[](https://linuxserver.io) [](https://blog.linuxserver.io "all the things you can do with our containers including How-To guides, opinions and much more!") [](https://linuxserver.io/discord "realtime support / chat with the community and the team.") [](https://github.com/orgs/linuxserver/discussions "post on our community forum.") [](https://github.com/linuxserver "view the source for all of our repositories.") [](https://opencollective.com/linuxserver "please consider helping us by either donating or contributing to our budget") The [LinuxServer.io](https://linuxserver.io) team brings you another container release featuring: * regular and timely application updates * easy user mappings (PGID, PUID) * custom base image with s6 overlay * weekly base OS updates with common layers across the entire LinuxServer.io ecosystem to minimise space usage, down time and bandwidth * regular security updates Find us at: * [Blog](https://blog.linuxserver.io) - all the things you can do with our containers including How-To guides, opinions and much more! * [Discord](https://linuxserver.io/discord) - realtime support / chat with the community and the team. * [Discussions](https://github.com/orgs/linuxserver/discussions) - post on our community forum. * [GitHub](https://github.com/linuxserver) - view the source for all of our repositories. * [Open Collective](https://opencollective.com/linuxserver) - please consider helping us by either donating or contributing to our budget # [linuxserver/webtop](https://github.com/linuxserver/docker-webtop) [](https://scarf.sh) [](https://github.com/linuxserver/docker-webtop) [](https://github.com/linuxserver/docker-webtop/releases) [](https://github.com/linuxserver/docker-webtop/packages) [](https://gitlab.com/linuxserver.io/docker-webtop/container_registry) [](https://quay.io/repository/linuxserver.io/webtop) [](https://hub.docker.com/r/linuxserver/webtop) [](https://hub.docker.com/r/linuxserver/webtop) [](https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-webtop/job/master/) [](https://ci-tests.linuxserver.io/linuxserver/webtop/latest/index.html) [Webtop](https://github.com/linuxserver/docker-webtop) - Alpine, Ubuntu, Fedora, and Arch based containers containing full desktop environments in officially supported flavors accessible via any modern web browser. [](https://github.com/linuxserver/docker-webtop) ## Supported Architectures We utilise the docker manifest for multi-platform awareness. More information is available from docker [here](https://distribution.github.io/distribution/spec/manifest-v2-2/#manifest-list) and our announcement [here](https://blog.linuxserver.io/2019/02/21/the-lsio-pipeline-project/). Simply pulling `lscr.io/linuxserver/webtop:latest` should retrieve the correct image for your arch, but you can also pull specific arch images via tags. The architectures supported by this image are: | Architecture | Available | Tag | | :----: | :----: | ---- | | x86-64 | ✅ | amd64-\ | | arm64 | ✅ | arm64v8-\ | ## Version Tags This image provides various versions that are available via tags. Please read the descriptions carefully and exercise caution when using unstable or development tags. | Tag | Available | Description | | :----: | :----: |--- | | latest | ✅ | XFCE Alpine *Wayland Support | | alpine-i3 | ✅ | i3 Alpine *Wayland Support | | alpine-kde | ✅ | KDE Alpine *Wayland Only | | alpine-mate | ✅ | MATE Alpine | | arch-i3 | ✅ | i3 Arch *Wayland Support | | arch-kde | ✅ | KDE Arch *Wayland Only | | arch-mate | ✅ | MATE Arch | | arch-xfce | ✅ | XFCE Arch *Wayland Support | | debian-i3 | ✅ | i3 Debian *Wayland Support | | debian-kde | ✅ | KDE Debian | | debian-mate | ✅ | MATE Debian | | debian-xfce | ✅ | XFCE Debian | | fedora-i3 | ✅ | i3 Fedora *Wayland Support | | fedora-kde | ✅ | KDE Fedora *Wayland Support | | fedora-mate | ✅ | MATE Fedora | | fedora-xfce | ✅ | XFCE Fedora | | ubuntu-i3 | ✅ | i3 Ubuntu *Wayland Support | | ubuntu-kde | ✅ | KDE Ubuntu *Wayland Support | | ubuntu-lxqt | ✅ | LXQt Ubuntu *Wayland Support | | ubuntu-mate | ✅ | MATE Ubuntu | | ubuntu-xfce | ✅ | XFCE Ubuntu *Wayland Support | | dev | ✅ | KDE Ubuntu *Current Selkies Development Head | ## Application Setup The application can be accessed at: * https://yourhost:3001/ ### Strict reverse proxies This image uses a self-signed certificate by default. This naturally means the scheme is `https`. If you are using a reverse proxy which validates certificates, you need