With over 21,000 GitHub stars and six years of steady development through version 3.1.0, Neko transforms any Docker container into a fully interactive browser or desktop environment streamed to web browsers via WebRTC with sub-300-millisecond glass-to-glass latency. The Go backend captures X server display frames using the Pion WebRTC library while the Vue.js frontend renders the remote session with native audio synchronization, delivering a significantly smoother experience than Apache Guacamole or noVNC which rely on image-over-WebSocket approaches. Multiple users simultaneously view and collaboratively control the same session with real-time input synchronization and host-managed control passing between participants. Pre-built Docker images cover Firefox, Chromium, Google Chrome, Tor Browser, Brave, Vivaldi, and Microsoft Edge alongside full desktop environments including XFCE and KDE for running any Linux application. Neko Rooms provides multi-tenant deployment with a REST API for programmatic room provisioning, while Neko Apps extends the platform with additional containerized applications beyond browsers. Sessions persist on the server independently of client connections — close your laptop, reconnect from your phone, and resume exactly where you left off. Optional VPN and Tor integration routes traffic through encrypted tunnels for privacy-sensitive browsing. RTMP broadcasting streams sessions to external platforms. The embeddable client supports iframe integration for custom portals and applications. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

EveryOS gives the Linux server you already own a desktop it never had: open a browser and your machine greets you with windows you can move, snap, and stack, a dock, virtual desktops, widgets, and a launcher, all remembering exactly how you left them. Your files live in a private home with the usual folders, previews, a text editor, and a trash you can restore from, and plugging in a USB disk makes it appear on the desktop ready to mount. An app store installs self-hosted applications from catalogs and follows each deployment, later offering updates that keep your settings, rollbacks when one goes wrong, and backups of app data. The same workspace watches the machine itself: CPU, memory, disk, and network at a glance, systemd services and logs, available package updates, and a Docker view for containers and Compose projects. A real terminal opens in the browser under your own Linux account, Home Assistant arrives as a panel and desktop widgets with its tokens kept on the server, and an AI assistants app can find or install a local model server such as Ollama and chat with it privately. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Your server already runs your apps; PhreshOS gives it a desktop. Install the System once and every Program you add gets a window on a real browser desktop, complete with taskbar, start menu, and a plane of views you can spread work across. Close the browser and nothing stops: each Program's server keeps running on the machine, holding its data and state, and when you open the Desktop again the windows are exactly where you left them. The System handles the groundwork every small web tool normally rebuilds for itself: one sign-in for the owner, permissions that decide what each Program may reach, storage and uploads, logs, and messaging between Programs, so a new tool only brings its own logic. Everyday pieces like the file manager, Settings, and even the wallpaper are Programs too, and an appearance changes colors and motion across the whole desktop at once. The same Desktop opens in several browsers simultaneously, each with its own view and scale, and AI agents work alongside you through the same Programs and APIs you use. When you want another tool, you create it as a small web project and its window appears on your desktop. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Puter delivers a complete cloud operating system that runs entirely in the browser — turning any device with internet access into a full-featured personal computer with desktop environment, file management, application hosting, and developer platform. The familiar desktop interface presents windows, taskbar, right-click menus, drag-and-drop, and multi-window management indistinguishable from native operating systems. The hierarchical filesystem supports file creation, uploads, sharing, permissions, and trash recovery with storage backends ranging from local SQLite for self-hosting to S3 and DynamoDB for production scale. Built-in AI integration provides access to GPT-4, Claude, and other models directly from the desktop for text generation, code assistance, and image creation. The developer platform offers a JavaScript SDK, REST APIs, cloud storage, key-value database, and serverless workers for building and hosting web applications without managing infrastructure. Sandboxed applications run in iframes with IPC communication and permission-based access to filesystem, AI, and system services. The app store enables publishing, discovering, and monetizing applications built on the Puter platform. Website hosting publishes static sites with custom domains directly from the file manager. Multi-user support provides individual accounts with authentication, resource isolation, and sharing capabilities. Deploy via Docker with a single command, Docker Compose for production, or npm for development — the one-line install script handles everything automatically on Linux, macOS, and Windows. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

