How can I disable the Extension Gallery when making a custom VS Code build?

I need to disable the online extension gallery cause I don't want developers to download any extension that could be potentially dangerous. Is there any simple setting that allow it?

Options:

• I could use the --no-proxy-server option to avoid access to the extension gallery. However some extensions require it.

• I could use a read-only extension folder and the --extensions-dir option. However some extensions need write permissions on that folder.

• I found out that there is a a key called "extensionsGallery" in resources\app\product.json I think I could remove those URLs:

		"nlsBaseUrl": "https://www.vscode-unpkg.net/_lp/",
		"serviceUrl": "https://marketplace.visualstudio.com/_apis/public/gallery",
		"cacheUrl": "https://vscode.blob.core.windows.net/gallery/index",
		"itemUrl": "https://marketplace.visualstudio.com/items",
		"publisherUrl": "https://marketplace.visualstudio.com/publishers",
		"resourceUrlTemplate": "https://{publisher}.vscode-unpkg.net/{publisher}/{name}/{version}/{path}",
		"controlUrl": "https://az764295.vo.msecnd.net/extensions/marketplace.json",
		"recommendationsUrl": "https://az764295.vo.msecnd.net/extensions/workspaceRecommendations.json.gz"

but I'm not sure if I break something important. Is it safe to remove those URLs?

Is there a setting I can just set to avoid installing extensiones freely? I want to build a custom flavored VS Code with some extensions but not allowing users to do everything.

> I want to build a custom flavored VS Code with some extensions but not allowing users to do everything.

Then make a product.json that does that. See also this comment from @chrisdias (a member of the VS Code team).

> I found out that there is a a key called "extensionsGallery" in resources\app\product.json I think I could remove those URLs, but I'm not sure if I break something important. Is it safe to remove those URLs?

The default/template product.json doesn't even have those properties defined, and if you look at VS Code's type definition of IproductConfiguration in src/vs/base/common/product.ts, you'll see that the extensionsGallery property is nullable. If the type definition says the extensionsGallery property can be left out, I think that means it's fine to leave out. The Extensions View will not have any backing service, but users will still be able to install extensions by downloading VSIXes and installing them with code --install-extension.