Part of 
Your browser is your new computer.
Self-hosted browser isolation and remote application streaming.
SealSkin runs desktop applications in isolated containers on a server you control and streams them to any browser or phone. A browser extension turns every link, file, download, and text selection into something you open remotely instead of locally, so nothing from the web ever runs on the device in front of you. With nothing installed, the server's own web app does the same from any browser. It is built on Selkies and the LinuxServer.io application images.
Read the documentation or visit sealskin.app.
| Chrome, Edge, Brave, and other Chromium browsers | Chrome Web Store |
| Firefox | Firefox Add-ons |
| iPhone and iPad | App Store |
| Android | Google Play |
| Any browser, nothing to install | the web app at https://<server>:8443/ |
Every release also carries the extension zips, the APK, the IPA, and the server wheel.
The server ships as the linuxserver/sealskin container. The quickest path to a working server with a trusted certificate is its installer, which needs Docker, a free Duck DNS subdomain, and its token:
mkdir sealskin && cd sealskin
bash <(curl -sSL https://raw.githubusercontent.com/linuxserver/docker-sealskin/refs/heads/master/install.sh)Then open https://<server>:8443/ and sign in with the root key the server
wrote to config/root_key, or import the generated config/admin.json into
the extension or the app, and launch your first application. The
Getting Started guide
covers the installer, the plain docker compose alternative, certificates,
and the first sign-in.
On the web, the root key is the only sign-in the server handles itself. Everyone else is authenticated externally, by an identity provider (OpenID Connect or SAML) or a reverse proxy that signs users in, whose groups make administrators and carry limits. Plan on one of those before inviting a second person. Signing in and Behind a reverse proxy show how, with tested configurations for Authelia, Authentik, Keycloak, Pocket ID, Tinyauth, oauth2-proxy, SWAG, Traefik, Nginx Proxy Manager, and Caddy.
On Kubernetes, one manifest installs the server in any namespace you administer, with no cluster-scoped objects, and every session runs as a pod beside it (Kubernetes):
curl -LO https://raw.githubusercontent.com/selkies-project/sealskin/main/kubernetes/sealskin.yml
# set HOST_URL, and a ReadWriteMany class for the storage to use more than one node
kubectl apply -n <namespace> -f sealskin.yml- Isolation. Links, files, downloads, and searches open in a fresh container on the server. Cleanroom sessions leave nothing behind, and persistent home directories keep what you choose.
- Any application. Browsers, office suites, IDEs, media editors, emulators, and 3D tools from the app stores, or any Selkies-compatible image you add, with NVIDIA and DRI3 GPU acceleration.
- Files stay on the server. A file manager, chunked uploads, intercepted downloads, and password-protected public share links.
- Collaboration rooms. Launch any app into a room with chat, voice and video, gamepad slots, and hand-over of mouse and keyboard control.
- Sign in with what you have. The web app signs users in through OpenID Connect, SAML, or the reverse proxy in front of it, with groups that carry permissions, session and storage limits, and time allowances. The extension and the app sign in with an application key made on the web, or, on a single server, with a key file and an end-to-end encrypted API that needs no trusted certificate.
- VPN exits. Administrators import WireGuard or OpenVPN profiles, and a user picks one at launch: the session leaves through that tunnel and nothing else, on Docker and on Kubernetes.
- One server or many. Servers join into a cluster with shared users and applications and no master: pools of nodes, placement, GPU slots, and home directories that move between nodes.
- One UI, served by the server. The extension and the app are thin shells, and any browser can use the same pages as a web app. The launcher, dashboard, and admin panels ship with the server image, so UI updates never wait for a store review.
| Getting Started | Install the server, connect a client, launch an application. |
| Signing in | The web sign-in, identity providers, groups and limits, reverse proxies. |
| Behind a reverse proxy | What a proxy in front needs, with guides for SWAG, Traefik, Nginx Proxy Manager, and Caddy. |
| External authentication | Forward-auth and identity providers: Authelia, Authentik, Keycloak, Pocket ID, Tinyauth, oauth2-proxy. |
| Clusters | Several servers as one: nodes, the shared store, pools, and a lab to try it. |
| Kubernetes | Run the server in any namespace, with sessions as pods beside it. |
| Usage | The launcher, context menus, sessions, storage, files, and rooms. |
| Administration | Users, groups, app stores, templates, the App Laboratory, GPUs. |
| Configuration | What lives in /config and /storage, keys, hand-editing the YAML. |
| Settings Reference | Every environment variable the server reads. |
| Architecture | Control and data planes, encryption, the served UI, and the shells. |
| HTTP API | Every endpoint and how requests are wrapped. |
| Development | Running from source, building the client, the mobile shells, this site. |
| Releasing | Versioning, release notes, and the workflows. |
| Troubleshooting | Certificates, Firefox, mobile, GPUs, and Docker. |
The pages live in docs/content and can be edited on GitHub, and
the site is rebuilt on every push to main.
VERSION the one version number for server, UI, extension and app
assets/ the logo tile the README shows
server/ Python API server, Caddy template, tests, wheel
client/ web UI source and build (dist/ui, dist/extension, dist/mobile)
browser_extension/ manifests, icons and packaging for the extension shell
mobile/ Capacitor project for the iOS and Android shells
kubernetes/ manifest for running the server in a Kubernetes namespace
vpn/ the VPN gateway image sessions leave through
docs/ the documentation site
release-notes/ one file per stable release
cd client && npm install && npm run build # served UI + extension + mobile web dir
cd server && pip install -r requirements.txt && pytest
cd docs && npm install && npm run dev # documentation at http://localhost:3000- Issues for bugs and feature requests
- LinuxServer.io Discord for questions and support
- linuxserver/sealskin-apps, the default application catalogue
SealSkin is licensed under the Mozilla Public License 2.0. The privacy policy for the published clients is PRIVACY.md.