diff --git a/src/code-server/README.md b/src/code-server/README.md
index f819a5c..b24bb47 100644
--- a/src/code-server/README.md
+++ b/src/code-server/README.md
@@ -28,6 +28,7 @@ VS Code in the browser
 | disableWorkspaceTrust | Disable Workspace Trust feature. This only affects the current session. | boolean | false |
 | extensions | Comma-separated list of VS Code extensions to install. Format: 'publisher.extension[@version]' (e.g., 'ms-python.python,ms-azuretools.vscode-docker'). | string | - |
 | host | The address to bind to for the code-server. Use '0.0.0.0' to listen on all interfaces. | string | 127.0.0.1 |
+| logFile | Path to a file to send stdout and stderr logs to from code-server. | string | /tmp/code-server.log |
 | port | The port to bind to for the code-server. | string | 8080 |
 | socket | Path to a socket. When specified, host and port will be ignored. | string | - |
 | socketMode | File mode of the socket when using the socket option. | string | - |
diff --git a/src/code-server/devcontainer-feature.json b/src/code-server/devcontainer-feature.json
index f23ffbd..abebdcb 100644
--- a/src/code-server/devcontainer-feature.json
+++ b/src/code-server/devcontainer-feature.json
@@ -70,6 +70,11 @@
             "default": "127.0.0.1",
             "description": "The address to bind to for the code-server. Use '0.0.0.0' to listen on all interfaces."
         },
+        "logFile": {
+            "type": "string",
+            "default": "/tmp/code-server.log",
+            "description": "Path to a file to send stdout and stderr logs to from code-server."
+        },
         "port": {
             "type": "string",
             "default": "8080",
diff --git a/src/code-server/install.sh b/src/code-server/install.sh
index af0b767..c621425 100644
--- a/src/code-server/install.sh
+++ b/src/code-server/install.sh
@@ -23,70 +23,69 @@ if [[ -n $WORKSPACE ]]; then
     CODE_SERVER_WORKSPACE="$WORKSPACE"
 fi
 
-DISABLE_FLAGS=()
+FLAGS=()
+FLAGS+=(--auth "$AUTH")
+FLAGS+=(--bind-addr "$HOST:$PORT")
 
 if [[ "$DISABLEFILEDOWNLOADS" == "true" ]]; then
-    DISABLE_FLAGS+=(--disable-file-downloads)
+    FLAGS+=(--disable-file-downloads)
 fi
 
 if [[ "$DISABLEFILEUPLOADS" == "true" ]]; then
-    DISABLE_FLAGS+=(--disable-file-uploads)
+    FLAGS+=(--disable-file-uploads)
 fi
 
 if [[ "$DISABLEGETTINGSTARTEDOVERRIDE" == "true" ]]; then
-    DISABLE_FLAGS+=(--disable-getting-started-override)
+    FLAGS+=(--disable-getting-started-override)
 fi
 
 if [[ "$DISABLEPROXY" == "true" ]]; then
-    DISABLE_FLAGS+=(--disable-proxy)
+    FLAGS+=(--disable-proxy)
 fi
 
 if [[ "$DISABLETELEMETRY" == "true" ]]; then
-    DISABLE_FLAGS+=(--disable-telemetry)
+    FLAGS+=(--disable-telemetry)
 fi
 
 if [[ "$DISABLEUPDATECHECK" == "true" ]]; then
-    DISABLE_FLAGS+=(--disable-update-check)
+    FLAGS+=(--disable-update-check)
 fi
 
 if [[ "$DISABLEWORKSPACETRUST" == "true" ]]; then
-    DISABLE_FLAGS+=(--disable-workspace-trust)
+    FLAGS+=(--disable-workspace-trust)
 fi
 
-CERT_FLAGS=()
-
 if [[ -n "$CERT" ]]; then
-    CERT_FLAGS+=(--cert "$CERT")
+    FLAGS+=(--cert "$CERT")
 fi
 
 if [[ -n "$CERTHOST" ]]; then
-    CERT_FLAGS+=(--cert-host "$CERTHOST")
+    FLAGS+=(--cert-host "$CERTHOST")
 fi
 
 if [[ -n "$CERTKEY" ]]; then
-    CERT_FLAGS+=(--cert-key "$CERTKEY")
+    FLAGS+=(--cert-key "$CERTKEY")
 fi
 
-SOCKET_FLAGS=()
-
 if [[ -n "$SOCKET" ]]; then
-    SOCKET_FLAGS+=(--socket "$SOCKET")
+    FLAGS+=(--socket "$SOCKET")
 fi
 
 if [[ -n "$SOCKETMODE" ]]; then
-    SOCKET_FLAGS+=(--socket-mode "$SOCKETMODE")
+    FLAGS+=(--socket-mode "$SOCKETMODE")
 fi
 
