Add app: Ubuntu Desktop (webtop / KasmVNC)

[pofallon]

Add a Ubuntu Desktop app — a full Linux desktop streamed to the browser — as a concrete, shippable catalog entry. This is the deliverable spun out of the KasmVNC research umbrella (#32); see that issue for the broader "is Kasm possible in Hola" analysis.

Image

linuxserver/webtop with an Ubuntu flavor (ubuntu-xfce recommended; ubuntu-kde/ubuntu-mate as alternatives). It uses Kasm's KasmVNC and serves HTTP on :3000, so it routes through Hola's http://-only router today (no server change) and Traefik gives the browser HTTPS at https://<name>.<base>.

Hola packaging notes

• Pinned image, expose: 3000 only (no host ports), data under ${HOLA_APP_DATA} (/config = the user home).
• shm_size: "1gb" (2gb for heavier use) — required for browsers/desktops.
• Possibly security_opt: [seccomp=unconfined] for GUI apps on older kernels — test first; don't relax if unneeded.
• KasmVNC uses websockets — Traefik passes them.
• Do not enable the image's optional Docker-in-Docker (--privileged).
• Ingress: service on 3000.

Auth — mandatory gate

Ships no auth by default and includes passwordless sudo (root in the container), so:

• auth.mode: forward-auth is required; restrict to hola-admins where possible.
• Treat it like code-server (Add app: code-server (VS Code in the browser) #31) — a remote-exec surface with internet egress and root.

Desktop-specific caveats (document in the README)

• Single-tenant, persistent — one shared desktop per install (not per-user disposable sessions; that's unique to full Kasm Workspaces).
• System changes outside /config don't survive a container recreate (e.g. on hola update) — apt installs into the base image are lost. Persist under /config or ship a derived image.

Multi-instance

The core use case is running several desktops for different tasks (research.<base>, build.<base>, …). Hola is single-install-per-app today, so this app should declare multiInstance: true once that lands — tracked in try-hola/hola#246. Ship this app and #246 together for the intended experience.

How to add it (see repo README)

1. ./bin/create-package.sh ubuntu-desktop → edit src/ubuntu-desktop/src/{compose.yaml,manifest.json} (expose: 3000, shm_size, auth.mode: forward-auth, multiInstance: true).
2. Add icons/ubuntu-desktop.svg.
3. ./bin/push-oci-package.sh ubuntu-desktop then ./bin/build-catalog.sh.

Acceptance

• Installs, healthy at https://<name>.<base>, reachable only through the Authentik forward-auth gate, the streamed desktop + clipboard work over websockets, and /config persists across a restart.
• Once Support multiple instances of the same catalog app (per-deployment subdomains) hola#246 lands: two installs with different names yield two independent desktops at distinct subdomains.

Umbrella/research: #32. Multi-instance dependency: try-hola/hola#246.

🤖 Generated with Claude Code