kasm

1.19.0-ls154

kasm Workspaces is a docker container streaming platform for delivering browser-based access to desktops, applications, and web services. Kasm uses devops-enabled Containerized Desktop Infrastructure (CDI) to create on-demand, disposable, docker containers that are accessible via web browser. Example use-cases include Remote Browser Isolation (RBI), Data Loss Prevention (DLP), Desktop as a Service (DaaS), Secure Remote Access Services (RAS), and Open Source Intelligence (OSINT) collections. The rendering of the graphical-based containers is powered by the open-source project KasmVNC.

docker pull lscr.io/linuxserver/kasm:latest

Quick start

Generated from the image's own configuration. Replace the /path/to folders with real paths on your host.

Include optional settings

---
services:
  kasm:
    image: lscr.io/linuxserver/kasm:latest
    container_name: kasm
    privileged: true
    security_opt:
      - apparmor:rootlesskit # optional
    environment:
      - KASM_PORT=443
      - DOCKER_HUB_USERNAME=USER # optional
      - DOCKER_HUB_PASSWORD=PASS # optional
      - DOCKER_MTU=1500 # optional
    volumes:
      - /path/to/kasm/data:/opt
      - /path/to/kasm/profiles:/profiles # optional
      - /dev/input:/dev/input # optional
      - /run/udev/data:/run/udev/data # optional
    ports:
      - 3000:3000
      - 443:443
    stop_grace_period: 90s # optional
    restart: unless-stopped

Parameters

Ports
Port	Function	Required
3000:3000	Kasm Installation wizard. (https)	required
443:443	Kasm Workspaces interface. (https)	required

Environment variables
Variable	Function	Required
KASM_PORT=443	Specify the port you bind to the outside for Kasm Workspaces.	required
DOCKER_HUB_USERNAME=USER	Optionally specify a DockerHub Username to pull private images.	optional
DOCKER_HUB_PASSWORD=PASS	Optionally specify a DockerHub password to pull private images.	optional
DOCKER_MTU=1500	Optionally specify the mtu options passed to dockerd.	optional

Volumes
Path	Function	Required
/opt	Docker and installation storage.	required
/profiles	Optionally specify a path for persistent profile storage.	optional
/dev/input	Optional for gamepad support.	optional
/run/udev/data	Optional for gamepad support.	optional

Other settings
Setting	Function	Required
security_opt: apparmor:rootlesskit	Some hosts require this on top of privileged for namespacing to work properly inside the DinD layer.	optional
stop_grace_period: 90s	Increase container shutdown delay to give Kasm services time to stop cleanly.	optional
privileged: true	Needs privileged mode.	required

Architectures

Pulling :latest picks the right one for your host automatically.

x86_64amd64-latest
arm64arm64v8-latest

Changelog

7 Aug 2026
Fix NVIDIA passthrough to Workspace containers by generating a CDI specification inside the DinD layer.
4 Aug 2026
Give kasm_manager a healthcheck start period so a cold start does not leave kasm_proxy created but never started.
16 Apr 2026
Update for 1.18.1 release. Use rolling service images. Bump docker to v29.

Browse all

sealskin

0.4.0-ls64

Sealskin is a self-hosted browser isolation and remote application streaming platform. It runs desktop applications in isolated containers on a server you control and streams them to any browser or phone. Clients include a browser extension, mobile apps, and a web app served by the server itself. Each turns links, files, downloads, and text selections into something you open remotely instead of locally, so nothing from the web runs on the device in front of you.

48.9K133arm64

webtop

3d3463cb-ls321

webtop - Alpine, Ubuntu, Fedora, and Arch based containers containing full desktop environments in officially supported flavors accessible via any modern web browser.

1.6M4.4Karm64

rustdesk

1.5.0-ls130

RustDesk is a full-featured open source remote control alternative for self-hosting and security with minimal configuration.

566K67arm64

netbox

v4.7.3-ls387

netbox is an IP address management (IPAM) and data center infrastructure management (DCIM) tool. Initially conceived by the network engineering team at DigitalOcean, NetBox was developed specifically to address the needs of network and infrastructure engineers. It is intended to function as a domain-specific source of truth for network operations.

91.8K129arm64