F45 Change Proposal: Web Based Remote Installation Support for Atomic Desktops (self-contained) - Fedora Discussion

= 40rem)" rel="stylesheet" data-target="desktop" />

= 40rem)" rel="stylesheet" data-target="discourse-ai_desktop" /><br>= 40rem)" rel="stylesheet" data-target="discourse-calendar_desktop" /><br>= 40rem)" rel="stylesheet" data-target="discourse-reactions_desktop" /><br>= 40rem)" rel="stylesheet" data-target="poll_desktop" />

F45 Change Proposal: Web Based Remote Installation Support for Atomic Desktops (self-contained)

Project Discussion

Change Proposals

fesco,<br>f45

bciconelle

(Bruno Ciconelle)

July 22, 2026, 3:18pm

Web Based Remote Installation Support for Atomic Desktops

This is a proposed Change for Fedora Linux.

This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.

Wiki

Announced

Summary

Enable secure remote installation via the Anaconda WebUI on Fedora Atomic Desktop images. Users can boot a target machine with inst.webui.remote and complete the installation from a web browser on another machine over HTTPS with pin-based authentication. This change is scoped to Atomic Desktop images (Silverblue, Kinoite, etc.).

Owner

Name: Bruno Ciconelle

Email: bciconel@redhat.com

Detailed Description

This change introduces remote installation as a tech preview for Fedora Atomic Desktop images. Users can boot with inst.webui.remote and complete the installation from a web browser on another machine — no VNC/RDP client needed.

The Anaconda WebUI already supports remote access for development via inst.webui.remote, but without authentication, TLS, or configuration isolation. This change adds the production controls needed to ship it as an opt-in feature:

Pin-based authentication following the inst.rdp pattern, with an opt-out (inst.webui.remote.noauth) for development and trusted networks

HTTPS with self-signed certificates — cockpit generates these automatically

Port 443 by default so users connect with just https://

Isolated cockpit configuration under /etc/anaconda/cockpit/ to prevent installer settings from leaking to the installed system

Remote access is not enabled by default — it must be explicitly activated by the user via the inst.webui.remote boot option. Without it, behavior is completely unchanged. This change is scoped to Atomic Desktop images (see Changes/BuildAtomicDesktopsWithImageBuilder).

Feedback

The feature was announced on Fedora Magazine in June 2026 with a developer preview and proof-of-concept. Community feedback included:

mDNS discovery : Suggestion to advertise the installer via mDNS (e.g., fedora-installer.local) so users can find headless machines without knowing their DHCP-assigned IP. Not in scope for this initial MVP but noted as a valuable future improvement.

Tablet/phone support : Cockpit’s PatternFly widgets are responsive — storage configuration may be challenging on small screens but tablets should work well.

Lightweight boot ISO : Interest in a minimal boot ISO without a local browser that defaults to remote installation — a headless/network-only variant. Not in scope for this change, but aligns with the broader Changes/ModernizeBootISO effort.

Benefit to Fedora

New installation method : Users can install Fedora Atomic Desktops from any device with a web browser — no VNC/RDP client software needed. This works from phones, tablets, Chromebooks, or any machine on the same network.

Better user experience than VNC/RDP : The WebUI provides copy-paste support, a responsive layout, and runs in a standard web browser. No special client software to install or configure.

Secure by default : Unlike VNC (historically unencrypted, 8-character password limit), remote installation uses HTTPS with TLS and user-set passwords. Authentication is required by default.

Practical graphical installation on lightweight ARM SBCs : Devices like the Raspberry Pi have limited CPU and memory. Running a local browser consumes resources better used by the installer itself. With remote installation, the browser runs on the user’s workstation and the target device only serves the lightweight cockpit-ws process.

Benefits any future boot.iso/netinst image that adopts the WebUI : This change lives in anaconda and anaconda-webui, not in image-specific configuration. Any new boot.iso or network install image that migrates from the GTK interface to the WebUI — such as Fedora Server, which currently still uses GTK — will automatically gain remote installation support with no additional work. (Note: remote access on Live images is not supported.)

Community testing opportunity : Landing in Fedora 45 Atomic images gives the community a full release cycle to test, report issues, and provide feedback before the feature is extended to other image types.

Scope

Proposal owners:

Modify anaconda to...