Add QEMU Windows 11 template with CUA computer-server support #551

synacktraa · 2025-11-07T22:29:20Z

Cua.Windows.Test.mp4

Summary

This PR adds a production-ready QEMU-based Windows 11 container to the libs/qemu directory, enabling CUA agents to interact with Windows desktop environments through the CUA computer-server.

Recent Updates (Nov 9, 2025)

Fixed critical issues from initial implementation:

✅ CUA server now installs correctly using isolated Python virtual environment
✅ Both CUA server and Caddy proxy run hidden in background (no visible windows)
✅ Golden image creation completes automatically without blocking
✅ Boot from golden image works reliably (added windows.boot marker file)
✅ Container lifecycle properly managed (exits during setup, stays alive during runtime)

What's New

Windows 11 in Docker: Enterprise edition running in QEMU/KVM with CUA computer-server and Caddy proxy
Hidden background services: Both services run via Windows scheduled tasks with LogonType S4U
Virtual environment isolation: CUA server uses isolated Python venv to prevent dependency conflicts
Automated lifecycle: Detects setup vs runtime mode, manages container lifecycle accordingly
Dual deployment modes: Support for both dev (shared folder) and azure (OEM folder) modes
Port forwarding: Server accessible at localhost:5000, noVNC at localhost:8006

Technical Details

Base Image: Uses windowsarena/windows-local:latest instead of windowsarena/winarena-base:latest to avoid unnecessary ML bloat:

Removes Python 3.9 and ML client dependencies (easyocr, onnxruntime, etc.)
Removes CUDA 11.8 libraries
Removes ML model weights (GroundingDINO, OmniParser)
Results in significantly smaller image (~25GB reduction)

Architecture:

Container (Linux) → Port Forwarding (socat) → QEMU VM (Windows 11) → CUA computer-server

Files Added

libs/qemu/
├── Dockerfile                          # Multi-stage build for dev/azure modes
├── README.md                           # Comprehensive setup and usage guide
└── src/
    ├── entry.sh                        # Container entrypoint with setup detection and lifecycle management
    └── vm/
        ├── image/                      # Place for setup.iso
        ├── setup/                      # Windows setup scripts
        │   ├── install.bat             # Entry point for Windows setup
        │   ├── setup.ps1               # Main setup orchestration
        │   ├── setup-cua-server.ps1    # CUA server setup with venv isolation
        │   ├── setup-caddy-proxy.ps1   # Caddy proxy setup with scheduled task
        │   ├── on-logon.ps1            # Starts scheduled tasks at user logon
        │   ├── setup-tools.psm1        # PowerShell utilities
        │   └── tools_config.json       # Software download mirrors
        └── unattend-files/             # Unattended installation configs
            ├── dev_win11x64-enterprise-eval.xml
            └── azure_win11x64-enterprise-eval.xml

Usage Example

# 1. Download setup.iso from Microsoft Evaluation Center
# 2. Place in src/vm/image/

# Build
docker build --build-arg DEPLOY_MODE=dev -t cua-windows:dev .

# First run - creates golden image (15-20 min)
docker run -it --rm \
    --device=/dev/kvm \
    --platform linux/amd64 \
    --name cua-windows \
    --mount type=bind,source=$(pwd)/src/vm/image/setup.iso,target=/custom.iso \
    --cap-add NET_ADMIN \
    -v $(pwd)/storage:/storage \
    -p 8006:8006 \
    -p 5000:5000 \
    -e RAM_SIZE=8G \
    -e CPU_CORES=4 \
    -e DISK_SIZE=20G \
    cua-windows:dev

# Subsequent runs - uses golden image (2-5 min)
docker run -it --rm \
    --device=/dev/kvm \
    --platform linux/amd64 \
    --name cua-windows \
    --cap-add NET_ADMIN \
    -v $(pwd)/storage:/storage \
    -p 8006:8006 \
    -p 5000:5000 \
    -e RAM_SIZE=8G \
    -e CPU_CORES=4 \
    -e DISK_SIZE=20G \
    cua-windows:dev

# Access
open http://localhost:8006              # noVNC browser
curl http://localhost:5000/status       # Computer-server API

Breaking Changes

None - this is a new addition to the libs directory.

