Desktop

The desktop template ships an XFCE desktop with Xvfb, x11vnc and noVNC preinstalled — a real graphical session for GUI applications that have no headless mode.

Viewing it in your browser

noVNC is a web page, so it opens through a browser preview: a private address of its own that your browser is signed in to with a one-time link. Previews are a deployment feature; GET /capabilities reports browser_preview_urls as active where they are on.

Setup

pip install ovrin
export OVRIN_API_KEY="ovrin_..."

Start the display

import ovrin

client = ovrin.Client()  # reads OVRIN_API_KEY

sandbox = client.sandboxes.create(template="desktop", timeout=3600)

sandbox.run("nohup Xvfb :0 -screen 0 1280x800x24 > /tmp/xvfb.log 2>&1 &")
sandbox.run("sleep 1 && DISPLAY=:0 nohup dbus-launch startxfce4 > /tmp/xfce.log 2>&1 &")

Run a GUI application and take the result

sandbox.run("DISPLAY=:0 nohup xterm -e 'echo hello; sleep 30' > /dev/null 2>&1 &")

# Capture the virtual display and pull the image back.
sandbox.run("sleep 2 && DISPLAY=:0 import -window root /workspace/screen.png")
png = sandbox.files.read_bytes("/workspace/screen.png")
open("screen.png", "wb").write(png)

sandbox.kill()

Adding VNC

x11vnc is installed if you want a VNC server running inside the sandbox, for example to reach it from another process in the same sandbox:

sandbox.run(
    'nohup x11vnc -display :0 -passwd "$VNC_PASSWORD" -forever -shared '
    "-rfbport 5900 > /tmp/x11vnc.log 2>&1 &"
)

Pass VNC_PASSWORD through env at creation. Never reuse a password you use anywhere else: it protects a screen, not an account.

View it in your browser

noVNC is the browser client for that VNC server. websockify serves it and bridges its WebSocket to port 5900; publish the port it listens on:

sandbox.run(
    "nohup websockify --web /usr/share/novnc 6080 localhost:5900 "
    "> /tmp/novnc.log 2>&1 &"
)

preview = sandbox.preview(6080)
print(preview["open_url"] + "&next=/vnc.html")

Open that link within a minute. It works once, signs your browser in to the preview, and lands on noVNC, where you connect with the VNC password. next is the page to land on after signing in; it has to be a path on the preview.

Related

• Agent environments — every template
• Chrome — a browser sandbox with DevTools