Out of curiosity, how have you made this website? Maybe you can link me something or explain the technology behind it? As I say, I've never seen anything like this before and it's really cool!
Thanks, I'm glad you like the service. A brief summary of how it works: When you launch a machine on the service then during the 20 second loading screen the following happens on the back-end:
- A new QEMU disk (qcow2) is created for you based off a template image
- A folder is created for your file upload/download
- Qemu will be told to use this folder to host an SMB file share
- An instance of QEMU (in KVM mode) is launched starting your virtual machine
- Qemu starts an SMB server which your machine is pre-configured to connect to and mount the share in /home/instant-workstation/Share
- The exact qemu parameters are looked up a from a MongoDB database since the parameters vary based on the OS you start
- Qemu also launches a VNC server listening on a particular port
- An instance of FileBrowser is launched using the file upload/download folder created in the second bullet point
- Your instance of FileBrowser listens on a particular port
- A unique token is generated for your instance of the virtual machine
When I say "particular port" or "particular folder" above I mean that these can vary at runtime. The values of these are determined when you launch your machine. As other machines are already running other ports may need to be used etc.
Once the 20 seconds are up the back-end responds to your browser with the technical details how to connect to your particular virtual machine:
- Port numbers of the various services your browser will connect to
- VNC server port
- FileBrowser instance port
- SSH port
- The unique token for your machine
- To prevent unauthorised access to your machine all services your browser connects to (e.g. VNC server) all expect a token to verify it is really the same person that started the machine
The back-end parts of the libraries used in this project (noVNC, webssh2, FileBrowser) were all modified/customized to check the token is valid for the particular machine to be connected to. In noVNC's case the websockify back-end part verifies the token. The modifications/customizations cause these services to look up MongoDB to verify this token grants access to a particular machine.
Furthermore it is prevented that virtual machines can see or access each other through strict firewall rules.
The explanation is what happens when you launch a virtual machine when you are not logged in. When you are logged in the steps are almost the same except that it may re-use the same virtual machine for your particular user if you previously already started it. So it may re-use your previously used disk image instead of creating a new one.
By default your file share folder and virtual machine disk image are permanently deleted on shutdown of your virtual machine. However if you are a registered/logged in user then this does not happen (unless you press the "bomb" button on the right hand side of the screen to shut down your machine).
Currently the service is hosted by a dedicated server in Helsinki, Finland. The server has the capacity to run 3 virtual machines simultaneously. Each virtual machine has 4 virtual CPU cores, 16GB of RAM and 64GB of disk space.