…ation - Install Python 3.12 via Chocolatey for consistent environment - Create isolated virtual environment at %USERPROFILE%\.cua-server\venv - Install cua-computer-server package in venv to prevent conflicts - Create Windows scheduled task with VBScript hidden launcher - Use LogonType S4U for background execution without interactive session - Configure auto-restart loop for service resilience - Add firewall rule for port 5000 Replaces global pip installation approach that was failing.

- Create Caddy start script with auto-restart loop - Use VBScript wrapper to launch hidden (window mode 0) - Configure Windows scheduled task with LogonType S4U - Run reverse proxy from port 9222 to port 1337 in background - Enable auto-restart on failure for resilience Ensures Caddy runs completely hidden without visible windows.

Changes to setup.ps1: - Replace global pip CUA server install with setup-cua-server.ps1 call - Add setup-caddy-proxy.ps1 call for proxy configuration - Start WindowsArena_OnLogon task asynchronously (non-blocking) - Remove blocking Start-ScheduledTask that prevented setup completion Changes to on-logon.ps1: - Replace direct service execution with scheduled task triggers - Start Caddy-Reverse-Proxy task instead of direct caddy command - Start CUA-Computer-Server task instead of direct python command - Both services now run hidden via their respective scheduled tasks Fixes issues: - Services no longer run in visible windows - Setup script no longer blocks indefinitely - Both services run in background as proper scheduled tasks

- Create windows.boot marker file if missing (fixes boot hang) - Add /storage directory existence check before file creation - Detect initial setup mode via /custom.iso presence - Skip tail -f during setup to allow container exit - Keep container alive only during normal runtime Fixes issues: - Container now exits properly after golden image creation - Boot from golden image no longer hangs indefinitely - Automatic distinction between setup and runtime modes

libs/qemu-docker/windows/src/vm/setup/setup-caddy-proxy.ps1

libs/qemu/Dockerfile

Renamed libs/qemu to libs/qemu-docker and organized Windows implementation into windows/ subdirectory.

f-trycua · 2025-11-10T10:04:35Z

on the subsequent runs, there should be no need to mount again the .iso:

Subsequent runs - uses golden image (2-5 min)

docker run -it --rm
--device=/dev/kvm
--platform linux/amd64
--name cua-windows
--cap-add NET_ADMIN
-v $(pwd)/storage:/storage
-p 8006:8006
-p 5000:5000
-e RAM_SIZE=8G
-e CPU_CORES=4
-e DISK_SIZE=20G
cua-windows:dev

synacktraa · 2025-11-10T10:08:38Z

on the subsequent runs, there should be no need to mount again the .iso:

Subsequent runs - uses golden image (2-5 min)

docker run -it --rm \
--device=/dev/kvm \

--platform linux/amd64 \

--name cua-windows \

--cap-add NET_ADMIN \

-v $(pwd)/storage:/storage \

-p 8006:8006 \

-p 5000:5000 \

-e RAM_SIZE=8G \

-e CPU_CORES=4 \

-e DISK_SIZE=20G \

cua-windows:dev

Yes, It is documented correctly in the README - I will update the PR comment.

f-trycua · 2025-11-10T15:17:17Z

libs/qemu-docker/windows/src/vm/setup/setup-caddy-proxy.ps1

@@ -0,0 +1,104 @@
+# Setup Caddy Reverse Proxy on Windows 11


Caddy proxy not needed

libs/qemu-docker/windows/src/entry.sh

f-trycua · 2025-11-10T15:17:54Z

libs/qemu-docker/windows/src/vm/setup/setup-caddy-proxy.ps1

+
+# Create scheduled task to run at logon
+try {
+  $TaskName = 'Caddy-Reverse-Proxy'


f-trycua · 2025-11-10T15:19:21Z

libs/qemu-docker/windows/src/vm/setup/setup-cua-server.ps1

+
+# Ensure Chocolatey and Python 3.12 are present
+try {
+  $ChocoExe = Resolve-ChocoPath


are we re-installing python? Pheraps you can instead download python through the tool-config.json mechanism.

