Rocky Linux 9 with the GNOME desktop, reached with any VNC viewer through an SSH tunnel: no default password, VNC switched off until you turn it on, and bound to localhost only when you do.
Rocky Linux 9 with GNOME Desktop is Rocky Linux 9, the community enterprise operating system from the Rocky Enterprise Software Foundation that is compatible with Red Hat Enterprise Linux 9, with the distribution's own desktop added: the AppStream environment group that Rocky Linux calls Server with GUI. Remote access uses TigerVNC from the same AppStream repository, the first party way to run headless GNOME desktops on this release, so each user gets their own full GNOME session on the virtual machine, reached with any VNC viewer through an SSH tunnel, with Files, Terminal, Firefox, Text Editor, System Monitor and Software ready to use.
It suits cloud workstations for enterprise Linux development, graphical administration and data tools that should run close to your cloud resources, training labs that need a RHEL 9 compatible desktop for each user, and a secure jump desktop that exposes nothing but SSH. Rocky Linux 9 is in active support to May 2027 and receives security maintenance to May 2032, and anything else you need installs with dnf.
cloudimg builds the desktop so that a new machine exposes nothing but SSH. VNC ships switched off, no account has a password and no VNC password exists anywhere in the image: each user chooses their own. A mandatory policy keeps the VNC server on localhost with password only security types, so it is reached through an SSH tunnel and never from the internet, and a single helper command starts or stops a user's desktop and refuses while either password is missing. The operating system disk is sized for a desktop rather than a headless server, guest sleep is disabled so the desktop cannot strand the virtual machine, SELinux stays in enforcing mode, SSH stays key only, every available update is applied at build time, and dnf-automatic is armed for security updates, all backed by 24/7 support.
Real screenshots taken while testing this image against its deployment guide.