to [disable this check for the container](https://docs.linuxserver.io/faq#strict-proxy). This container is based on [Docker Baseimage Selkies](https://github.com/linuxserver/docker-baseimage-selkies), which streams a desktop or single application to your web browser. Only the essentials are covered below, the full platform documentation lives at [docs.linuxserver.io/selkies](https://docs.linuxserver.io/selkies/). ### Start Minimal Most support issues we see stem from large run configurations assembled from years of forum posts. These containers are designed to work with almost nothing. Start with the minimal command below, confirm it works, then add your options (volumes, env vars, GPU flags) one at a time: ```bash docker run --rm -it \ --shm-size=1gb \ -p 3001:3001 \ lscr.io/linuxserver/webtop:latest bash ``` Open **https://localhost:3001** (note the `https`) and accept the self signed certificate warning. The trailing `bash` gives you a shell inside the container, `ctrl+d` exits and cleans everything up. If a bigger setup misbehaves, return to this command to isolate the problem, see the [Quickstart](https://docs.linuxserver.io/selkies/user-guide/quickstart/) and [Troubleshooting](https://docs.linuxserver.io/selkies/user-guide/troubleshooting/) guides. ### GPU Acceleration A GPU is optional, the CPU pipeline is fast enough for smooth sessions on modest hardware. When a GPU is mounted into the container it is automatically detected and configured for zero copy rendering and encoding, set `AUTO_GPU=false` to disable this behavior. **Intel / AMD (open source drivers), one flag is all it takes:** ```bash docker run --rm -it \ --shm-size=1gb \ -p 3001:3001 \ --device /dev/dri \ lscr.io/linuxserver/webtop:latest bash ``` **Nvidia (proprietary drivers, not available on Alpine based images):** Requires host driver **580 or newer** installed from the `.run` file downloaded directly from Nvidia. On drivers older than 595.80 you may also need kernel parameters and a dummy plug, see [GPU Acceleration](https://docs.linuxserver.io/selkies/user-guide/gpu/) before opening an issue. ```bash docker run --rm -it \ --shm-size=1gb \ -p 3001:3001 \ --runtime nvidia \ --gpus all \ --device /dev/nvidia-modeset \ lscr.io/linuxserver/webtop:latest bash ``` Compose examples, multi GPU selection (`DRINODE`/`DRI_NODE`), Unraid notes, and a step by step debugging loop are in the [GPU Acceleration](https://docs.linuxserver.io/selkies/user-guide/gpu/) guide. ### Security >[!WARNING] >This container provides privileged access to the host system. Do not expose it to the Internet unless you have secured it properly. **HTTPS is required.** Modern browser features used for video and audio (WebCodecs) only work in a secure context. Port `3001` serves HTTPS directly, the HTTP port exists only to sit behind a reverse proxy. By default there is **no authentication**. Setting the `CUSTOM_USER` and `PASSWORD` environment variables enables HTTP basic auth, which is suitable only for a trusted local network. For internet exposure, place the container behind a reverse proxy with robust authentication, such as [SWAG](https://github.com/linuxserver/docker-swag). Keep in mind the web interface includes a terminal with passwordless `sudo`, anyone who can reach the GUI can gain root inside the container. Authentication options, sharing link behavior, container isolation, and the lockdown variables for kiosk style deployments are covered in [Security and Hardening](https://docs.linuxserver.io/selkies/user-guide/security/). ### Language Support - Internationalization To launch the session in a different language, set the `LC_ALL` environment variable, e.g. `-e LC_ALL=zh_CN.UTF-8` (Chinese), `ja_JP.UTF-8` (Japanese), `ko_KR.UTF-8` (Korean), `ar_AE.UTF-8` (Arabic), `ru_RU.UTF-8` (Russian), `es_MX.UTF-8` (Spanish Latin America), `de_DE.UTF-8` (German), `fr_FR.UTF-8` (French), `nl_NL.UTF-8` (Dutch), `it_IT.UTF-8` (Italian). ### Beyond Running the App This image inherits every capability of the Selkies platform, all documented in depth on the docs site: * [Configuration Reference](https://docs.linuxserver.io/selkies/user-guide/configuration/) - every environment variable: ports, subfolder reverse proxy, custom dashboards, watermarking, and the full set of `SELKIES_*` stream, feature, and UI settings with their `|locked` syntax. * [Using the Web Client](https://docs.linuxserver.io/selkies/user-guide/web-client/) - file transfer, clipboard