml
+socket: /home2/run/$sockname.sock
+socket-mode: 777
+auth: password
+password: $password
+cert: false
+EOF
+fi
+if [[ -d /home2/run && -x $(command -v code-server) ]]; then
+    code-server
+else
+    bash
+fi