-cat > /usr/local/bin/code-server-entrypoint \
-<< EOF
+cat > /usr/local/bin/code-server-entrypoint <<EOF
 #!/usr/bin/env bash
 set -e
 
-$(declare -p DISABLE_FLAGS)
-$(declare -p CERT_FLAGS)
-$(declare -p SOCKET_FLAGS)
+if [[ \$(whoami) != "$_REMOTE_USER" ]]; then
+	exec su $_REMOTE_USER -c /usr/local/bin/code-server-entrypoint
+fi
+
+$(declare -p FLAGS)
 
-su $_REMOTE_USER -c 'code-server --auth "$AUTH" --bind-addr "$HOST:$PORT" "\${DISABLE_FLAGS[@]}" "\${CERT_FLAGS[@]}" "\${SOCKET_FLAGS[@]}" "$CODE_SERVER_WORKSPACE"'
+code-server "\${FLAGS[@]}" "$CODE_SERVER_WORKSPACE" >"$LOGFILE" 2>&1
 EOF
 
 chmod +x /usr/local/bin/code-server-entrypoint
diff --git a/test/code-server/code-server-auth-none.sh b/test/code-server/code-server-auth-none.sh
index 089f594..0707dab 100644
--- a/test/code-server/code-server-auth-none.sh
+++ b/test/code-server/code-server-auth-none.sh
@@ -9,7 +9,7 @@ check "code-server version" code-server --version
 check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
 check "code-server listening" lsof -i "@127.0.0.1:8080"
 
-check "code-server auth" grep $'\'code-server.* --auth "none" .*\'' < /usr/local/bin/code-server-entrypoint
+check "code-server auth" grep '"--auth".*"none"' < /usr/local/bin/code-server-entrypoint
 
 # Report results
 reportResults
diff --git a/test/code-server/code-server-auth-password.sh b/test/code-server/code-server-auth-password.sh
index 6bd1920..1ac2e6d 100644
--- a/test/code-server/code-server-auth-password.sh
+++ b/test/code-server/code-server-auth-password.sh
@@ -9,7 +9,7 @@ check "code-server version" code-server --version
 check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
 check "code-server listening" lsof -i "@127.0.0.1:8080"
 
-check "code-server auth" grep $'\'code-server.* --auth "password" .*\'' < /usr/local/bin/code-server-entrypoint
+check "code-server auth" grep '"--auth".*"password"' < /usr/local/bin/code-server-entrypoint
 
 # Report results
 reportResults
diff --git a/test/code-server/code-server-cert.sh b/test/code-server/code-server-cert.sh
index 14961fe..fd3a5a6 100644
--- a/test/code-server/code-server-cert.sh
+++ b/test/code-server/code-server-cert.sh
@@ -4,15 +4,13 @@ set -e
 # Optional: Import test library bundled with the devcontainer CLI
 source dev-container-features-test-lib
 
-cat /usr/local/bin/code-server-entrypoint
-
 # Feature-specific tests
 check "code-server version" code-server --version
 check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
 check "code-server listening" lsof -i "@127.0.0.1:8080"
 
-check "code-server cert" grep '"--cert".*"/path/to/cert.pem"' < /usr/local/bin/code-server-entrypoint
-check "code-server cert-key" grep '"--cert-key".*"/path/to/key.pem"' < /usr/local/bin/code-server-entrypoint
+check "code-server cert" grep '"--cert".*"/home/vscode/cert.pem"' < /usr/local/bin/code-server-entrypoint
+check "code-server cert-key" grep '"--cert-key".*"/home/vscode/key.pem"' < /usr/local/bin/code-server-entrypoint
 
 # Report results
 reportResults
diff --git a/test/code-server/code-server-cert/Dockerfile b/test/code-server/code-server-cert/Dockerfile
new file mode 100644
index 0000000..4e7868a
--- /dev/null
+++ b/test/code-server/code-server-cert/Dockerfile
@@ -0,0 +1,3 @@
+FROM mcr.microsoft.com/devcontainers/base:ubuntu
+
+RUN su vscode -c "openssl req -x509 -newkey rsa:4096 -keyout /home/vscode/key.pem -out /home/vscode/cert.pem -sha256 -days 1 -nodes -subj \"/C=XX/ST=Texas/L=Austin/O=Coder/OU=Engineering/CN=dev.coder.com\""
diff --git a/test/code-server/code-server-log-file.sh b/test/code-server/code-server-log-file.sh
new file mode 100644
index 0000000..bb382d0
--- /dev/null
+++ b/test/code-server/code-server-log-file.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+set -e
+
+# Optional: Import test library bundled with the devcontainer CLI
+source dev-container-features-test-lib
+
+# Feature-specific tests
+check "code-server version" code-server --version
+check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
+check "code-server listening" lsof -i "@0.0.0.0:8080"
+
+check "code-server log-file" test -f /tmp/code-server-log-file.log
+check "code-server log-file content" grep "HTTP server listening on http://127.0.0.1:8080/" < /tmp/code-server-log-file.log
+
+# Report results
+reportResults
diff --git a/test/code-server/code-server-socket-with-mode.sh b/test/code-server/code-server-socket-with-mode.sh
index 1282cf5..cdf1a9c 100644
--- a/test/code-server/code-server-socket-with-mode.sh
+++ b/test/code-server/code-server-socket-with-mode.sh
@@ -4,15 +4,12 @@ set -e
 # Optional: Import test library bundled with the devcontainer CLI
 source dev-container-features-test-lib
 
