The purpose of these images is to provide a full featured web native Linux desktop experience for any Linux application or desktop environment. These images replace our old base images at KasmVNC for greatly increased performance, fidelity, and feature set. They ship with passwordless sudo to allow easy package installation, testing, and customization. By default they have no logic to mount out anything but the users home directory, meaning on image updates anything outside of /config will be lost.
- Support for using our base images in your own projects is provided on a Reasonable Endeavours basis, please see our Support Policy for details.
- There is no
latesttag for any of our base images, by design. We often make breaking changes between versions, and we don't publish release notes like we do for the downstream images. - If you're intending to distribute an image using one of our bases, please read our docs on container branding first.
Full documentation for the Selkies platform lives at docs.linuxserver.io/selkies.
These images bundle Selkies (the streaming server and web client), pixelflux (video capture, encoding and the Wayland compositor), pcmflux (Opus audio), NGINX, PulseAudio, Docker and labwc. Each piece is described in the Components section of the docs.
docker run --rm -it \
--shm-size=1gb \
-p 3001:3001 \
-e PIXELFLUX_WAYLAND=true \
ghcr.io/linuxserver/baseimage-selkies:debiantrixie bash
Open https://localhost:3001 and accept the self signed certificate. The Quickstart explains the flags and the minimal command debugging philosophy, and Installation covers compose, volumes, PUID/PGID and the rest of the LinuxServer.io conventions.
Every facet of the container is configured with environment variables. The baseimage variables (ports, basic auth, subfolder, Wayland mode, GPU nodes, dashboard selection, and so on) and the complete list of Selkies application settings are documented in the Configuration Reference. Other topics that used to live in this README:
- GPU Acceleration - Intel, AMD and Nvidia passthrough, zero copy encoding, multi GPU and the Nvidia host requirements.
- Security and Hardening - authentication, the hardening variables for kiosk style deployments, locking client settings and the token control plane.
- Reverse Proxy - SWAG, Nginx, Traefik and subfolder setups.
- Using the Web Client - the sidebar, clipboard, file transfer, gamepads, webcam and session sharing.
- WebRTC Transport - the opt in UDP transport and the STUN/TURN setup it needs.
- Pelorus and Pixelflux - the agentic web interface, the Computer Use API and session recording.
- Troubleshooting - the checklist to run before opening an issue.
Authentication for these containers is included as a convenience. In general this authentication mechanism should be used to keep the kids out not the internet. If you are looking for a robust secure application gateway please check out SWAG.
All base images are built for x86_64 and aarch64 platforms.
| Distro | Current Tag |
|---|---|
| Alpine | alpine324 |
| Arch | arch |
| Debian | debiantrixie |
| Fedora | fedora44 |
| Kali | kali |
| Ubuntu | ubunturesolute |
A dev tag is also available based on the latest Ubuntu and the head Selkies codebase for integration testing.
- All images include proot-apps, which install portable applications into the user's
$HOMEso they survive image updates and can be mounted into any other flavor of Selkies container. See Installing Applications. - The glibc based images carry a built in Steam installer, run
steaminside the container without any permissions. See the Steam section for the limits and how to disable it. - Selkies baseimages are compatible with SealSkin, a self hosted platform that launches isolated application containers on demand with browser extensions and mobile apps. See the SealSkin docs.
Included in these base images is labwc (or Openbox in X11 fallback mode) and the init logic needed to launch a single application. The bare minimum needed to create an application container is a Dockerfile:
FROM ghcr.io/linuxserver/baseimage-selkies:debiantrixie
RUN apt-get update && apt-get install -y --no-install-recommends firefox-esr
COPY /root /
and a root/defaults/autostart_wayland file containing the command to run, in this case firefox-esr. Build it, run it with the quick start command above and Firefox is streaming in the browser.
Right click menus, full desktop environments via startwm.sh, hardening and kiosk builds, testing and multi arch CI are all covered in Building Custom Images, with Baseimage Internals describing the init chain, services and nginx layout, and Customizing Containers covering the runtime hooks available without rebuilding. Examples of full desktop images can be found in our Webtop repository.
These base images include an installation of Docker. Mount -v /var/run/docker.sock:/var/run/docker.sock to manage the host Docker installation from inside the session, or pass --privileged to start an isolated in container Docker daemon (set -e START_DOCKER=false to keep privilege without the daemon). Details and the performance notes are in the Docker in Docker section of the installation docs.
This container and any downstream images can also be used as a rapid development environment for the Selkies Project. Simply clone the upstream repo and run the container as shown:
git clone https://github.com/selkies-project/selkies.git
cd selkies
docker run --rm -it \
--shm-size=1gb \
-e DEV_MODE=selkies-dashboard \
-e PUID=1000 \
-e PGID=1000 \
-v $(pwd):/config/src \
-p 3001:3001 ghcr.io/linuxserver/webtop:ubuntu-kde bash
The application will be restarted on code changes to the src directory you mounted in and provide feedback for debugging. The web side runs through Vite with hot module reload and is served at the root path of the container. DEV_MODE accepts the name of any dashboard directory under addons/ in the Selkies repo, core to watch and rebuild selkies-web-core (the streaming engine itself), or pixelflux as shown below.
To run a pixelflux rapid development environment:
git clone https://github.com/linuxserver/pixelflux.git
cd pixelflux
docker run --rm -it \
--shm-size=1gb \
-e DEV_MODE=pixelflux \
-e PUID=1000 \
-e PGID=1000 \
-v $(pwd):/config/src \
-p 3001:3001 ghcr.io/linuxserver/webtop:ubuntu-kde bash
The container builds the mounted source, all Rust build dependencies are present in the image, and runs the session against your working copy so a compositor or encoder change is one container restart away from being on screen. More on the workflow and a map of the repositories involved is in Development Environment.
The following line is only in this repo for loop testing:
- { date: "01.01.50:", desc: "I am the release message for this internal repo." }