Introduction
rd is a remote desktop for a situation ordinary tools don’t cover: you sit at a computer that can only browse the web, and you want to use your own Mac or Windows PC somewhere else.
Many company laptops can’t install remote-desktop software, and their network lets nothing through but HTTPS on ports 80 and 443, so VNC, RDP and SSH are blocked. rd fits in that gap. The picture, the keyboard and the mouse all travel over one WebSocket on port 443, the same kind of traffic as any web app, and the computer you sit at needs only a browser.
The parts
Section titled “The parts”Anywhere
Viewer
A browser tab, or rd Desktop
- Decodes H.264 with WebCodecs
- Acknowledges every frame
- Sends keys, pointer, scroll
Your server
rd-gateway
One small container
- Serves the portal and viewer
- Checks sign-in and device tokens
- Joins the two sockets, no buffering
At home
rd-agent
On the Mac or Windows PC
- Captures the screen
- Encodes on the GPU
- Injects mouse and keyboard
| Part | Runs on | What it does |
|---|---|---|
| rd-agent | the Mac or PC you want to reach | Captures the screen (ScreenCaptureKit on macOS, Desktop Duplication on Windows, and GDI where Windows has no display driver for either), encodes hardware H.264 (VideoToolbox; Media Foundation with NVENC, Quick Sync or AMF) and injects mouse and keyboard input. It connects out to the gateway, so nothing listens at home. |
| rd-gateway | a server or cluster you run | Serves the portal and the viewer, checks who you are (single sign-on plus an email allowlist, a token per device), and joins the viewer’s socket to the agent’s without buffering. Ships as a small distroless image. |
| viewer | any browser with WebCodecs | A TypeScript web app, served by the gateway: decodes video with WebCodecs, sends your input and acknowledges every frame. |
| rd Desktop | Windows 10/11, macOS 12+ (optional) | The same viewer in its own window. It also captures the shortcuts a browser never sees (Alt+Tab, Cmd+Tab, the Windows key, …) and sends them to the remote machine. |
What you need
Section titled “What you need”- A gateway that is reachable over HTTPS on port 443, under two host names: one for people
(the portal and the viewer, for example
rd.example.com), behind single sign-on, and one for agents (for examplerd-agent.example.com), without it. The container image isghcr.io/thijmen/rd-gateway(linux/arm64). See Gateway. - A reverse proxy that signs people in. The gateway reads the user from the
X-authentik-emailheader that Authentik’s forward auth sets, and checks it against an allowlist. The tested setup is Traefik with Authentik on Kubernetes. - The machine to reach: a Mac with macOS 15 or later (Mac agent), or a PC with Windows 10 (1703 or later) or 11 (Windows agent). Someone has to be at it once, for the setup. A Linux server can run the agent too, for its terminal and files only (Linux agent). The commands for each: Install an agent.
- A browser with WebCodecs on the computer you use. WebCodecs needs a secure context, so the
portal must be served over HTTPS (or from
localhost).
What a session is like
Section titled “What a session is like”You open the portal, sign in and click Connect on a machine. The viewer asks the gateway for a session, the gateway asks the agent, and the agent opens a second connection for the session’s media. From then on the gateway copies messages between the two sockets as they arrive. More in How it works, and the viewer’s controls in Using rd.
- Picture: hardware H.264 at up to 60 or 120 fps. When the network can’t keep up, the agent sends fewer frames and lowers the bitrate rather than letting a queue build up.
- Keyboard and mouse: keys are sent by their physical position, so the remote machine’s own layout applies. Ctrl and Cmd are swapped automatically between Windows and Mac. A browser tab can’t capture every system shortcut; rd Desktop can.
What rd doesn’t do
Section titled “What rd doesn’t do”- Reach the login window or a freshly rebooted machine. The agent runs inside your logged-in session. On a Mac, the recovery path (Apple Screen Sharing over Guacamole) covers it. On Windows, the optional secure-desktop service (Windows setup) shows a locked session’s lock screen and UAC prompts in the viewer; the signed-out screen after a reboot still needs a KVM or similar.
- Several viewers at once. A machine has one session at a time: connecting from a second place takes the session over, and the first viewer is told so.
- Sound or clipboard sharing. rd streams the screen, sends your input, transfers files and opens a terminal. (The protocol and the viewer can already carry Opus audio, but the agents don’t capture sound yet.)