Containers and isolation

Reemo Containers provides isolated containerized environments for users — for example a secure browsing session (RBI) or a specific application. Each container is a running instance, created from a template and orchestrated by the PROVISION environment.

Profiles and collections

  • Container profile: the template of a container — its image, options, constraints, and restrictions. When an assigned user connects, their container appears automatically in their list. See Container profiles.

  • Collection: groups one or more profiles (and desktops) assigned to a set of users. See Collections.

Lifecycle and persistence

Containers stay as close as possible to the connection:

  • The lifetime after disconnection is set on the profile, through the Expire after option.

  • In WebSocket mode, a dedicated relay container is created on connection, then destroyed at the end of the session.

  • The transfer directory /home/reemo/Downloads is ephemeral: its contents are lost when the container stops.

Isolation levels

The PROVISION environment can isolate containers at three levels:

  • Per cluster: several provision environments, per customer or per container type.

  • Per worker: a worker dedicated to a single container type within a cluster.

  • Per container: a virtualization layer that isolates users’ graphical spaces.

Official images

Containers are based on images maintained by Reemo, covering browsers, application access, and desktops: Chromium, Firefox, Edge, Ungoogled Chromium, HTTPS, RDP, SSH, Java 8 and Java 17 OpenJDK, Light Desktop, Citrix, Ubuntu.

Controls and restrictions

A profile governs how the container is used: clipboard, file transfer (upload, download, per-type allowlists, size limits), placement constraints, access approval, and — on a private instance — session recording.