SealSkin

Your browser is your new computer.
Self-hosted browser isolation and remote application streaming.

SealSkin runs desktop applications in isolated containers on a server you control and streams them to any browser or phone. A browser extension turns every link, file, download, and text selection into something you open remotely instead of locally, so nothing from the web ever runs on the device in front of you; with nothing installed, the server's own web app does the same from any browser. It is built on Selkies and the LinuxServer.io application images.

Read the documentation or visit sealskin.app.

Install

Clients

| | | | --- | --- | | Chrome, Edge, Brave, and other Chromium browsers | Chrome Web Store | | Firefox | Firefox Add-ons | | iPhone and iPad | App Store | | Android | Google Play | | Any browser, nothing to install | the web app at https://:8443/ |

Every release also carries the extension zips, the APK, the IPA, and the server wheel.

Server

The server ships as the linuxserver/sealskin container. The quickest path to a working server with a trusted certificate is its installer, which needs Docker, a free Duck DNS subdomain, and its token:

mkdir sealskin && cd sealskin
bash <(curl -sSL https://raw.githubusercontent.com/linuxserver/docker-sealskin/refs/heads/master/install.sh)

Then open https://:8443/ and sign in with the root key the server wrote to config/root_key, or import the generated config/admin.json into the extension or the app, and launch your first application. The Getting Started guide covers the installer, the plain docker compose alternative, certificates, and the first sign-in.

On Kubernetes, one manifest installs the server in any namespace you administer, with no cluster-scoped objects, and every session runs as a pod beside it (Kubernetes):

curl -LO https://raw.githubusercontent.com/selkies-project/sealskin/main/kubernetes/sealskin.yml
set HOST_URL, and a ReadWriteMany class for the storage to use more than one node
kubectl apply -n <namespace> -f sealskin.yml

What it does

• Isolation. Links, files, downloads, and searches open in a fresh

• Any application. Browsers, office suites, IDEs, media editors,

• Files stay on the server. A file manager, chunked uploads, intercepted

• Collaboration rooms. Launch any app into a room with chat, voice and

• Sign in with what you have. The web app signs users in through OpenID

• VPN exits. Administrators import WireGuard or OpenVPN profiles, and a

• One server or many. Servers join into a cluster with shared users and

• One UI, served by the server. The extension and the app are thin

Documentation

| | | | --- | --- | | Getting Started | Install the server, connect a client, launch an application. | | Signing in | The web sign-in, identity providers, groups and limits, reverse proxies. | | Clusters | Several servers as one: nodes, the shared store, pools, and a lab to try it. | | Kubernetes | Run the server in any namespace, with sessions as pods beside it. | | Usage | The launcher, context menus, sessions, storage, files, and rooms. | | Administration | Users, groups, app stores, templates, the App Laboratory, GPUs. | | Configuration | What lives in /config and /storage, keys, hand-editing the YAML. | | Settings Reference | Every environment variable the server reads. | | Architecture | Control and data planes, encryption, the served UI, and the shells. | | HTTP API | Every endpoint and how requests are wrapped. | | Development | Running from source, building the client, the mobile shells, this site. | | Releasing | Versioning, release notes, and the workflows. | | Troubleshooting | Certificates, Firefox, mobile, GPUs, and Docker. |

The pages live in docs/content and can be edited on GitHub; the site is rebuilt on every push to main.

Repository

VERSION              the one version number for server, UI, extension and app
assets/              the logo tile the README shows
server/              Python API server, Caddy template, tests, wheel
client/              web UI source and build (dist/ui, dist/extension, dist/mobile)
browser_extension/   manifests, icons and packaging for the extension shell
mobile/              Capacitor project for the iOS and Android shells
kubernetes/          manifest for running the server in a Kubernetes namespace
vpn/                 the VPN gateway image sessions leave through
docs/                the documentation site
release-notes/       one file per stable release

cd client && npm install && npm run build   # served UI + extension + mobile web dir
cd server && pip install -r requirements.txt && pytest
cd docs && npm install && npm run dev       # documentation at http://localhost:3000

Community

• Issues for bugs and feature requests
• LinuxServer.io Discord for questions and support
• linuxserver/sealskin-apps, the default application catalogue