{"docs":[{"id":32,"title":"Kasm Workspaces 1.19: Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production","description":"Kubernetes deployment in Kasm Workspaces is now Generally Available. That means standardized backends, production-ready Helm charts, and Helm-based RDP Gateway configuration - all shipping as a supported, first-class deployment path. ","heroImage":{"id":62,"alt":"Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production ","caption":null,"author":6,"updatedAt":"2026-06-15T13:10:59.802Z","createdAt":"2026-06-15T13:10:56.200Z","url":"/api/media/file/Kasm%20Workspaces%201.19_%20Kubernetes%20Goes%20GA%2C%20Zero-Trust%20Egress%2C%20and%20a%20Release%20Built%20for%20Production%20(1).png","thumbnailURL":"/api/media/file/Kasm%20Workspaces%201.19_%20Kubernetes%20Goes%20GA%2C%20Zero-Trust%20Egress%2C%20and%20a%20Release%20Built%20for%20Production%20(1)-300x214.png","filename":"Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1).png","mimeType":"image/png","filesize":1303253,"width":2000,"height":1429,"focalX":50,"focalY":50,"sizes":{"thumbnail":{"url":"/api/media/file/Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-300x214.png","width":300,"height":214,"mimeType":"image/png","filesize":57112,"filename":"Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-300x214.png"},"square":{"url":"/api/media/file/Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-500x500.png","width":500,"height":500,"mimeType":"image/png","filesize":205155,"filename":"Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-500x500.png"},"small":{"url":"/api/media/file/Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-600x429.png","width":600,"height":429,"mimeType":"image/png","filesize":191426,"filename":"Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-600x429.png"},"medium":{"url":"/api/media/file/Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-900x643.png","width":900,"height":643,"mimeType":"image/png","filesize":383263,"filename":"Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-900x643.png"},"large":{"url":"/api/media/file/Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-1400x1000.png","width":1400,"height":1000,"mimeType":"image/png","filesize":853058,"filename":"Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-1400x1000.png"},"xlarge":{"url":"/api/media/file/Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-1920x1372.png","width":1920,"height":1372,"mimeType":"image/png","filesize":1394011,"filename":"Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-1920x1372.png"},"og":{"url":"/api/media/file/Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-1200x630.png","width":1200,"height":630,"mimeType":"image/png","filesize":527643,"filename":"Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-1200x630.png"}}},"content":{"root":{"type":"root","format":"","indent":0,"version":1,"children":[{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"The gap between “interesting technology” and “production-ready infrastructure” is real, and it takes deliberate engineering to close it. Kasm Workspaces 1.19 is a release that closes several of those gaps at once - moving Kubernetes support from preview to Generally Available, hardening the networking layer with a native OpenZiti egress provider, and delivering a set of platform improvements that make Kasm Workspaces meaningfully easier to operate at scale.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"This is not a release full of shiny features for the demo. It is a release built for teams who are running Kasm Workspaces in production and need the platform to grow with them.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Kubernetes Is Now Generally Available","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"For teams that have been watching Kasm’s Kubernetes support from a distance, 1.19 is the moment to look again.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Kubernetes deployment in Kasm Workspaces is now Generally Available. That means standardized backends, production-ready Helm charts, and Helm-based RDP Gateway configuration - all shipping as a supported, first-class deployment path. If your organization already runs workloads on Kubernetes, you now have a clean, declarative way to run Kasm Workspaces alongside them.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"The practical implications go beyond just “it works now.” Helm-based deployment means your Kasm Workspaces configuration lives in version control. It means your infrastructure team can review workspace platform changes the same way they review application deployments - as code, in a pull request, with a traceable history. That is a different operational posture than a wizard-driven install, and it matters for compliance-focused environments.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Zero-Trust Egress with OpenZiti","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Network access control is one of the more underappreciated dimensions of a workspace platform. You can isolate the session itself beautifully and still create exposure through permissive egress.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Kasm Workspaces 1.19 adds a native OpenZiti egress provider, giving administrators the ability to route workspace traffic through a software-defined zero-trust network fabric rather than relying on traditional VPN or firewall rules. OpenZiti connections are mutually authenticated, encrypted by default, and scoped to specific services - not the broad network access that VPNs typically grant.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"For security teams that have been working toward a zero-trust architecture, this is a meaningful integration. It brings the egress layer into the same policy-driven model that governs the session itself.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Self-Service Diagnostics: Less Time Fighting the Platform","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"One of the quieter but consistently impactful investments in any platform is making it easier to understand what is happening when something goes wrong.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Version 1.19 introduces a self-service diagnostics and metrics system covering metrics collection and export, system health checks, and a support bundle generator. Administrators can now pull structured diagnostic data without needing to escalate to a support ticket or dig through logs manually. For teams running Kasm Workspaces as part of a larger observability stack, the metrics export feeds directly into existing monitoring pipelines.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"This is the kind of work that does not generate excitement in a feature announcement but meaningfully reduces operational friction over time.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Configuration as Code, Done Properly","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Kasm Workspaces 1.19 delivers a substantial refresh to configuration import and export. The improvements include table-level selection so you can export exactly what you need, UUID tokenization to make configs portable across environments, a sanitize option to strip environment-specific values, additive imports that merge rather than overwrite, and preset export modes for common scenarios.