init

.env.example

@@ -0,0 +1,2 @@
+VNC_PASSWORD=changeme
+RESOLUTION=1280x800

.gitignore

@@ -0,0 +1 @@
+.env

Dockerfile

@@ -0,0 +1,36 @@
+FROM ubuntu:24.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    xfce4 \
+    xfce4-goodies \
+    dbus-x11 \
+    tigervnc-standalone-server \
+    tigervnc-common \
+    novnc \
+    websockify \
+    sudo \
+    wget \
+    curl \
+    nano \
+    git \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+# ubuntu:24.04 already ships a default "ubuntu" user (uid 1000); just grant it passwordless sudo
+RUN echo "ubuntu ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/ubuntu \
+    && chmod 0440 /etc/sudoers.d/ubuntu
+
+# Keep these outside /home/ubuntu: that directory is replaced by a named
+# volume at runtime (for persistence), which would otherwise shadow them.
+COPY scripts/xstartup /opt/vnc/xstartup
+COPY scripts/entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /opt/vnc/xstartup /usr/local/bin/entrypoint.sh
+
+USER ubuntu
+WORKDIR /home/ubuntu
+
+EXPOSE 5901 6901
+
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

docker-compose.yml

@@ -0,0 +1,17 @@
+services:
+  xubuntu:
+    build: .
+    container_name: xubuntu_sandbox
+    restart: unless-stopped
+    shm_size: "1gb"
+    environment:
+      VNC_PASSWORD: ${VNC_PASSWORD:-changeme}
+      RESOLUTION: ${RESOLUTION:-1280x800}
+    ports:
+      - "5901:5901"
+      - "6901:6901"
+    volumes:
+      - xubuntu_home:/home/ubuntu
+
+volumes:
+  xubuntu_home:

scripts/entrypoint.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+set -e
+
+VNC_PASSWORD="${VNC_PASSWORD:-changeme}"
+RESOLUTION="${RESOLUTION:-1280x800}"
+
+if [ "$VNC_PASSWORD" = "changeme" ]; then
+    echo "WARNING: using default VNC password 'changeme'. Set VNC_PASSWORD in your .env file." >&2
+fi
+
+# This tigervnc build ships no vncpasswd tool; it authenticates VNC's "Plain"
+# security type against the Unix account password via PAM instead.
+echo "ubuntu:${VNC_PASSWORD}" | sudo chpasswd
+
+mkdir -p "$HOME/.vnc"
+cp /opt/vnc/xstartup "$HOME/.vnc/xstartup"
+chmod +x "$HOME/.vnc/xstartup"
+
+# Clean up any stale lock/pid files from a previous run of this volume
+vncserver -kill :1 >/dev/null 2>&1 || true
+rm -f /tmp/.X1-lock /tmp/.X11-unix/X1
+
+vncserver :1 -geometry "$RESOLUTION" -depth 24 -localhost no \
+    -SecurityTypes Plain -PlainUsers ubuntu
+
+websockify --web=/usr/share/novnc/ 6901 localhost:5901 &
+
+LOGFILE="$HOME/.vnc/$(hostname):1.log"
+touch "$LOGFILE"
+exec tail -f "$LOGFILE"

scripts/xstartup

@@ -0,0 +1,5 @@
+#!/bin/bash
+unset SESSION_MANAGER
+unset DBUS_SESSION_BUS_ADDRESS
+
+exec dbus-launch --exit-with-session xfce4-session