f-trycua · 2025-11-10T15:19:42Z

libs/qemu-docker/windows/src/vm/setup/tools_config.json

+      "https://github.com/git-for-windows/git/releases/download/v2.37.1.windows.1/Git-2.37.1-64-bit.exe"
+    ]
+  },
+  "7zip": {


Delete unused

f-trycua · 2025-11-10T15:26:42Z

libs/qemu-docker/windows/src/vm/unattend-files/azure_win11x64-enterprise-eval.xml

@@ -0,0 +1,467 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">


synacktraa added 7 commits November 8, 2025 03:55

feat: add QEMU Windows 11 template

ece1738

chore(qemu): set "dev" as default DEPLOY_MODE

8265403

docs(qemu): update README doc

cea9289

synacktraa marked this pull request as ready for review November 9, 2025 19:09

f-trycua reviewed Nov 9, 2025

View reviewed changes

libs/qemu-docker/windows/src/vm/setup/setup-caddy-proxy.ps1 Show resolved Hide resolved

f-trycua reviewed Nov 9, 2025

View reviewed changes

libs/qemu/Dockerfile Outdated Show resolved Hide resolved

synacktraa added 3 commits November 10, 2025 14:27

refactor(qemu): centralize logging with shared Write-Log function

c694c6a

chore(qemu): remove unnecessary comments

c59aa52

refactor: restructure as qemu-docker with OS-specific folders

8150d02

Renamed libs/qemu to libs/qemu-docker and organized Windows implementation into windows/ subdirectory.

synacktraa requested a review from f-trycua November 10, 2025 09:36

f-trycua reviewed Nov 10, 2025

View reviewed changes

libs/qemu-docker/windows/src/entry.sh Show resolved Hide resolved

f-trycua reviewed Nov 10, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Add QEMU Windows 11 template with CUA computer-server support #551

Add QEMU Windows 11 template with CUA computer-server support #551

Uh oh!

synacktraa commented Nov 7, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

f-trycua commented Nov 10, 2025 •

edited

Loading

Uh oh!

synacktraa commented Nov 10, 2025

Subsequent runs - uses golden image (2-5 min)

Uh oh!

f-trycua Nov 10, 2025

Uh oh!

Uh oh!

f-trycua Nov 10, 2025

Uh oh!

f-trycua Nov 10, 2025

Uh oh!

f-trycua Nov 10, 2025

Uh oh!

f-trycua Nov 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -0,0 +1,467 @@
		<?xml version="1.0" encoding="UTF-8"?>
		<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">

Uh oh!

Add QEMU Windows 11 template with CUA computer-server support #551

Are you sure you want to change the base?

Add QEMU Windows 11 template with CUA computer-server support #551

Uh oh!

Conversation

synacktraa commented Nov 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Recent Updates (Nov 9, 2025)

What's New

Technical Details

Files Added

Usage Example

Breaking Changes

Uh oh!

Uh oh!

Uh oh!

f-trycua commented Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Subsequent runs - uses golden image (2-5 min)

Uh oh!

synacktraa commented Nov 10, 2025

Subsequent runs - uses golden image (2-5 min)

Uh oh!

f-trycua Nov 10, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

f-trycua Nov 10, 2025

Choose a reason for hiding this comment

Uh oh!

f-trycua Nov 10, 2025

Choose a reason for hiding this comment

Uh oh!

f-trycua Nov 10, 2025

Choose a reason for hiding this comment

Uh oh!

f-trycua Nov 10, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

synacktraa commented Nov 7, 2025 •

edited

Loading

f-trycua commented Nov 10, 2025 •

edited

Loading