Neko - Secure Self-Hosted Virtual Browser

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Neko is a free and open source self-hosted virtual browser. A real desktop web browser runs inside a container on the instance, its screen and audio are captured, encoded and streamed to any number of viewers in a shared room over WebRTC, and viewers can take turns controlling it from their own browser with nothing to install. It is used for isolated and disposable browsing, secure remote work, collaborative research, and synchronised watch-together sessions. This image delivers that experience fully installed and secured, so a private virtual browser you run and control yourself is operational within minutes of launch rather than depending on a third-party service.

## Why This Image vs a Manual Install

Compared to installing Neko yourself, this image eliminates the container runtime setup, the WebRTC networking configuration, the reverse-proxy and WebSocket wiring, and the security hardening. Neko's upstream examples ship fixed default passwords; this image does not run on them. The desktop resolution, the single multiplexed WebRTC media port, the loopback-only metrics endpoint and the per-instance credential rotation are all configured for you at image build time. You launch the instance, read your unique credentials, open the web interface and start a session.

## Application Stack

The official upstream Neko container is pinned by digest and run under systemd via docker compose, fronted by nginx which serves the web client and its WebSocket signalling over HTTP and blocks the unauthenticated metrics and debug endpoints. Inside the container a real browser runs on an X server, GStreamer captures and VP8-encodes the desktop, and Neko streams it to viewers over WebRTC. Media flows over a single multiplexed port for both UDP and TCP, so only one firewall rule per protocol is required.

## Security Hardening

This image follows a defence-in-depth approach with the following hardening measures applied:

• No default or shared credentials: a unique user password and a separate unique admin password are generated on each instance's first boot and written only to a root-only file, so no two deployments share a credential and the upstream defaults are never in use
• Fail-closed bootstrap: the application is gated on a first-boot marker and physically cannot start until both passwords have been rotated, so it can never come up on a known credential
• Role separation: the user role can watch and take control while only the admin role can lock the room, remove members and force control
• Closed metrics surface: the unauthenticated Prometheus metrics endpoint is bound to loopback only and blocked at the public front door, so its live session labels are never reachable off-box
• Per-instance advertised address: the address advertised to WebRTC clients is resolved on first boot for the instance's own public IP, never baked at build time

Buyers requiring formal compliance documentation should contact cloudimg to discuss specific requirements.

## Low-Cost Evaluation Path

To evaluate the product before committing to a production deployment, launch on a smaller instance such as t3.medium for a brief functional test session. This lets you verify the streaming experience, the credential workflow and the security posture at minimal EC2 cost before moving to m5.large or larger for a smooth production stream.

## AWS Integration

Deploy on any EC2 instance type; m5.large suits one comfortable viewer at 720p30 and larger types add headroom for more concurrent viewers. Open UDP port 59000 and TCP port 59000 in the security group for the WebRTC media stream, in addition to TCP 80 for the web interface. The media does not run over HTTP and cannot be proxied through port 80, so without the media ports open the login page loads but the screen stays black.

## Use Cases

• Isolated, disposable browsing where risky links open on a throwaway remote browser instead of your own device
• Collaborative research, support and remote work where several people share and control one browser session in real time
• Synchronised watch-together sessions for teams, presentations and demos over a single shared screen

## Ready to Use

Read your credentials from the root-only file, open the web interface in your browser, sign in and start controlling the streamed browser. Invite others to the same room to browse or watch together, using the admin role to moderate.

## Get Started

For a guided deployment walkthrough or help sizing your instance for your expected viewer count, contact cloudimg support at any time. Our engineers can assist with TLS termination, security group configuration, and integration into your existing infrastructure.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.