[mfro]

FWIW VScode can be used in a docker container or remote server from the local client. See devcontainers and VSCode over ssh.

[jon-wood]

At least some of your extensions will still run in the client editor instance, not on the server side. That limits exposure a bit but when colour themes have been known attack vectors in VSCode it’s far from a panacea.