Self-host sealskin
0.4.0Browser isolation and remote app streaming platform
- Stars
- 154
- Ports
- 8443 (Session proxy server (HTTPS for streamed sessions and API)), 8000 (Main API server (plain HTTP fallback for Chrome with self-signed certificate))
- Requires
- Docker
lscr.io/linuxserver/sealskinWhat is sealskin?
SealSkin is a self-hosted platform for running desktop programs in isolated containers on your own server and streaming them to browsers, phones, and tablets. It isolates web content by opening links and files in fresh containers so nothing executes locally. Any Linux desktop application works — including web browsers, office software, development environments, graphics editors, emulators, and 3D tools — with GPU acceleration. A file manager handles uploads, downloads, and password-protected shares. Collaboration rooms enable shared sessions with chat, voice, video, and input hand-over. Authentication supports OpenID Connect, SAML, and reverse proxy headers with group-based permissions. Admins can route traffic through WireGuard or OpenVPN tunnels. Multiple servers can cluster with shared users and movable home directories. Deploy via an automated installer with Duck DNS, Docker Compose, or Kubernetes. The web UI and admin panels are served by the server itself.
Should you self-host sealskin?
sealskin scores 47/100 on selfhost.directory (how scoring works) and ranks #19 of 22 in Remote Desktop. It has 154 GitHub stars.
It shipped 20 stable releases in the past year. The latest, e64ba80, came out on 24 October 2026. New versions land roughly every 2 days.
Setup is advanced: plan for several services and some ongoing maintenance. An official Docker image is available. It is MPL-2.0-licensed and written mostly in Python.
Its closest alternative on selfhost.directory is rustdesk (92/100, 127 313 stars). It scores higher overall, so compare the two before you pick. See sealskin vs rustdesk side by side.
Features
- Any Linux desktop application support
- Browser Extension
- Browser Isolation
- Collaboration rooms
- End-to-end encryption
- File manager with remote storage
- Multi-node clustering
- OpenID Connect Authentication
- Remote application streaming
- Reverse Proxy Authentication
- SAML Authentication
- VPN exit profiles
- Web-based UI
sealskin README
FAQ
Files I put in the session are gone after it stops.
Cleanroom sessions are deleted with the session. Use a home directory (or Auto) and put files in Desktop/files, which is your shared files directory and survives every session.
No GPU is offered in the launcher.
Three things have to line up: the server detected the GPU at start-up (the dashboard lists detected GPUs), the user's settings allow GPU access, and the application declares support for that GPU type.
A launch times out waiting for the container.
The container started but did not answer HTTP within a minute. Usually the image is still being pulled for the first time, the host is out of memory, or the server cannot reach the container's IP.
A launch fails with a Docker error.
The server needs the Docker socket and the right to use it. If the error is a permission denied on /var/run/docker.sock, make the socket group-writable on the host (sudo chmod g+rw /var/run/docker.sock) and restart the container.
Why must the container be named sealskin?
The server inspects its own container to translate the paths it sees (/config, /storage) into the host paths Docker needs for session volumes, to learn the externally mapped ports it writes into configuration files, and to attach sessions to its network.
Can I run SealSkin behind my existing reverse proxy?
Yes. The proxy terminates TLS for the web app's name and passes WebSockets; SealSkin's own Caddy stays behind it and keeps routing and authenticating every session request.
I lost admin.json.
The server only keeps the public key. Remove /config/.config/sealskin/keys/admins/admin and restart: a new key pair and admin.json for admin are created, and the account keeps its desktops and its root key.
The server says "HOST_URL" in admin.json.
HOST_URL was not set when the container was first started. Open the file and replace the string with your server's hostname or IP before importing it, or set HOST_URL and delete the keys/admins/admin file and admin.json to have them generated again.
The mobile app shows a blank page or "Server unreachable".
The Android and iOS WebViews reject self-signed certificates and block mixed content, so the served UI only loads over HTTPS from a certificate the device trusts. There is no fallback.
Firefox never connects, Chrome works.
Firefox does not allow extensions to talk to a server with an untrusted certificate and has no HTTP fallback. Use a trusted certificate, for example the Let's Encrypt one the installer obtains through Duck DNS.
The dashboard says "Server unreachable" right after I imported my configuration.
With a self-signed certificate the browser refuses the served UI until you have accepted the certificate once. Click Open server, accept it in the tab that opens, then Retry.
More in Browser Automation
skyvernSelf-hosted, open-source AI browser automation: vision LLM agents run tasks and no-code workflows on any site, with Python/TypeScript SDKs and Docker Compose.
steelSelf-hosted browser API giving AI agents control over real Chrome via standard automation tools, handling sessions, proxies, and anti-detection.
Web Rendering Proxy (WRP)Self-hosted, open-source proxy that paints modern sites via headless Chrome into clickable imagemaps or stripped-down HTML for retro and legacy browsers.
web-uiOpen-source, self-hosted Gradio web UI for browser-use AI agents: automate websites with any major LLM, drive your own Chrome profile, and watch the browser over VNC.
Aerokube MoonMoon is a self-hosted commercial browser automation platform for Kubernetes/OpenShift running Selenium, Playwright, Cypress, and Puppeteer tests.
auto-browserSelf-hosted, open-source MCP control plane for a shared Playwright Chromium, where an agent browses and a person can grab the live desktop mid-task, keeping saved logins.
BrowserBeeBrowserBee is an open-source Chrome extension for browser control via natural language. Supports Anthropic, OpenAI, Gemini, and Ollama. Runs in-browser using Playwright.
browserlessSelf-hosted headless browser deployment in Docker. Connects with Puppeteer or Playwright for web scraping, automation, and testing.
BrowserOS neoA self-hosted, open-source Chromium browser for your AI agents: one-click Chrome login import, parallel agent tabs, and full session replay, all running locally.
camofox-browserSelf-hosted, open-source browser server that drives the Camoufox Firefox engine through a REST API, evading Cloudflare and bot detection for AI agents.
CloakBrowserSelf-hosted stealth Chromium with source-level fingerprint patches passing 50+ bot detection tests. Drop-in Playwright replacement plus Pro tier for latest builds.
CloakBrowser-ManagerSelf-hosted anti-detect browser for unlimited isolated profiles with unique fingerprints. Open-source GUI (MIT) powered by CloakBrowser stealth Chromium.
0 comments