AlmaLinux 9 with the GNOME desktop, reached with any VNC viewer through an SSH tunnel: no default password, VNC switched off until you turn it on, and bound to localhost only when you do.
AlmaLinux 9 with GNOME Desktop is AlmaLinux 9, the community owned enterprise Linux that is binary compatible with Red Hat Enterprise Linux 9, with the distribution's own desktop added: the AppStream environment group that AlmaLinux calls Server with GUI. Remote access uses TigerVNC from the same AppStream repository, the first party way to run headless GNOME desktops on this release, so each user gets their own full GNOME session on the virtual machine, reached with any VNC viewer through an SSH tunnel, with Files, Terminal, Firefox, Text Editor, System Monitor and Software ready to use.
It suits cloud workstations for enterprise Linux development, graphical administration and data tools that should run close to your cloud resources, training labs that need a RHEL 9 compatible desktop for each user, and a secure jump desktop that exposes nothing but SSH. AlmaLinux 9 is in active support to May 2027 and receives security maintenance to May 2032, and anything else you need installs with dnf.
cloudimg builds the desktop so that a new machine exposes nothing but SSH. VNC ships switched off, no account has a password and no VNC password exists anywhere in the image: each user chooses their own. A mandatory policy keeps the VNC server on localhost with password only security types, so it is reached through an SSH tunnel and never from the internet, and a single helper command starts or stops a user's desktop and refuses while either password is missing. Guest sleep is disabled so the desktop cannot strand the virtual machine, SELinux stays in enforcing mode, SSH stays key only, every available update is applied at build time, and dnf-automatic is armed for security updates, all backed by 24/7 support.
Real screenshots taken while testing this image against its deployment guide.