Kerbside, a SPICE VDI proxy

Kerbside is a SPICE VDI protocol proxy: a pure-Python control plane (the REST API and the daemon) that supervises a Rust SPICE proxy. It sits out the front of your cloud and provides VDI access to VMs running inside the cluster, determining what VM to proxy your traffic to based on the password you provide when connecting. Unlike layer 4 proxies that pass through unparsed traffic, Kerbside understands the SPICE protocol itself — the proxy terminates TLS, drives the SPICE link handshake, and is an enforcing SPICE application firewall, on by default.

Kerbside currently knows how to proxy console sessions for Shaken Fist, OpenStack, and oVirt. It will mostly be of interest to operators of those clouds who want to offer users rich native SPICE desktops (high resolution, multi-monitor, USB passthrough, audio) instead of HTML5-transcoded consoles. OpenStack is probably the best documented integration at the moment because there are patches to add deployment support for Kerbside to Kolla-Ansible in the kerbside-patches repository.

Kerbside is currently considered experimental: it works, but it has not yet seen large scale deployment.

Installation

pip install kerbside

This installs the Python control plane and a matching prebuilt kerbside-proxy binary wheel automatically (x86_64 and aarch64). See docs/installation.md for the packaging details, OS-level dependencies, and deployment pointers. If you would rather see it working first, demo/ brings the whole stack up under docker compose and hands you a proxied console.

Documentation

In the docs/ directory:

• Documentation Index - What Kerbside is, the broker model, and the connection flow
• Kerbside for oVirt - The first of the per-deployment guides: what Kerbside replaces in an oVirt deployment, and how to set it up
• Installation - From pip install to a proxied console: what a running Kerbside needs, the compose demo, and where to go for your cloud
• Configuration - Configuration reference, including the SPICE firewall knobs
• Console Sources - Configuring sources.yaml for Shaken Fist, OpenStack, and oVirt
• Proxy Architecture - Internal proxy design, state machine, and firewall
• Database Schema - Tables, columns, and relationships
• SPICE Protocol Documentation - Protocol fundamentals, link handshake, per-channel message formats, compression, capabilities, USB redirection, and the VD agent protocol (under docs/spice/)
• Development - Migrations, building and packaging the Rust proxy, dependency pinning, review tracking, vendored web assets, and debugging
• Testing - Running the test suite, CI tiers and lane mechanics, Ryll harnesses, the oVirt console probe, Tempest, and load-test images

Project reference files:

• ARCHITECTURE.md - High-level system architecture
• AGENTS.md - AI agent guidelines for working on this codebase
• .claude/ - Claude Code project instructions and skills (database migrations, adding source types)

License

Apache-2.0