Add app: Kasm-style streamed desktop/browser (KasmVNC) — research + recommended path

[pofallon]

Researched whether Kasm can run in a Hola environment. Short version: the full Kasm Workspaces platform is not a fit, but a single KasmVNC streamed desktop/app is — and there's a path that works with today's server (no Hola changes) plus an optional follow-up for the official images.

What's feasible

✅ Recommended: a single KasmVNC desktop/app via the LinuxServer images

linuxserver/webtop (and friends: linuxserver/chromium, linuxserver/firefox, …) use Kasm's KasmVNC tech and crucially serve HTTP on port 3000 (HTTPS on 3001). Hola's router emits http://<service>:<port> backends (packages/server/src/services/core/routing.ts), and Traefik terminates real TLS at the edge — so the browser still gets HTTPS at https://<app>.<base> (WebCodecs/clipboard etc. work) even though the Traefik→container hop is HTTP. This deploys through the normal pipeline today.

Packaging notes

• Pinned image, expose: 3000 only (no host ports), data under ${HOLA_APP_DATA} (/config).
• shm_size: "1gb" (or 2gb) — required for browsers/desktops.
• Possibly security_opt: [seccomp=unconfined] for GUI apps on older kernels (test; prefer not to relax if unneeded).
• KasmVNC uses websockets — Traefik passes them; confirm no buffering issues.
• Do NOT enable the image's optional Docker-in-Docker (--privileged).
• Ingress: service on port 3000.

Auth — mandatory gate. These images ship no auth by default and include passwordless sudo (root in the container). So:

• auth.mode: forward-auth is required, restricted to hola-admins if the provisioner can express it.
• It's a full desktop with internet egress and root — treat it like code-server (a remote-exec surface). Loud README warning.

⚠️ Optional follow-up: the official kasmweb/* images

The official images (kasmweb/desktop, kasmweb/chrome, …) serve HTTPS-only on :6901 with a self-signed cert. Hola's router only emits http:// backends, so it can't reach an HTTPS backend today. Supporting them needs a small server change in try-hola/hola: let a manifest declare an https backend scheme so routing emits https://… + a Traefik serversTransport with insecureSkipVerify for the self-signed cert. Until then, prefer the LinuxServer path above. (Happy to file that server issue if we want official-image support.)

❌ Not feasible: the full Kasm Workspaces platform

Deploying the orchestrator product (linuxserver/kasm / the official installer) as a Hola catalog app conflicts with the platform model on multiple axes:

• requires privileged + Docker-in-Docker (Hola apps are unprivileged, no-new-privileges);
• wants host ports (443 web + 3000 setup wizard; inside/outside must match) — the validator rejects host ports;
• runs its own reverse proxy and terminates its own TLS — conflicts with Traefik-only ingress;
• its agent spawns disposable session containers (CDI) that it proxies itself — they never join the hola network or get Traefik routes, so it's effectively a second orchestrator inside Hola, not a single compose stack;
• install is a multi-step script, not a clean compose up.

It can run on the same host standalone, but not as a managed Hola app without breaking the security + ingress + single-stack invariants. Recommend we don't pursue it.

Open questions

• Which KasmVNC image(s) to ship first — a Linux desktop (webtop) vs a disposable browser (chromium/firefox) for browser isolation. Leaning one desktop + one browser.
• Confirm seccomp=unconfined is actually needed on our target kernels before relaxing it.
• File the companion hola routing change to unlock official kasmweb/* images?

How to add it (see repo README)

1. ./bin/create-package.sh webtop (or chosen image) → edit src/<name>/src/{compose.yaml,manifest.json} (expose: 3000, shm_size, auth.mode: forward-auth).
2. Add icons/<name>.svg.
3. ./bin/push-oci-package.sh <name> then ./bin/build-catalog.sh.

Acceptance

• Installs, healthy at https://<app>.<base>, reachable only through the Authentik forward-auth gate, the streamed desktop/app + clipboard work over websockets, and /config persists across a restart.

🤖 Generated with Claude Code

[pofallon]

Concrete first target: a "Ubuntu Desktop" app. Use linuxserver/webtop with an Ubuntu flavor (e.g. ubuntu-xfce or ubuntu-kde) — a full Linux desktop streamed to the browser via KasmVNC on HTTP :3000, so it routes through Hola today and Traefik gives the browser HTTPS at https://<name>.<base>. Package per the notes above (shm_size, maybe seccomp=unconfined, /config under ${HOLA_APP_DATA}, mandatory forward-auth).

Two desktop-specific caveats to document:

• Single-tenant/persistent — one shared desktop per install (not per-user disposable sessions; that part is unique to full Kasm Workspaces).
• System changes outside /config don't survive a container recreate (e.g. on hola update); apt installs into the base image are lost. Persist under /config or ship a derived image.

Depends on multi-instance support: the desktop's main use case is running several copies for different tasks, which Hola can't do yet (one install per app today). Tracked in try-hola/hola#246 — once that lands, a user can spin up research.<base>, build.<base>, etc. from the same Ubuntu Desktop app. Worth shipping this app and #246 together.

[pofallon]

Split the concrete, shippable desktop out into its own issue: #34 (Add app: Ubuntu Desktop — webtop / KasmVNC). This issue (#32) stays as the broader KasmVNC research/umbrella; #34 is the first shippable app and carries the multiInstance: true + try-hola/hola#246 dependency.