---
title: Desktop
description: Open a Linux desktop in a GUI sandbox through KasmVNC.
---

# Desktop

Any sandbox whose pool image is `zondax/kobe-sandbox` can run a Linux desktop. The image includes KasmVNC, Openbox, Firefox, and the [Tauri 2 Linux prerequisites](https://v2.tauri.app/start/prerequisites/#linux). Firefox is registered for HTTP and HTTPS, so OAuth opened by a desktop app stays inside that browser. `kobe vnc paste` still uses x11vnc on the same display.

The desktop does not start until you ask, and you need a pool that uses this image and publishes port 6080. Operators: [Images and runner](/docs/pools/images-and-runner). Callers: [Sandbox](/docs/getting-started/sandbox) for lease and SSH.

## Start the desktop

```sh
kobe lease gui --ttl 4h
kobe exec gui -- kobe-desktop start
kobe exec gui -- kobe-desktop status
```

`kobe-desktop start` is idempotent. It runs the supervisor in a dedicated tmux server so the desktop outlives the `kobe exec` that started it.

```sh
kobe exec gui -- kobe-desktop logs
kobe exec gui -- kobe-desktop terminal
kobe exec gui -- kobe-desktop browser
kobe exec gui -- kobe-desktop stop
```

`gui` is your lease id or alias.

## Open it

In another terminal:

```sh
kobe port-forward gui 6080:6080
```

Then either:

```sh
kobe vnc open gui
```

That opens KasmVNC in the browser (`http://127.0.0.1:<port>/`). `--native` is TigerVNC against 5900 if you have `vncviewer`.

That is a 1440×900 desktop. It starts with a terminal and a blue background. Right-click for Terminal, Browser, and Desktop status. `kobe-desktop browser <url>` opens Firefox on the desktop to a URL.

Run the project's usual Linux desktop command in another execution, with `--cwd /home/agent/work/your-project`. Each execution already has `DISPLAY=:99`, the X11 authority file, and the session D-Bus address.

Clone into `/home/agent/work` and run `mise install` there. Project tools come from the project's `mise.toml`, not from the image.

## What is listening

KasmVNC (6080, HTTP) and x11vnc (5900, RFB) bind loopback inside the sandbox. X11 uses a Unix socket with a per-session cookie. You reach the desktop only through Kobe's authorized port-forward. The pool must declare port 6080 (or a range that includes it).

This does not need host networking, privilege escalation, or extra container capabilities.

## Stop

`kobe-desktop stop` stops the managed desktop. Releasing the lease stops it too. Only one desktop can run in a sandbox.