AgentVerse OS turns a single Ubuntu server into a personal cloud with a real desktop in the browser, built for a developer and their AI agents. You work in a windowed desktop with a taskbar, start menu, and widgets for system monitoring, clock, news, weather, and projects, and the same desktop opens from a laptop, tablet, or phone while everything stays on the server. Each project gets an isolated Incus container with Docker inside, its own network and gate, plus VS Code, a terminal, files, and git in the browser. The Agents app runs Claude Code, Codex, Gemini CLI, pi, and Antigravity inside the workspace, with permission prompts you approve from any device, scheduled routines, model menus, conversation search and export, and a ledger of what each session spent. When you close your laptop the agents keep working, and you pick the conversation up later exactly where it stopped. A built-in store merges the Runtipi, Coolify, and Umbrel catalogs into about 945 installable apps with guided setup, credentials shown in the app card, snapshots, and rollback. Projects request capabilities such as storage.s3, llm, or notify instead of hardcoding addresses, scheduled ZFS snapshots feed a restic backup repository, and access arrives only through your Tailscale network with real certificates. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Eclipse Che spins up complete development environments on Kubernetes from a Devfile in the project repository, so new developers click a factory link and open a browser IDE with dependencies, runtimes, and debugging already configured instead of spending their first day installing toolchains. Each workspace runs as a DevWorkspace custom resource in the user's namespace, making environments API-manageable with kubectl and GitOps tooling alike. Developers choose their editor per workspace, from Visual Studio Code Open Source to JetBrains IDEs via Projector, and the 7.124 release adds Orca, an agent development environment for working alongside AI coding agents. Workspaces carry their own containers for build and run, so code executes in a production-like environment with direct Kubernetes API access from the IDE. Teams standardize stacks as Devfile templates, onboard contributors in minutes, and open a fresh workspace per branch or pull request in a new browser tab. The 7.124 release also builds workspace lifecycle commands into chectl, including SSH connections with port forwarding to desktop editors, and DevWorkspace Operator 1.0 adds optional per-workspace NetworkPolicy isolation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. EPL-2.0 licensed.

With over 14,000 GitHub stars and enterprise adoption by security-conscious organizations, Coder transforms how development teams provision, manage, and secure their coding environments. Every workspace is defined as a Terraform template, meaning infrastructure engineers can standardize development environments across EC2 instances, Kubernetes pods, Docker containers, or any combination, while developers get self-service provisioning that launches in seconds rather than days of manual setup. The WireGuard-based networking layer establishes encrypted tunnels between developer machines and remote workspaces, providing low-latency access without exposing ports or configuring VPN concentrators. Automatic idle detection shuts down unused workspaces after configurable periods, directly reducing cloud compute costs for organizations running hundreds of developer environments. The Coder Agents feature introduces native AI coding capabilities where the agent loop executes entirely within the control plane on self-hosted infrastructure, keeping LLM API credentials out of individual workspaces and eliminating credential exfiltration risks. Centralized model governance allows platform teams to approve specific AI providers and models, set per-user spend limits, and maintain complete audit logs of all prompts, tool calls, and agent activity. IDE integration supports VS Code through a dedicated extension, JetBrains IDEs via Gateway and Toolbox plugins, and browser-based code-server for web access. The template registry provides pre-built configurations for common development stacks. DevContainer support builds environments from standard devcontainer.json specifications. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Neko Master watches every connection flowing through your Clash, Mihomo, or Surge gateway and turns the stream into a live map of devices, domains, countries, and proxy nodes, so questions that once needed packet captures get answered at a glance. The dashboard refreshes over WebSocket as traffic moves, charting upload and download trends across thirty minutes, one hour, or a full day. Domain views rank every host your network contacts by traffic and connection count, and IP views add ASN and geographic detail, so an unfamiliar endpoint explains itself instead of raising an alarm. Proxy statistics break traffic down per node and per rule, which makes a saturated exit, a misrouted application, or an underused subscription obvious in seconds. One panel watches several gateways at once: add OpenClash backends directly, or install the one-command agent on OpenWrt, Linux, or macOS machines beside remote gateways and let each agent report home. Because agents open the connection outward, gateways behind NAT still report in, and the panel never reaches into your network uninvited. History persists in SQLite by default, and busy networks can dual-write traffic statistics to ClickHouse for larger histories while configuration stays in SQLite. Token-based access control protects the dashboard, dark mode and an installable PWA keep it comfortable on a phone, and the interface switches between English and Chinese. