Desktop

Any sandbox whose pool image is zondax/kobe-sandbox can run a Linux desktop. The image includes KasmVNC, Openbox, Firefox, and the Tauri 2 Linux prerequisites. Firefox is registered for HTTP and HTTPS, so OAuth opened by a desktop app stays inside that browser. kobe vnc paste still uses x11vnc on the same display.

The desktop does not start until you ask, and you need a pool that uses this image and publishes port 6080. Operators: Images and runner. Callers: Sandbox for lease and SSH.

Start the desktop

kobe lease gui --ttl 4h
kobe exec gui -- kobe-desktop start
kobe exec gui -- kobe-desktop status

kobe-desktop start is idempotent. It runs the supervisor in a dedicated tmux server so the desktop outlives the kobe exec that started it.

kobe exec gui -- kobe-desktop logs
kobe exec gui -- kobe-desktop terminal
kobe exec gui -- kobe-desktop browser
kobe exec gui -- kobe-desktop stop

gui is your lease id or alias.

Open it

In another terminal:

kobe port-forward gui 6080:6080

Then either:

kobe vnc open gui

That opens KasmVNC in the browser (http://127.0.0.1:<port>/). --native is TigerVNC against 5900 if you have vncviewer.

That is a 1440×900 desktop. It starts with a terminal and a blue background. Right-click for Terminal, Browser, and Desktop status. kobe-desktop browser <url> opens Firefox on the desktop to a URL.

Run the project's usual Linux desktop command in another execution, with --cwd /home/agent/work/your-project. Each execution already has DISPLAY=:99, the X11 authority file, and the session D-Bus address.

Clone into /home/agent/work and run mise install there. Project tools come from the project's mise.toml, not from the image.

What is listening

KasmVNC (6080, HTTP) and x11vnc (5900, RFB) bind loopback inside the sandbox. X11 uses a Unix socket with a per-session cookie. You reach the desktop only through Kobe's authorized port-forward. The pool must declare port 6080 (or a range that includes it).

This does not need host networking, privilege escalation, or extra container capabilities.

Stop

kobe-desktop stop stops the managed desktop. Releasing the lease stops it too. Only one desktop can run in a sandbox.