menu
announcement

Spectrum is now read-only. Learn more about the decision in our official announcement.

Theia

Eclipse Theia - Cloud & Desktop IDE

Channels
Team

Is Theia multi-tenant in any way?

March 26, 2019 at 8:06pm

Is Theia multi-tenant in any way?

March 26, 2019 at 8:06pm

March 27, 2019 at 4:49am
Theia can server multiple clients. Each client gets own running instances of language servers, VS Code extensions with own state of dirty editors and so on. But at the same time several clients using the same backend will see each other processes like terminals, debug sessions and so on. If you don't want such sharing you will need to give each client own backend what products like Gitpod, Google Cloud Shell or Eclpise Che do.

March 28, 2019 at 10:25am
also consider that Theia is meant to be use to produce desktop application as well as Cloud applications. On the desktop (Electron) it's assumed that the user has already authenticated and will have exclusive use of this application.
Edited
So what we have is the smallest common denominator to satisfy both those use-cases.
Thanks Anton and Marc. Let me be less vague.
I am evaluating how to use Theia as a potential framework for a multi-tenant web code editor. As such I am comparing it to how other web-based code editors, like GitPod, Coder, Che, are doing it. The current requirement is for both soft multi-tenancy (users from the same trusted company) and hard multi-tenancy (users from the different companies). The degree of isolation is different for each.
At this point, I am trying to figure out how much of our tenancy requirements can be accomplished with just Theia ( the source at https://github.com/theia-ide/theia ). So I'd like to understand a bit more about Theia's webserver.
What requirements does Theia's webserver fulfill (and what it doesn't)? / What was it built to accomplish?
And to follow up on that question, to support our multi-tenancy requirements, if I'm going to need to:
  1. Replace it with our own?
  2. Augment it with BackendApplicationContributions?
  3. Build a wrapper around each instance of Theia (like what Anton suggested)?
If anyone else is using Theia this way ( soft and hard multi-tenancy ) and are willing and able to share what they are doing, that would be appreciated too!

March 29, 2019 at 10:38am
Hi . As far as I understand, the built-in web server is used (only?) to serve the frontend application in vanilla Theia. Using option 2, you should be able to make it do more, with your own contribution(s).
Here's an old issue with some interesting information, that could maybe help you: https://github.com/theia-ide/theia/issues/411
Alternatively, you can use strategy #3 and so have each instance of Theia serve only one user; then the multi-tenancy would be implemented in the "wrapper" layer above. So far this seems to be the popular way to go.

March 29, 2019 at 4:58pm
What requirements does Theia's webserver fulfill (and what it doesn't)? / What was it built to accomplish?
Theia's backend first dispatch the frontend (html/js files), and then also provide services over Websockets and RPC protocol for the frontend to use.
You can see the backend as a slave to the frontend, as the IDE actually runs in your browser. The backend has as little state as possible, but I wouldn't say that it is stateless.
e.g. The backend allows the frontend to ask for disk content, or anything that would exists on the host and that the IDE would need to access. edit: Another important example: The backend also makes the bridge frontend <--(websocket)--> backend <--(stdio)--> processes. As stated, the IDE lives in the frontend, but the language servers live on the backend's host, hence the bridge.
Edited
Replacing the backend is possible on paper, but not sure about it being actually viable. We do declare the JSON-RPC "protocol" in files under <package>/src/common/*-protocol.ts, but I wonder if just providing a service answering all of these definitions would be enough to have a different backend (say one written in C++ for instance).
Edited
Now about contributing express middlewares, it would certainly allow you to auth the users before accessing the app, but not sure how proper user restriction between the different "sessions" would actually work, as most implementations are written with single tenancy in mind?
Edited
I think the simpliest solution is to have one backend instance per user indeed.
Edited
I do appreciate you all taking your time to respond.
The github issue link Marc posted does suggest there's been some experimentation with Option #2 in the community. I'm hoping someone can share their experience with that approach vs #3.

March 30, 2019 at 12:19pm
https://github.com/theia-ide/theia/issues/411 seems to be about authentication, not about isolation of a user access on backend to underlying filesystem, OS resources like processes, git and so on. It probably can be done to some extent by rebinding Theia services like FileSystem and restricting access based on user token or something like that. But, for example, any Theia/VS Code extension on backend can use Node.js (or other runtime via child processes) for filesystem access. How you can restrict access via such runtimes, replacing Node.js?
It's easier to solve the issue of isolated environments outside of Theia (so it works for all runtimes) and then deploy Theia in such env depending on a case, i.e. for soft multi-tenancy it could be ok to deploy in the same env, if users are fine to share os resources and filesystem. For hard multi-tenancy, it's better to give each user own env.
like-fill
2

June 16, 2019 at 3:48pm
So what exactly are the user-experience effects of sharing a backend if language servers are replicated for each user. I noticed that preferences were changing underneath us when colleagues and I were concurrently accessing the Theia instance. That seems easily fixable by swapping some service in the container I presume, so get it from a The filesystem is shared, but we are intending to swap the backend service out for a code repo REST service, running in our cloud. Not sure how much we can reuse , and how we pass the authentication token to our new backend file system service, yet, but seems solvable. Other than this, I couldn't obviously see anything weird and annoying. Granted we didn't get much time.
I'm trying to establish what else would change underneath users resulting in bad user experience of sharing same theia backend? You say terminals are shared. Would terminals in one client popup in another client?
Edited

June 17, 2019 at 7:17am
Would terminals in one client popup in another client?
It should not.
Generally the primary use case was so far that each user has own backend and shares it only for collaborative work. I.e. we plan to allow seeing all debug sessions and so on. Sounds like you would prefer to avoid such features.
like-fill
1

June 18, 2019 at 10:30am
I'm trying to establish what else would change underneath users resulting in bad user experience of sharing same theia backend?
Generally, any settings that are set by the "backend" user (the user that started the Theia backend). If each client of that backend has their own workspace(s) and do not use each-other's, that leaves the setting in the user's home: ~/.theia/ and/or ~/.vscode/ . Under there can be: preferences, tasks, history of previously used workspaces, including the most recent one, that can be used as a default when a client connects to the backend.
That’s great info. Thanks

June 28, 2019 at 11:01am
Hi , so is it possible to change where the preferences are stored easily? I can see they are stored in the user's home. Is it possible to make them stored in ${workspace}/.theia ?
OK I created .theia in the workspace and its being picked up.
just as an FYI, Theia supports user, workspace and also folder level preferences (if the workspace currently is a multi-root) :)
like-fill
2