Get Started with Docker - Part 6b: Clientless Remote Desktop with Apache Guacamole

In Part 6a, we set up Cloudflare Tunnel ( cloudflared ) in Docker and learned how to route public hostnames through Cloudflare's edge network with Zero-Trust Email OTP MFA and Geo-IP filtering—without opening a single inbound port on our home router.

Now that our secure remote tunnel foundation is in place, it's time to build on top of it!

In this guide, we're going to deploy Apache Guacamole, an HTML5 clientless gateway that renders full Windows Remote Desktop (RDP), VNC, and Linux SSH sessions directly inside any standard web browser. By putting Guacamole behind your Part 6a Cloudflare Tunnel, you get high-speed, secure remote desktop access to your home lab from any device, anywhere in the world!

We're going to:

Look at what Apache Guacamole is and how its microservices work

Set up your persistent Docker Config folders ( Files/AppData/Config/guacamole )

Create our Docker Compose file using Nano Text Editor

Initialize the required PostgreSQL database schema

Run and set up Apache Guacamole using Docker Compose

Connect Guacamole to your Part 6a Cloudflare Tunnel ( remote.yourdomain.com )

Configure your first Remote Desktop (RDP) and SSH connections in Guacamole

Test accessing your desktops securely inside your web browser

What's Apache Guacamole?

Apache Guacamole is a clientless web-based remote desktop gateway. It runs in a container on your network and renders full RDP (Windows), VNC, and SSH (Linux) sessions right inside any web browser.

That means you can access your home lab servers from a laptop, Chromebook, iPad, or work computer without installing any remote desktop software or VPN clients!

How Apache Guacamole Works (The 3 Microservices)

Under the hood, Apache Guacamole relies on three containerized microservices working in harmony:

⚙️ guacd (Guacamole Protocol Proxy Daemon):

The native C daemon ( guacamole/guacd ) is the protocol translator. It connects directly to your target homelab servers over RDP (port 3389 ), SSH (port 22 ), or VNC…