diff --git a/README.md b/README.md
index 4b22e75..bfe3c13 100644
--- a/README.md
+++ b/README.md
@@ -55,6 +55,7 @@ Each links to its own README for variables, ports, and storage.
 | --- | --- |
 | [alloy](alloy/README.md) | Grafana Alloy shipping host and Docker telemetry to Grafana Cloud |
 | [code-server](code-server/README.md) | VS Code in the browser, as a remote dev box |
+| [code-server-base](code-server-base/README.md) | VS Code in the browser, stock image with no mods |
 | [couchbase](couchbase/README.md) | Couchbase Server |
 | [gitea-mirror-local](gitea-mirror-local/README.md) | Gitea + PostgreSQL + gitea-mirror, mirroring GitHub repos |
 | [netdata](netdata/README.md) | Netdata monitoring agent |
diff --git a/code-server-base/.env.example b/code-server-base/.env.example
new file mode 100644
index 0000000..772a431
--- /dev/null
+++ b/code-server-base/.env.example
@@ -0,0 +1,9 @@
+# Copy to .env and fill in. Never commit .env.
+#
+#   cp .env.example .env
+
+# Web UI login password. MUST NOT be blank -- the LinuxServer image serves
+# code-server without authentication when PASSWORD is empty.
+# Also used for SUDO_PASSWORD inside the container.
+# Generate one with: openssl rand -base64 24
+PASSWORD=
diff --git a/code-server-base/README.md b/code-server-base/README.md
new file mode 100644
index 0000000..2d9643f
--- /dev/null
+++ b/code-server-base/README.md
@@ -0,0 +1,42 @@
+# code-server-base
+
+[VS Code in the browser](https://github.com/linuxserver/docker-code-server),
+from the LinuxServer image, stock.
+
+The starting point for a new code-server instance: the image as it ships, with
+no mods and no extra packages. Only a password, a timezone, and a workspace
+path are set. Copy the directory and add `DOCKER_MODS` / `INSTALL_PACKAGES` to
+build a kitted-out box — [code-server](../code-server/README.md) is that same
+image with Go, Node.js, Python, and a pile of CLI tools layered on.
+
+Both use a volume named `code-server-config`, but Compose namespaces volumes by
+project and the project is named after the directory, so the two instances stay
+independent.
+
+## Environment
+
+| Variable | Purpose |
+| --- | --- |
+| `PASSWORD` | Web UI login, also the in-container sudo password. **A blank value disables authentication entirely.** |
+
+Generate a password with `openssl rand -base64 24`.
+
+`PUID`/`PGID` are pinned to `1000` and `TZ` to `Asia/Ho_Chi_Minh` in the
+compose file — the first user on my hosts, and my timezone. Change them in
+place if neither holds.
+
+The upstream example also offers `HASHED_PASSWORD`, `SUDO_PASSWORD_HASH`, and
+`PROXY_DOMAIN`. The hash variants are left out because the plaintext ones
+already come from a gitignored `.env`, and `PROXY_DOMAIN` because Coolify and
+Dokploy terminate the domain at their own proxy.
+
+## Networking
+
+Listens on `8443`. No ports are published — point the domain at that port in
+Coolify or Dokploy. See the [root README](../README.md) for why.
+
+## Storage
+
+Everything lives in the `code-server-config` named volume mounted at `/config`;
+the default workspace is `/config/workspace`. Removing the volume wipes your
+files, settings, and extensions.
diff --git a/code-server-base/compose.yml b/code-server-base/compose.yml
new file mode 100644
index 0000000..0b738a7
--- /dev/null
+++ b/code-server-base/compose.yml
@@ -0,0 +1,15 @@
+services:
+  code-server:
+    image: 'lscr.io/linuxserver/code-server:latest'
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=Asia/Ho_Chi_Minh
+      - DEFAULT_WORKSPACE=/config/workspace
+      - PWA_APPNAME=code-server
+      - PASSWORD=${PASSWORD}
+      - SUDO_PASSWORD=${PASSWORD}
+    volumes:
+      - 'code-server-config:/config'
+volumes:
+  code-server-config: