VSCodium gives you the VS Code editor built from the same MIT-licensed source, without Microsoft’s telemetry, branding or product license. Keybindings, settings and the workspace layout are the ones you already know, so switching costs you a package install. What has aged badly is the install advice most pages still carry. It pipes the signing key into apt-key, which Ubuntu 26.04 no longer ships, so the very first command fails with sudo: 'apt-key': command not found.
Below is one way to install VSCodium that worked unchanged on all three distros, a dedicated keyring file plus a deb822 .sources entry for the VSCodium apt repository. You will also see what the install pulls in per system and how extensions behave when the store is Open VSX instead of Microsoft’s marketplace. The repository and install steps were run in October 2026 against VSCodium 1.140.06880 on Ubuntu 26.04, Debian 13 and Linux Mint 22.3. The editor and extension steps ran on Ubuntu 26.04 only, and Debian ran as root with no GUI.
Why the old apt-key steps fail
Older guides import the repository key with apt-key add, which dropped the key into a global trust store that every repository on the machine could use. Debian and Ubuntu deprecated that model years ago, and on current releases it either breaks outright or keeps working with a warning, depending on which apt your distro ships. We ran the old command on two of the three lab machines, and they gave two different results.
sudo: ‘apt-key’: command not found
Ubuntu 26.04 prints this when you paste the old key import, because the apt-key binary is gone from the release. The pipe fails with exit code 1, nothing is imported, and every later apt update against the repository would fail its signature check. Nothing on the box needs fixing, so skip the old line and follow the keyring steps below. The failed run looked like this.
sudo: 'apt-key': command not found
rc=1Debian 13 has no apt-key either: which found no such binary in our Debian container, so the old line has nothing to run there. That leaves Mint as the only system in the lab where the old method still appeared to work.
Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead
Linux Mint 22.3 sits on the Ubuntu 24.04 (noble) base, and that apt still includes apt-key. The old command succeeds there, but only after printing a deprecation warning.
Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).
OKDo not trust that OK. The key lands in the shared /etc/apt/trusted.gpg file, so it is trusted for every repository on the machine, and the same command will break the day Mint moves to a base without apt-key. We removed it from the lab VM and used the keyring method instead. If you already ran the old line, the apt-key deprecation fix shows how to move a key out of the legacy store.
Check the prerequisites
VSCodium is a desktop application, so you need a graphical session to use it, even though every install step runs in a terminal. The repository publishes builds for two architectures, and a minimal Debian image is missing two tools the key import needs. Before you start, have these in place:
- Ubuntu 26.04, Debian 13 or Linux Mint 22
- An amd64 or arm64 machine
- A user with sudo rights
wgetandgpgfor the key import- A desktop session to run the editor
Ubuntu and Mint desktops already have wget and gpg. Our Debian 13 container had only curl, so on a minimal Debian install add both packages before you continue.
sudo apt-get update
sudo apt-get install -y wget gpgIf you work as root on Debian and sudo is not installed, drop the sudo prefix from every command in this guide. That’s how the Debian test ran.
Add the VSCodium signing key
Apt checks the repository against the key its maintainer publishes on GitLab. You convert it to binary form with gpg --dearmor and write it to its own file under /usr/share/keyrings, so apt trusts it only for the VSCodium source and not for anything else on the machine:
wget -qO - https://gitlab.com/paulcarroty/vscodium-deb-rpm-repo/raw/master/pub.gpg | gpg --dearmor | sudo dd of=/usr/share/keyrings/vscodium-archive-keyring.gpg 2>/dev/nullConfirm the keyring was written before you go further, because every later step depends on that one file being correct.
ls -l /usr/share/keyrings/vscodium-archive-keyring.gpgOurs was 2256 bytes and owned by root. The real test is that the file is not empty: a zero-byte file means the download failed, usually because wget or gpg is missing, so fix that and run the import again before you add the source. Ours looked like this.
-rw-r--r-- 1 root root 2256 Oct 21 10:14 /usr/share/keyrings/vscodium-archive-keyring.gpgThe keyring holds only this one key, so removing VSCodium later means deleting this file and the source file, with nothing left behind in a shared trust store.
Add the VSCodium repository
A deb822 source puts the repository URL, suite, architectures and the key it trusts in one file. That Signed-By line is what ties the source to the keyring you just wrote. The same file works on all three distros because the suite is vscodium, not a distro codename. Open a new source file with vim.
sudo vim /etc/apt/sources.list.d/vscodium.sourcesPaste these six lines exactly. Field names are case-insensitive, and a misspelled required field makes apt fail loudly, but a misspelled Signed-By is silently ignored and only surfaces later as a NO_PUBKEY error, so copy the lines rather than retyping them.