-cat /usr/local/bin/code-server-entrypoint
-
 # Feature-specific tests
 check "code-server version" code-server --version
 check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
-check "code-server listening" lsof -i "@127.0.0.1:8080"
 
-check "code-server socket" grep '"--socket".*"/tmp/code-server.sock"' < /usr/local/bin/code-server-entrypoint
-check "code-server socket-mode" grep '"--socket-mode".*"777"' < /usr/local/bin/code-server-entrypoint
+check "code-server socket" test -S /tmp/code-server.sock
+check "code-server socket-mode" grep '0777' <<< $(stat /tmp/code-server.sock)
 
 # Report results
 reportResults
diff --git a/test/code-server/code-server-socket.sh b/test/code-server/code-server-socket.sh
index 8d5aa45..3ef9208 100644
--- a/test/code-server/code-server-socket.sh
+++ b/test/code-server/code-server-socket.sh
@@ -4,14 +4,12 @@ set -e
 # Optional: Import test library bundled with the devcontainer CLI
 source dev-container-features-test-lib
 
-cat /usr/local/bin/code-server-entrypoint
-
 # Feature-specific tests
 check "code-server version" code-server --version
 check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
-check "code-server listening" lsof -i "@127.0.0.1:8080"
 
-check "code-server socket" grep '"--socket".*"/tmp/code-server.sock"' < /usr/local/bin/code-server-entrypoint
+check "code-server socket" test -S /tmp/code-server.sock
+check "code-server socket-mode" grep '0775' <<< $(stat /tmp/code-server.sock)
 
 # Report results
-reportResults
\ No newline at end of file
+reportResults
diff --git a/test/code-server/code-server-workspace.sh b/test/code-server/code-server-workspace.sh
index b57e334..3a911f5 100644
--- a/test/code-server/code-server-workspace.sh
+++ b/test/code-server/code-server-workspace.sh
@@ -9,7 +9,7 @@ check "code-server version" code-server --version
 check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
 check "code-server listening" lsof -i "@127.0.0.1:8080"
 
-check "code-server workspace" grep $'\'code-server.*"/home"\'' < /usr/local/bin/code-server-entrypoint
+check "code-server workspace" grep $'/home' < /usr/local/bin/code-server-entrypoint
 
 # Report results
 reportResults
diff --git a/test/code-server/scenarios.json b/test/code-server/scenarios.json
index 941f4f3..4704e50 100644
--- a/test/code-server/scenarios.json
+++ b/test/code-server/scenarios.json
@@ -126,11 +126,13 @@
         }
     },
     "code-server-cert": {
-        "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
+        "build": {
+            "dockerfile": "Dockerfile"
+        },
         "features": {
             "code-server": {
-                "cert": "/path/to/cert.pem",
-                "certKey": "/path/to/key.pem"
+                "cert": "/home/vscode/cert.pem",
+                "certKey": "/home/vscode/key.pem"
             }
         }
     },
@@ -158,5 +160,13 @@
                 "socketMode": "777"
             }
         }
+    },
+    "code-server-log-file": {
+        "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
+        "features": {
+            "code-server": {
+                "logFile": "/tmp/code-server-log-file.log"
+            }
+        }
     }
 }
diff --git a/test/code-server/test.sh b/test/code-server/test.sh
index b6fc5e4..4d0e664 100644
--- a/test/code-server/test.sh
+++ b/test/code-server/test.sh
@@ -9,5 +9,8 @@ check "code-server version" code-server --version
 check "code-server running" pgrep -f 'code-server/lib/node.*/code-server'
 check "code-server listening" lsof -i "@127.0.0.1:8080"
 
+check "code-server log-file" test -f /tmp/code-server.log
+check "code-server log-file content" grep "HTTP server listening on http://127.0.0.1:8080/" < /tmp/code-server.log
+
 # Report results
 reportResults