One shared desktop is the product
Neko streams a Linux desktop or application through WebRTC. Its default images run browsers, but the repository also points to VLC, Remmina, XFCE, KDE, and other applications. Multiple people join the same room, receive synchronized video and audio, chat, and can take control. That shared state separates Neko from ordinary remote desktop gateways built around one private session per user.
The fit is specific. A support engineer can guide a customer inside a clean browser. A teacher can hand control to a student. Friends can operate one player during a watch party, and a product can embed a remote browser using the separate neko-rooms API. If every user needs a personal desktop, duplicating rooms and profiles changes the capacity plan considerably.
The sample deployment opens 101 UDP ports
The supplied Compose file uses the Firefox image, reserves 2 GB of shared memory, publishes TCP port 8080, and maps UDP 52000 through 52100. It also requires NEKO_WEBRTC_NAT1TO1 to contain an address clients can reach. Those details are the real quick start. Launching a container is easy; making WebRTC work through home NAT, cloud firewalls, and a separate reverse proxy can take longer.
Issue 477 captures that confusion. Its author had Nginx on one machine and Neko on another and asked whether the UDP range should traverse the proxy. The open documentation issue includes both HTTP proxy and UDP stream examples. Operators should design the media route explicitly and test it from outside the local network rather than treating a successful same-LAN session as proof.
What happened when we ran it
Our sandbox entered ./server/, installed 94 Go packages in 28 seconds, and completed the build in 43 seconds. The checkout at commit baf21c1 had 720 files, about 52,748 source lines, and occupied 10.8 MB. It included 14 CI workflow files and a Dockerfile, which fits a project distributed mainly as container images.
The Go test step failed after 17 seconds. Its summary showed 1 passed package result and 17 failed out of 18. The visible tail marked packages including pkg/auth, pkg/drop, pkg/gst, pkg/xevent, and pkg/xorg as build failed; several type and utility packages said they had no test files.
The provided tail does not include the compiler diagnostics that preceded those lines. We cannot say whether a system package, build tag, generated file, or code defect caused the failures. The defensible finding is narrower: the repository built with the harness command, while the test command could not compile most package targets in the same fresh Debian container.
WebRTC gives Neko audio and group control
The README compares Neko with Guacamole and noVNC. Those tools commonly deliver remote displays through established protocols or images over WebSockets. Neko's WebRTC path targets smoother video, built-in audio, and several participants controlling the same environment. Release v3.1.5 added H.265 encoding, reduced audio jitter-buffer latency, and updated NVIDIA encoding for driver 590 or newer.
Codec choice complicates deployment. Hardware acceleration depends on the image, GPU, driver, GStreamer pipeline, and browser support. Issue 689 reports that v3.1.5 ignored NEKO_CAPTURE_VIDEO_PIPELINES and fell back to VP8, while the singular pipeline setting produced H.265. Anyone investing in GPU capacity or multiple quality tiers should verify the active codec from logs and client playback, not only from environment variables.
Browser isolation does not secure the service by itself
Running a browser in a container keeps its cookies and history away from the viewer's local browser. Profiles can be ephemeral or mounted for persistence. The README also suggests Tor Browser or a VPN for additional anonymity and describes a jump-host use case for internal applications. Those are useful building blocks, but exposing a controllable browser creates a sensitive service with credentials, outbound access, and possibly persistent sessions.
The sample Compose values set the normal user's password to neko and the administrator password to admin. They are examples, not safe deployment values. Replace them before the first public bind, terminate TLS, restrict who can reach the room, and decide whether the container may access private networks. A disposable browser that can reach internal services is still an internal access path.
Version 3 is active and still changing
GitHub showed 22,193 stars and 147 combined open issues and pull requests when fetched. The last push was August 25, 2026, and v3.1.5 shipped on August 5. Current work includes OIDC-only member authentication, AMD GPU acceleration, pointer capture controls, example Compose configurations, and additional browser images. That is healthy activity, while the combined open count is not a bug count.
The Apache-2.0 license is straightforward, and the project has dedicated migration, installation, configuration, FAQ, and troubleshooting documentation. Neko earns a trial when several people truly need one remote screen. Budget the network route and shared memory, change the credentials, pin an image instead of relying forever on latest, and run the failed Go test command on your build host before maintaining custom server code.