Restricting the permitted VSCode extensions

[mtwest2718]

At my work, we are using https://openondemand.org/ to run instances of code-server on a slurm batch system and I would like to know what the community's prefer methods for restricting which VSCode extensions a user can install &/or use within their instance are. Given the proliferation of supply chain attacks targeting things on the VSX marketplace, I would prefer to limit our exposure as much as possible from the jump.

[code-asher]

The first thing that comes to my mind is hosting your own marketplace so you can choose which extensions are available.

Something like https://github.com/coder/code-marketplace/ or https://github.com/eclipse/openvsx or https://github.com/LOLINTERNETZ/vscodeoffline (I have not used the last one myself but the sync looks interesting).

The only other thing that comes to mind is to administer via policy, but I think this only works with native VS Code on Windows. https://code.visualstudio.com/docs/setup/enterprise#_configure-allowed-extensions

Although, nothing would stop a user from downloading an extension and installing it manually I suppose.