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Pomerium puts every internal application behind a single identity-aware proxy, so engineers reach dashboards, admin panels, and databases through their browser with no VPN client and no network-level trust. Sign-in flows through your existing identity provider, including Google, Okta, Azure AD, GitHub, GitLab, and any OpenID Connect service, with sessions verified continuously rather than once at login. Each route carries its own policy: restrict the finance tool to the finance group, require a specific email domain for the admin console, or allow read-only paths more broadly. Authorized requests pass identity headers the application can trust, and every access decision is logged for audit. TCP routes extend the same sign-in and policy checks to SSH, PostgreSQL, MySQL, and RDP connections through a small client or a browser-based terminal. In Kubernetes, Pomerium doubles as an ingress controller, applying the same policies to services as annotations on ingress resources. Mutual TLS between the proxy and backends, encrypted sessions, and short-lived credentials replace shared passwords and flat networks. Teams roll it out as one all-in-one binary or split the proxy, authorize, authenticate, and cache services across machines as traffic grows. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

With over 24,000 GitHub stars and a rapidly growing community of self-hosters, authentik delivers enterprise-grade identity management that replaces commercial solutions like Okta and Auth0 with a fully self-hosted platform requiring no per-user licensing fees. The platform serves as a unified identity provider supporting SAML 2.0, OAuth 2.0 and OpenID Connect, LDAP for legacy application compatibility, SCIM 2.0 for automated user provisioning, and RADIUS for network device authentication. The visual flow designer enables administrators to create custom authentication workflows combining password verification, multi-factor authentication with TOTP, WebAuthn, and SMS codes, email verification, captcha challenges, and conditional logic based on user attributes or device context. The forward-auth and reverse proxy integration works seamlessly with Traefik, Nginx, Caddy, and Envoy to protect applications that lack built-in authentication. User enrollment flows support self-registration with configurable approval workflows, invitation links, and automatic group assignment. The LDAP outpost exposes user and group data to legacy applications requiring LDAP bind authentication, while the SCIM provider automates user lifecycle management with downstream applications. Multi-tenancy support through brands allows a single authentik instance to serve multiple organizations with independent domains, branding, and authentication policies. The admin interface provides comprehensive user management, group hierarchy, application catalog, event logging with GeoIP enrichment, and system health monitoring. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Licensed under a source-available license with an open-source community edition.

To protect self-hosted web services behind a unified single sign-on portal without deploying complex enterprise identity suites, Tinyauth acts as an OpenID Certified authentication server and reverse proxy middleware. Homelab operators and infrastructure teams place it in front of internal dashboards, media servers, and administrative tools routed through Traefik, Caddy, Nginx, Nginx Proxy Manager, or LinuxServer SWAG. Users can sign in with local bcrypt-hashed credentials, scan QR codes to enroll time-based one-time password authenticators for two-factor verification, or authenticate through external OAuth providers like GitHub, Google, and Pocket ID. Organizations running centralized directories can bind Tinyauth directly to an LDAP server such as LLDAP or OpenLDAP and automatically synchronize group memberships for role-based authorization. Fine-grained access control rules configured via dynamic Docker container labels or environment variables let administrators whitelist or block specific usernames, OAuth email regex patterns, OIDC groups, client IP CIDR ranges, and URL path prefixes per subdomain. For applications that support native federated login, the built-in OpenID Connect 1.0 discovery endpoint, authorization code flow, and userinfo API allow seamless single sign-on with optional consent skipping for trusted clients. