v0.13.0

Native desktop client for Kube Workspaces: sign in to an instance, browse your
workspaces, and open a VM workspace's display in a real window.

Download

Platform	Architecture	File
Linux	x86_64	kube-workspaces-v0.13.0-linux-amd64.tar.gz
Linux	x86_64	AppImage kube-workspaces-v0.13.0-linux-amd64.AppImage
Linux	x86_64	deb kube-workspaces-0.13.0_amd64.deb
Linux	x86_64	rpm kube-workspaces-0.13.0-1.x86_64.rpm
Linux	x86_64	Flatpak io.github.kubeworkspaces.KubeWorkspaces-v0.13.0.x86_64.flatpak
Linux	arm64	kube-workspaces-v0.13.0-linux-arm64.tar.gz
Linux	arm64	Flatpak io.github.kubeworkspaces.KubeWorkspaces-v0.13.0.aarch64.flatpak
Linux	arm64	deb kube-workspaces-0.13.0_arm64.deb
Linux	arm64	rpm kube-workspaces-0.13.0-1.aarch64.rpm
macOS	Apple silicon	kube-workspaces-v0.13.0-darwin-arm64.tar.gz
macOS	Intel	kube-workspaces-v0.13.0-darwin-amd64.tar.gz
Windows	x86_64	kube-workspaces-v0.13.0-windows-amd64.zip
Windows	arm64	kube-workspaces-v0.13.0-windows-arm64.zip
Windows	x86_64	unsigned test MSI kube-workspaces-v0.13.0-windows-amd64.msi
Windows	arm64	unsigned test MSI kube-workspaces-v0.13.0-windows-arm64.msi

Verify with SHA256SUMS: sha256sum -c SHA256SUMS (covers zips, tarballs and MSIs)

This software uses code of FFmpeg licensed under the LGPLv2.1;
its source can be downloaded from https://ffmpeg.org/releases/
(pinned version, build flags and hashes: third_party/media-libs).
Opus audio uses the BSD-licensed reference implementation
(license); attribution ships
in every package. windows/arm64 and darwin/amd64 carry no media
libraries yet and use Tier 0 there (no woa64 5.1 source, no
x86_64 macOS toolchain on the arm64-only runners).

The AppImage is not part of SHA256SUMS (the in-app updater contract covers
the six archives); it ships its own sidecar: sha256sum -c kube-workspaces-v0.13.0-linux-amd64.AppImage.sha256.
The same holds for the native packages below: each ships its own sidecar checksum.

Install

Linux

tar -xzf kube-workspaces-v0.13.0-linux-amd64.tar.gz
cd kube-workspaces-linux-amd64
./kube-workspaces --help

or the AppImage (no install step; a KDE/GNOME launcher entry appears when you
integration-mount the file):

wget https://github.com/kube-workspaces/desktop-client/releases/download/v0.13.0/kube-workspaces-v0.13.0-linux-amd64.AppImage https://github.com/kube-workspaces/desktop-client/releases/download/v0.13.0/kube-workspaces-v0.13.0-linux-amd64.AppImage.sha256
sha256sum -c kube-workspaces-v0.13.0-linux-amd64.AppImage.sha256
chmod +x kube-workspaces-v0.13.0-linux-amd64.AppImage
./kube-workspaces-v0.13.0-linux-amd64.AppImage

or the native system packages (Debian/Ubuntu, Fedora/RHEL — unsigned,
like everything above):

sudo dpkg -i kube-workspaces-0.13.0_amd64.deb        # or: sudo rpm -i kube-workspaces-0.13.0-1.x86_64.rpm
kube-workspaces --help

or the Flatpak bundle (needs the GNOME 48 runtime from Flathub once):

flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
flatpak install flathub org.gnome.Platform//48
flatpak install --user io.github.kubeworkspaces.KubeWorkspaces-v0.13.0.x86_64.flatpak
flatpak run io.github.kubeworkspaces.KubeWorkspaces

System packages disable the in-app updater (your package manager owns
those files now); update them with apt/dnf/flatpak update. The web
view needs WebKitGTK 4.1 (Debian 12+, Ubuntu 24.04+, Fedora 41+).

