Providers

Windows VMs (Guacamole) and macOS via AWS EC2 Mac — how each substrate is wired.

Desktop profiles that are not plain Linux pods use a VM or external provider. Operators enable those catalog entries only after the verify scripts pass.

Windows VM (`driver_hint: ec2-vm`)

Item	Value
Profile	`desktop-windows`
Substrate	EC2 Windows VM (also accepts `gce-vm` / `vm` hints in the router)
Viewer	`guacamole` — Guacamole in the AWS desktop VPC
Env	`SANDBOX_VM_DESKTOP_VIEWER_HOST` / `SANDBOX_VM_DESKTOP_VIEWER_ENDPOINT`

Sandboxes pods reach Guacamole over the private network (VPN / PrivateLink). The trainer still only opens viewer.url on the gateway host.

Verify: scripts/verify-viewer-windows-dev.sh

macOS external (`kind: aws-ec2-mac`)

Catalog fragment:

desktop_provider:
  kind: aws-ec2-mac
  region: us-east-1
  secret_ref: sandbox-desktop-aws

Item	Value
Profile	`desktop-macos`
`driver_hint`	`external`
Viewer	`provider`
Secrets	Kubernetes secret named by `secret_ref`

Verify: scripts/verify-viewer-macos-dev.sh

Linux pod (for comparison)

desktop-ubuntu uses driver_hint: k8s — no VM, no external provider. Stream is TigerVNC + websockify inside the trial pod.

Desktop architecture
Provider plugin — add a new kind
Operator detail in-repo: docs/sandbox/desktop/PROVIDERS.md

Providers

Windows VM (driver_hint: ec2-vm)

macOS external (kind: aws-ec2-mac)

Linux pod (for comparison)

Related

On this page

Windows VM (`driver_hint: ec2-vm`)

macOS external (`kind: aws-ec2-mac`)