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Behind one admin panel, DefGuard runs a WireGuard VPN, an identity provider, and multi-factor authentication, so every person and device proves who they are before reaching your private network. Administrators define VPN locations, assign which users and groups may enter each one, and enforce firewall rules that allow or deny traffic per location, with changes applied to gateways in real time. People enroll remotely through a guided self-service flow, register their own laptops and phones, and connect with desktop and mobile clients that show live connection statistics. Sign-in goes well beyond passwords, because the built-in OpenID Connect provider gives internal tools single sign-on, while TOTP codes, WebAuthn and FIDO2 keys, email tokens, and mobile biometrics gate each connection. Directory teams sync accounts from LDAP and Active Directory, or federate sign-in through Google, Microsoft, and custom OpenID providers, instead of maintaining a separate user list. Every authentication, enrollment, and policy change lands in a searchable activity log, and webhooks plus a REST API let surrounding systems react to access events automatically. Gateways keep enforcing access from a local cache when the control plane is unreachable, and several gateways can front the same location for failover. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Warpgate is a clientless bastion host and privileged access management gateway that lets engineering teams secure, assign, and audit access to internal SSH servers, databases, Kubernetes clusters, web applications, and remote desktops from a single portal without installing VPN clients. Connect directly from standard tools like OpenSSH, VS Code Remote, psql, mysql, kubectl, or native RDP clients using formatted credentials, or launch browser-based SSH terminals, RDP desktops, and VNC sessions straight from the web interface. Administrators map users and roles to specific internal targets with granular 1:1 permissions, enforcing multi-factor authentication via TOTP and Single Sign-On through OpenID Connect providers like Google Workspace, Microsoft Entra ID, and Okta with automatic group-to-role provisioning. Every interactive terminal command, database query, HTTP request, and remote desktop session is captured in real time so security auditors can watch active connections live or replay historical recordings on demand from the web dashboard. Built-in brute-force defense automatically blocks suspicious IP addresses and locks compromised accounts, while temporary access tickets, just-in-time session approvals, encrypted credential storage, and S3-compatible recording archival support enterprise compliance workflows across multi-node clusters. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Every server, embedded board, and edge gateway you manage becomes reachable through one SSH address in ShellHub, even when it sits behind NAT with no public IP and no open inbound port. A small agent on each device dials out to your server, so a box on a customer LAN or a cellular link needs nothing beyond outbound web access. Connect with the stock ssh client by typing [email protected]@server, or open a terminal in the browser, and scp, sftp, rsync, and port forwarding work unchanged. SSH identities tie every key to a named team member, so removing someone ends their access on every device at once. Default-deny access policies grant or block members, roles, users, or API keys by device tag, Linux login, and source address, and can require a fresh browser confirmation before a session opens. Provisioning keys enroll whole fleets through automatic, manual, webhook, or allowlist acceptance, with usage limits, expiry dates, and tags. The Sessions page records who connected to which device, as which login, and from where, and browser terminals can be recorded and replayed. A Docker connector turns containers into devices that policies can grant one by one. Four member roles shape what each person can change, and the HTTP API, API keys, and an MCP server let scripts and AI assistants list devices and review sessions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Meshlan turns your own Linux server into the control plane for a private virtual LAN that connects remote Windows devices as if they sat on the same router. Devices pair through your server, receive their certificates, and then talk directly to each other over encrypted tunnels whenever NAT allows, using dual-stack hole punching, UPnP, and STUN diagnostics to find a path. When a direct connection is impossible, traffic falls back to relays, and multiple relay nodes are chosen automatically by latency, jitter, packet loss, and health. You can publish a service that only listens on localhost, a local API, a web panel, a database, a game server, to the mesh on a custom port, with direct access or manual approval by its creator. Names stay stable while addresses change: devices answer to names like alice.mesh and services to api.alice.mesh, and an HTTPS gateway serves mesh websites without port numbers. Files move directly between devices over the encrypted link while the server only distributes metadata. The console shows the live topology with P2P and relay paths, latency, and service health, and local history keeps traffic and events for replay with a time slider. Optional AI automation keeps model keys on the server, encrypts context end to end, and asks for your confirmation before changing anything. Signed updates verify and roll back automatically when a health check fails. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.