Types: deb
URIs: https://download.vscodium.com/debs
Suites: vscodium
Components: main
Architectures: amd64 arm64
Signed-By: /usr/share/keyrings/vscodium-archive-keyring.gpgSave the file and refresh the package index. Apt only learns that the codium package exists after this fetch, so skipping it leaves the install step with nothing to find.
sudo apt-get updateAmong the usual distro lines you should see three from download.vscodium.com: the signed InRelease file and one Packages index per architecture. A NO_PUBKEY or not signed error here points back at the keyring path in Signed-By.
Get:4 https://download.vscodium.com/debs vscodium InRelease
Get:5 https://download.vscodium.com/debs vscodium/main amd64 Packages [1011 B]
Get:6 https://download.vscodium.com/debs vscodium/main arm64 Packages [1005 B]Check that apt now sees a candidate version for the codium package. An empty candidate means the source file was not picked up.
apt-cache policy codium | head -3Apt offered the latest VSCodium release, and it matched the newest tag on the VSCodium GitHub releases page on the day we tested.
codium:
Installed: (none)
Candidate: 1.140.06880With a candidate showing, the repository side is done and the same three files sit on every machine: the keyring, the source and the refreshed package lists. Nothing so far was specific to Ubuntu, Debian or Mint, which is the point of using the deb822 file.
Install VSCodium on Ubuntu, Debian and Linux Mint
VSCodium’s package name is codium, and the install command is identical on all three systems. Apt resolves the GUI libraries the editor needs on its own, so there is nothing else to name on the command line.
sudo apt-get install -y codiumOn the Ubuntu 26.04 VM, which already had an Xfce desktop, apt pulled in 44 packages and took about 41 seconds.
0 upgraded, 44 newly installed, 0 to remove and 4 not upgraded.
Need to get 153 MB of archives.
After this operation, 636 MB of additional disk space will be used.
Setting up codium (1.140.06880) ...What the install costs depends on how much of a desktop stack is already present, and the three lab machines started from very different places.
| System | New packages | Download | Disk used | Install time |
|---|---|---|---|---|
| Ubuntu 26.04 with Xfce | 44 | 153 MB | 636 MB | 41 s |
| Linux Mint 22.3 Cinnamon | 2 | 151 MB | 628 MB | 37 s |
| Debian 13 minimal container | 184 | 260 MB | 1135 MB | not timed |
Mint needed only VSCodium and one dependency, because Cinnamon already ships the GTK and X libraries the editor links against. The minimal Debian image had none of them. Apt added 184 packages there and nearly doubled the disk cost. A normal Debian desktop should land close to the Ubuntu and Mint numbers. On a headless server you pay for the full GTK stack and still can’t display the editor, which is a good reason to use VS Code in the browser on servers instead.
Check the installed version from the same terminal. The command needs no display, which is why it worked for us over a plain SSH session.
codium --versionYou get the release, the commit it was built from and the architecture. If the shell says codium is not found, the install did not finish, so rerun the apt command and read its last lines.
1.140.06880
807ba2d6075c29587f884698cd7370c81ab0724c
x64Updates arrive with the rest of your system through sudo apt update && sudo apt upgrade, which is the main reason we’d pick the repository. The GitHub releases page also carries a codium_<version>_amd64.deb, and we confirmed that asset exists for the current release. We did not install it, though, and a .deb installed by hand never updates itself, so it only makes sense on a machine that can’t reach the repository. The repo held a single version during our test, so we never saw an upgrade happen, and we did not test the Flatpak or Snap builds either. How those formats compare with apt on a current release is covered in the apt, Snap and Flatpak guide.
Launch VSCodium
The package installs a desktop entry (com.visualstudio.CodeOSS.desktop), so VSCodium shows up in the application menu, although we launched it from the CLI in the lab. It keeps the upstream Code OSS file names, which matters if you look for them later:
/usr/share/codium/bin/codium, the binary behind thecodiumcommandcom.visualstudio.CodeOSS.desktop, the menu launchercom.visualstudio.CodeOSS.UrlHandler.desktop, the URL handler
From a terminal inside your desktop session you can also open a project folder directly. Point it at your own project, or create the folder first if it does not exist yet. The screenshots below show a small ~/demo folder opened the same way.
codium ~/projects/myappHere it is on the Ubuntu 26.04 Xfce desktop with a Docker compose.yaml open. The schema hint above line 1 comes from the Red Hat YAML extension installed from Open VSX later in this guide.
The grey banner across the top and the blue Restricted Mode badge in the status bar mean the folder is not trusted yet, and VSCodium does this for any folder you have not marked as trusted. It blocks tasks, debugging and some extension features until you click Manage and trust the folder. Do that for your own projects, and leave it on for code you just cloned from somewhere you do not know.
On Linux Mint 22.3 Cinnamon the same build looks identical, apart from the window decorations and the Mint panel. There is no schema hint above line 1 here, because the YAML extension was only installed on the Ubuntu VM. The status bar still reads Compose, so that language mode is built in and needs no extension.