sync, audio and microphone, up to four gamepads, session sharing, and mobile touch support. * [Installing Applications](https://docs.linuxserver.io/selkies/user-guide/installing-apps/) - persistent user installed apps with [proot-apps](https://github.com/linuxserver/proot-apps) (`proot-apps install filezilla`) or native packages at boot with Docker mods. * [Docker in Docker and host Docker control](https://docs.linuxserver.io/selkies/user-guide/configuration/#optional-run-configurations) - run `--privileged` for an isolated DinD setup, or mount `/var/run/docker.sock` to manage the host. * [Reverse Proxy](https://docs.linuxserver.io/selkies/user-guide/reverse-proxy/) - proxying websockets and subfolders correctly. * [SealSkin](https://docs.linuxserver.io/selkies/components/sealskin/) - turnkey multi user VDI orchestration with browser extension and mobile apps, this image is fully compatible. * [Pelorus](https://docs.linuxserver.io/selkies/components/pelorus/) - expose the session to AI agents via a computer use API and accessibility stack. ## Usage To help you get started creating a container from this image you can either use docker-compose or the docker cli. >[!NOTE] >Unless a parameter is flagged as 'optional', it is *mandatory* and a value must be provided. ### docker-compose (recommended, [click here for more info](https://docs.linuxserver.io/general/docker-compose)) ```yaml --- services: webtop: image: lscr.io/linuxserver/webtop:latest container_name: webtop environment: - PUID=1000 - PGID=1000 - TZ=Etc/UTC volumes: - /path/to/data:/config ports: - 3000:3000 - 3001:3001 shm_size: "1gb" restart: unless-stopped ``` ### docker cli ([click here for more info](https://docs.docker.com/engine/reference/commandline/cli/)) ```bash docker run -d \ --name=webtop \ -e PUID=1000 \ -e PGID=1000 \ -e TZ=Etc/UTC \ -p 3000:3000 \ -p 3001:3001 \ -v /path/to/data:/config \ --shm-size="1gb" \ --restart unless-stopped \ lscr.io/linuxserver/webtop:latest ``` ## Parameters Containers are configured using parameters passed at runtime (such as those above). These parameters are separated by a colon and indicate `:` respectively. For example, `-p 8080:80` would expose port `80` from inside the container to be accessible from the host's IP on port `8080` outside the container. | Parameter | Function | | :----: | --- | | `-p 3000:3000` | Web Desktop GUI HTTP, must be proxied | | `-p 3001:3001` | Web Desktop GUI HTTPS | | `-e PUID=1000` | for UserID - see below for explanation | | `-e PGID=1000` | for GroupID - see below for explanation | | `-e TZ=Etc/UTC` | specify a timezone to use, see this [list](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List). | | `-v /config` | abc users home directory | | `--shm-size=` | Recommended for all desktop images. | ## Environment variables from files (Docker secrets) You can set any environment variable from a file by using a special prepend `FILE__`. As an example: ```bash -e FILE__MYVAR=/run/secrets/mysecretvariable ``` Will set the environment variable `MYVAR` based on the contents of the `/run/secrets/mysecretvariable` file. ## Umask for running applications For all of our images we provide the ability to override the default umask settings for services started within the containers using the optional `-e UMASK=022` setting. Keep in mind umask is not chmod it subtracts from permissions based on it's value it does not add. Please read up [here](https://en.wikipedia.org/wiki/Umask) before asking for support. ## User / Group Identifiers When using volumes (`-v` flags), permissions issues can arise between the host OS and the container, we avoid this issue by allowing you to specify the user `PUID` and group `PGID`. Ensure any volume directories on the host are owned by the same user you specify and any permissions issues will vanish like magic. In this instance `PUID=1000` and `PGID=1000`, to find yours use `id your_user` as below: ```bash id your_user ``` Example output: ```text uid=1000(your_user) gid=1000(your_user) groups=1000(your_user) ``` ## Docker Mods [](https://mods.linuxserver.io/?mod=webtop "view available mods for this container.") [](https://mods.linuxserver.io/?mod=universal "view available universal mods.") We publish various [Docker Mods](https://github.com/linuxserver/docker-mods) to enable additional functionality within the containers. The list of Mods available for this image (if any) as well as universal mods that can be