macOS — the archive contains a Kube Workspaces.app bundle. Drag it to
Applications, or open it in place:

tar -xzf kube-workspaces-v0.13.0-darwin-arm64.tar.gz
open "kube-workspaces-darwin-arm64/Kube Workspaces.app"

Windows — recommended: unzip into %LocalAppData%\Programs\Kube Workspaces
(writable without UAC, so the built-in updater works unelevated), keep both
.exes together in one folder, then unblock and run:

Expand-Archive kube-workspaces-v0.13.0-windows-amd64.zip -DestinationPath "$env:TEMP\kw-install" -Force
New-Item -ItemType Directory -Force "$env:LocalAppData\Programs\Kube Workspaces" | Out-Null
Copy-Item "$env:TEMP\kw-install\kube-workspaces-windows-amd64\*" "$env:LocalAppData\Programs\Kube Workspaces" -Force
Get-ChildItem "$env:LocalAppData\Programs\Kube Workspaces\*.exe" | Unblock-File

The .msi files above are an unsigned test distribution for install hygiene
(Start Menu shortcut, Add/Remove entry, upgrade/uninstall; per-user by default,
msiexec /i <file> ALLUSERS=1 INSTALLDIR="C:\Program Files\Kube Workspaces" elevated for
per-machine). They warn exactly like the zip — not a trust fix. windows/arm64
is shell-only: container web UIs fall back to the system browser. Container
workspaces need the WebView2 Runtime (preinstalled on Windows 11, else the
Evergreen bootstrapper).

These binaries are not code-signed. macOS Gatekeeper will refuse to run
the app the first time: clear the quarantine attribute with
xattr -d com.apple.quarantine 'Kube Workspaces.app', or open it once via
Finder → right-click → Open. Windows SmartScreen will warn: choose
"More info" → "Run anyway". Signing and notarisation are not yet set up.

The shell is cgo-free and bundles SDL. Container/scratch workspaces open in the
embedded webview child (kube-workspaces-web) that ships inside each archive;
on Linux that child needs WebKitGTK 4.1 (libwebkit2gtk-4.1). macOS and Windows
use their bundled engines (WebKit, WebView2).

Getting started

kube-workspaces login --server https://workspaces.example.com  # opens your browser
kube-workspaces list --running
kube-workspaces                                                # graphical shell

If browser login gives trouble, --token <session-token> bypasses it.
On a machine with no OS keychain, set
KUBE_WORKSPACES_INSECURE_TOKEN_FILE=1 to fall back to a 0600 file.

Summary

21 commit(s) since v0.12.4 — 15 feature(s), 3 fix(es), 1 CI/docs, 2 unclassified.

What's Changed

✨ Features

• 57a4c5a feat(shell): align workspace context-menu labels and add action icons
• 460618e feat(shell): polish main-window close confirmation
• 0929b0e feat(shell): open session manager in an independent utility window
• 7729d0e feat(shell): add workspace right-click action menu
• cf45afd feat(viewer): add local scaling controls and stabilize shared-display test
• baa061d feat(web): remember embedded browser window arrangements
• bbda6e9 feat(shell): remember terminal and observer window arrangements
• 252a09e feat(session,shell): observe premium agent streams without guest authority
• ab7c380 feat(shell,kwclient): native Windows-aware actions and initial credentials
• 57b3fbc feat(session,kwclient): explicit agent-bridge connection purpose
• b07fb68 feat(session): finish secure console switching and watcher lifecycle
• 7de222d feat(shell): remember shell and display window arrangements
• 2ad07b9 feat(session): auto-hand off to the console for elevated windows
• 67faf31 feat(viewer): annotate blocked input with a desktop banner
• 9b5abb0 feat(session): in-session Agent/Console toggle with auto-return

🐛 Fixes

• 0c99e2e fix(viewer): open audio before starting the tier-1 producer
• 68d70e7 fix(i18n): explain workspace cold-start connection failures
• ba77850 fix(kwclient): use bearer-only native authentication

🔧 CI and tooling

• 301f9e9 chore(viewer): clean up Selkies diagnostics and cursor documentation

Other changes

• fd8951d tier1: add first-frame/upload/present debug logs for black-screen diagnosis
• 2ab0b69 never hide local cursor (RFB+Tier 1); restore system cursor on guest hide

Known caveats

This is an early release. The UI has had limited validation on real displays,
so expect rough edges in layout and scaling. Please report what you find.