If you came from Microsoft’s build, your Git clone workflow from VS Code works the same way here, since the Source Control view is part of the open source core. Git itself still comes from your distro, so install the git package if the view reports that it cannot find Git.
You are trying to start VSCodium as a super user which isn’t recommended
VSCodium refuses to run as root. We hit this in the Debian container, where every command ran as root, and adding --no-sandbox on its own was not enough:
codium --version --no-sandboxIt still printed the full refusal, because the message asks for an alternate user data directory as well.
You are trying to start VSCodium as a super user which isn't recommended. If this was intended, please add the argument `--no-sandbox` and specify an alternate user data directory using the `--user-data-dir` argument.Run the editor as your normal user and keep sudo for the install only. Running it as root needs both --no-sandbox and --user-data-dir, and the first of those switches off Chromium’s renderer sandbox, which is not a protection you want to drop in an editor that runs third-party extensions. The package installed fine as root (dpkg reported codium as ii), so this message never means the install failed.
Extensions: Open VSX vs the Microsoft marketplace
VSCodium installs extensions from Open VSX, the open registry run under the Eclipse Foundation, not from Microsoft’s Visual Studio Marketplace. Most popular open source extensions are published to both, but Microsoft’s own closed extensions are not, and that is the one real difference you notice day to day. The gallery is set in the product.json file shipped with the package.
grep -o "\"serviceUrl\": *\"[^\"]*\"" /usr/share/codium/resources/app/product.jsonOn the Ubuntu VM it pointed at the Open VSX gallery API, which is the default every VSCodium package ships with. Nothing in the install changes it.
"serviceUrl": "https://open-vsx.org/vscode/gallery"Extensions install from the Extensions view (Ctrl+Shift+X) or from the command line with the full publisher.name ID. Red Hat’s YAML extension is on Open VSX, so this works the same as it would in VS Code.
codium --install-extension redhat.vscode-yamlOnce the download finishes, the installer confirms the version it fetched. The ID is the same one you would use in VS Code, so a list of extension IDs from an old machine carries over as long as each one exists on Open VSX.
Installing extension 'redhat.vscode-yaml'...
Extension 'redhat.vscode-yaml' v2.0.0 was successfully installed.Most of the language and formatting extensions you use in VS Code install this way without a second thought. The gap shows up with Microsoft’s own extensions.
Extension ‘ms-vscode-remote.remote-ssh’ not found
VSCodium prints this error when you ask for an extension that exists only on Microsoft’s marketplace. Remote-SSH is the one people miss most, and installing it by its usual ID fails.
codium --install-extension ms-vscode-remote.remote-sshIgnore the Node url.parse() DeprecationWarning that prints first, because it’s a harmless notice from the bundled Node runtime and not the error. The line that matters comes after it.
Installing extensions...
(node:3104) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
(Use `codium --trace-deprecation ...` to show where the warning was created)
Extension 'ms-vscode-remote.remote-ssh' not found.After that line, the run closes with a hint to use the full extension ID, including the publisher, and Failed Installing Extensions: ms-vscode-remote.remote-ssh. That hint is a red herring, since the ID is correct. Asking the Open VSX API directly shows the real reason, which is that Microsoft never published the extension there.
curl -s "https://open-vsx.org/api/ms-vscode-remote/remote-ssh"Open VSX answers with a plain not-found and marks the ID as not downloadable. There is no alternate ID to try, so the way forward is a different extension.
{"deprecated":false,"downloadable":false,"error":"Extension not found: ms-vscode-remote.remote-ssh"}For an open source substitute, use Open Remote SSH by jeanp413. It is published on Open VSX and covers the same job of editing files on a remote host over SSH.
codium --install-extension jeanp413.open-remote-sshOur install went through cleanly, and listing extensions shows both of the ones added in this guide.
codium --list-extensions --show-versionsEach extension prints with its installed version, which is the quickest way to audit a machine. Pipe that list into a file and you have the input for setting up the next workstation.
[email protected]
[email protected]The terminal capture below shows the whole sequence on the Ubuntu VM, from the version check to the substitute in place.
In the Extensions view, searching for remote ssh returns only Open VSX entries. The first result is Remote SSH by jajera, and Open Remote SSH from jeanp413 comes second, greyed out with a shield icon because Restricted Mode disables it in an untrusted folder.
The substitute stays disabled until you trust the folder. We installed it but did not connect it to a remote host in this lab, so treat it as the extension to try rather than a tested drop-in.
You can point product.json at Microsoft’s gallery and get the full catalogue back. VSCodium’s own extensions documentation notes that Microsoft prohibits its marketplace from being used by other products, so that switch breaks the terms you’d be agreeing to, and we did not test it. If an extension you depend on exists only on the Microsoft marketplace and has no Open VSX equivalent, run Microsoft’s build for that work instead: the VS Code install on Ubuntu and the Linux Mint version cover it. For everything else on Open VSX, VSCodium does the same job without the telemetry.