applied to any one of our images can be accessed via the dynamic badges above. ## Support Info * Shell access whilst the container is running: ```bash docker exec -it webtop /bin/bash ``` * To monitor the logs of the container in realtime: ```bash docker logs -f webtop ``` * Container version number: ```bash docker inspect -f '{{ index .Config.Labels "build_version" }}' webtop ``` * Image version number: ```bash docker inspect -f '{{ index .Config.Labels "build_version" }}' lscr.io/linuxserver/webtop:latest ``` ## Updating Info Most of our images are static, versioned, and require an image update and container recreation to update the app inside. With some exceptions (noted in the relevant readme.md), we do not recommend or support updating apps inside the container. Please consult the [Application Setup](#application-setup) section above to see if it is recommended for the image. Below are the instructions for updating containers: ### Via Docker Compose * Update images: * All images: ```bash docker-compose pull ``` * Single image: ```bash docker-compose pull webtop ``` * Update containers: * All containers: ```bash docker-compose up -d ``` * Single container: ```bash docker-compose up -d webtop ``` * You can also remove the old dangling images: ```bash docker image prune ``` ### Via Docker Run * Update the image: ```bash docker pull lscr.io/linuxserver/webtop:latest ``` * Stop the running container: ```bash docker stop webtop ``` * Delete the container: ```bash docker rm webtop ``` * Recreate a new container with the same docker run parameters as instructed above (if mapped correctly to a host folder, your `/config` folder and settings will be preserved) * You can also remove the old dangling images: ```bash docker image prune ``` ### Image Update Notifications - Diun (Docker Image Update Notifier) >[!TIP] >We recommend [Diun](https://crazymax.dev/diun/) for update notifications. Other tools that automatically update containers unattended are not recommended or supported. ## Building locally If you want to make local modifications to these images for development purposes or just to customize the logic: ```bash git clone https://github.com/linuxserver/docker-webtop.git cd docker-webtop docker build \ --no-cache \ --pull \ -t lscr.io/linuxserver/webtop:latest . ``` The ARM variants can be built on x86_64 hardware and vice versa using `lscr.io/linuxserver/qemu-static` ```bash docker run --rm --privileged lscr.io/linuxserver/qemu-static --reset ``` Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64`. ## Versions * **02.10.26:** - Quality of life upgrades for KDE, MATE, and Xfce. Install base packages for flavors initialize KDE sessions properly. * **21.09.26:** - Updates for Selkies v2, add x11 init for ubuntu-kde, show ubuntu-lxqt branch. * **10.06.26:** - Rebase Alpine images to 3.24. * **07.05.26:** - Deprecate Enterprise Linux tags. * **07.04.26:** - Rebase Ubuntu images to Resolute. * **26.03.26:** - Rebase Fedora images to 44. * **24.03.26:** - Update tags that support Wayland to pass ozone platform for chromium. * **27.12.25:** - Rebase Alpine images to 3.23. * **17.11.25:** - Rebase Fedora images to 43. * **24.07.25:** - Rebase Debian images to Trixie. * **17.06.25:** - Rebase all images to Selkies, drop openbox and icewm, bump Alpine to 3.22, bump Fedora to 42. * **10.01.25:** - Rebase Fedora to 41. * **06.12.24:** - Rebase Alpine to 3.21. * **26.09.24:** - Swap from firefox to chromium on Alpine images. * **23.05.24:** - Rebase Alpine to 3.20, document Nvidia support. * **22.04.24:** - Rebase Ubuntu to Noble. * **16.04.24:** - Add docs on PRoot Apps. * **14.04.24:** - Rebase Fedora to 40. * **11.02.24:** - Add PWA icons and title variants properly. * **06.02.24:** - Update Readme about native language support. * **29.12.23:** - Rebase Alpine to 3.19 and swap back to Firefox. * **07.11.23:** - Rebase Fedora to 39. * **14.06.23:** - Rebase to Debian Bookworm. * **13.05.23:** - Rebase to Alpine 3.18 and Fedora 38. * **23.03.23:** - Rebase all Webtops to KasmVNC base image. * **21.10.22:** - Rebase xfce to Alpine 3.16, migrate to s6v3. * **12.03.22:** - Add documentation for mounting in a GPU. * **05.02.22:** - Rebase KDE Ubuntu to Jammy, add new documentation for updated gclient, stop recommending priv mode. * **21.09.21:** - Add Fedora and Arch images, show seccomp settings in readme. * **26.09.21:** - Rebase to Alpine versions to 3.14. * **20.04.21:** - Initial release.