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Taken together, these changes make it practical to treat Kasm Workspaces configuration as a versioned artifact - something you can promote from development to staging to production, review in a diff tool, and roll back if needed. That is what “config as code” actually means in practice, and most platforms do not get there cleanly.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"GPU Workloads and AI/ML Use Cases: MiG Support","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Organizations running AI and ML workloads have increasingly needed a way to share expensive GPU resources across multiple container sessions without the overhead of full GPU passthrough. NVIDIA Multi-Instance GPU (MiG) partitioning solves that problem at the hardware level, but the platform delivering those sessions needs to understand MiG topology to take advantage of it.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Kasm Workspaces 1.19 adds native NVIDIA MiG support, so administrators can assign MiG slices to container sessions. This makes GPU-accelerated workspaces practical for larger teams where a single high-end card needs to serve multiple concurrent users - a common scenario in data science and ML engineering environments.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"vSphere: Faster Provisioning with Instant Clones and CloudInit","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"For environments running Kasm Workspaces on VMware vSphere, 1.19 delivers two complementary improvements: Instant Clone support and CloudInit startup scripts.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Instant Clones reduce the time it takes to provision a new VM session by forking from a running parent VM rather than starting from a snapshot. CloudInit startup scripts let administrators run configuration logic at session start without baking everything into the base image. Together, these changes tighten the provisioning loop - meaning users spend less time waiting and infrastructure teams have more flexibility in how they manage session images.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Linux VMs via RDP, Windows Autoscale Fixes, and More","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Version 1.19 also includes Phase 1 of Linux VM support via RDP, expanding the range of session types Kasm Workspaces can deliver beyond containers and Windows machines. Windows autoscale deployments now correctly use the Kasm Server Name as the hostname, resolving a long-standing friction point for teams managing larger Windows fleets.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"On the infrastructure side: PostgreSQL has been updated from version 14 to a newer release, SQLAlchemy has been updated to 2.0, and Guacamole has been updated to version 1.6. Debian 13 (Trixie) is now a supported install and upgrade target.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"The public exec_kasm API is available for teams that need programmatic control over session execution. Server Auto-Expiration lets administrators define a lifecycle for servers so they do not accumulate indefinitely. Rolling builds are now the default, improving release stability. The install script now supports copying existing SSL certificates at install time - a small thing that eliminates a common deployment friction point.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"An Honest Assessment","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"1.19 is a release that rewards teams who are already invested in the platform. The Kubernetes GA milestone, the OpenZiti integration, and the configuration import/export overhaul are all changes that compound over time - they make the platform more operable, more auditable, and more adaptable to the infrastructure practices that serious engineering organizations already follow.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"For teams evaluating Kasm Workspaces for the first time, 1.19 is also a meaningful moment. The Kubernetes deployment path being Generally Available means you are not adopting an experimental feature - you are adopting a supported, Helm-driven deployment model that integrates with the toolchain you already use.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Get Started","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Upgrade instructions, Helm chart documentation, and the full 1.19 changelog are available at ","type":"text","style":"","detail":0,"format":0,"version":1},{"id":"6a2c3b123183f472e901c2e6","type":"link","fields":{"url":"https://kasm.com/downloads","newTab":false,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"kasm.com/downloads","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"mode":"normal","text":".","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"If you are new to Kasm Workspaces, the documentation at ","type":"text","style":"","detail":0,"format":0,"version":1},{"id":"6a2c3b123183f472e901c2e7","type":"link","fields":{"url":"https://kasmweb.com/docs","newTab":false,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"kasmweb.com/docs","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"mode":"normal","text":" is the right starting point.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"About Kasm Workspaces","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Kasm Technologies delivers a modern platform for secure, containerized desktop and application access. Kasm Workspaces streams browsers, desktops, and applications directly to users through ephemeral, policy-controlled sessions - eliminating the cost, rigidity, and risk of traditional VDI. Built by a team with deep roots in federal cybersecurity and offensive/defensive operations, Kasm is used by organizations ranging from government agencies to Fortune 500 companies to deliver secure, scalable developer and end-user environments.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Learn more at ","type":"text","style":"","detail":0,"format":0,"version":1},{"id":"6a2c3b123183f472e901c2e9","type":"link","fields":{"url":"https://kasm.com","newTab":false,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"kasm.com","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"mode":"normal","text":".","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0}],"direction":"ltr"}},"relatedPosts":[{"id":10,"title":"Introducing Kasm Workspaces v1.18: Secure Access, Simplified Scaling, and Enhanced Streaming ","description":"We are excited to announce Kasm Workspaces v1.18, a feature-rich release that makes it easier to deploy at scale, enhances the end-user experience, and introduces new enterprise features like Smartcard Passthrough. ","heroImage":18,"content":{"root":{"type":"root","format":"","indent":0,"version":1,"children":[{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Remote work and secure application delivery continue to evolve—and so does Kasm Workspaces. We are excited to announce Kasm Workspaces v1.18, a feature-rich release that makes it easier to deploy at scale, enhances the end-user experience, and introduces new enterprise features like Smartcard Passthrough. ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Kasm Workspaces v1.18 builds on our mission to deliver high-performance digital workspaces that are simple to administer and great to use—whether you’re supporting a handful of users or thousands across multiple regions. ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"type":"quote","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"“Kasm 1.18 delivers on our commitment to improve the quality of life for users and administrators of the Kasm platform.” — Justin Travis, CEO and Co-Founder, Kasm Technologies ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"quote","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"“The 1.18 release marks a significant step forward in helping our customers adopt next-generation technology, regardless of their business needs.\" — Daniel Ben-Chitrit, Chief Product Officer, Kasm Technologies ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"For a quick walkthrough, check out the release video (YouTube): ","type":"text","style":"","detail":0,"format":0,"version":1},{"type":"linebreak","version":1},{"id":"692490dcea6cc988b617467a","type":"link","fields":{"url":"https://youtu.be/ld80EFi2lfk","newTab":true,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"https://youtu.be/ld80EFi2lfk","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"mode":"normal","text":"  ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"To see Kasm streaming in action right in your browser, try the on-demand demo: ","type":"text","style":"","detail":0,"format":0,"version":1},{"type":"linebreak","version":1},{"id":"692490dcea6cc988b617467b","type":"link","fields":{"url":"https://app.kasmweb.com/#/cast/kasmos","newTab":true,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"https://app.kasmweb.com/#/cast/kasmos","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"mode":"normal","text":"  ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"What’s New in v1.18 ","type":"text","style":"","detail":0,"format":1,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Kasm Workspaces v1.18 focuses on three big themes: ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"tag":"ol","type":"list","start":1,"format":"start","indent":0,"version":1,"children":[{"type":"listitem","value":1,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Enterprise-grade Secure Access ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"listitem","value":2,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Enhanced Streaming Performance ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"listitem","value":3,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Simplified Scaling and Infrastructure Management ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"}],"listType":"number","direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Smartcard Pass-through + New Desktop Service ","type":"text","style":"","detail":0,"format":1,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Many organizations require smartcards for secure authentication. With version 1.18, Kasm introduces Smartcard Pass-through, supported by a new Desktop Service client installer for Windows and macOS. This feature lets users authenticate into streamed environments using their smartcards without losing the familiar Kasm browser-based workflow. ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Why it matters: ","type":"text","style":"","detail":0,"format":0,"version":1},{"type":"linebreak","version":1},{"mode":"normal","text":"You can now incorporate smartcard-based security policies directly into Kasm Workspaces, making it easier to support regulated environments and zero-trust access models. ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"KasmVNC v1.4: DPI Scaling and GPU Acceleration ","type":"text","style":"","detail":0,"format":1,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Streaming clarity and responsiveness are essential to the Kasm experience, and v1.18 introduces KasmVNC v1.4 with two significant improvements. ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"tag":"ul","type":"list","start":1,"format":"start","indent":0,"version":1,"children":[{"type":"listitem","value":1,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"DPI scaling for sharper, more readable sessions across high-resolution displays ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"listitem","value":2,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Chrome GPU acceleration for higher FPS and smoother interaction in supported environments ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"}],"listType":"bullet","direction":"ltr"},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Why it matters: ","type":"text","style":"","detail":0,"format":0,"version":1},{"type":"linebreak","version":1},{"mode":"normal","text":"End users experience a significantly improved performance—especially on modern laptops, large monitors, and when using graphics-intensive web apps. Learn more about KasmVNC. ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Kubernetes Helm Chart Updates for Modern Deployments ","type":"text","style":"","detail":0,"format":1,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Kasm Workspaces continues to enhance its Kubernetes readiness. v1.18 introduces important Helm chart improvements, including: ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"tag":"ul","type":"list","start":1,"format":"start","indent":0,"version":1,"children":[{"type":"listitem","value":1,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Multi-zone deployment support ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"listitem","value":2,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Simplified upgrades ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"listitem","value":3,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Standalone database options ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"}],"listType":"bullet","direction":"ltr"},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Why it matters: ","type":"text","style":"","detail":0,"format":0,"version":1},{"type":"linebreak","version":1},{"mode":"normal","text":"Teams running Kasm in Kubernetes environments gain more flexibility, smoother scaling options, and easier operational control across regions. ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Scaling and Admin Features That Save Time ","type":"text","style":"","detail":0,"format":1,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Enterprise deployments require consistent, low-effort scaling. v1.18 introduces several enhancements focused on increasing admin efficiency. ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"tag":"ul","type":"list","start":1,"format":"start","indent":0,"version":1,"children":[{"type":"listitem","value":1,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Workspace Labels — apply controls across agents, pools, and zones ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"listitem","value":2,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Bulk Import — quickly add users and servers as your environment grows ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"listitem","value":3,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Agent Draining — gracefully offload workloads during maintenance windows ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"listitem","value":4,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Enhanced Server Enrollment — streamlined bulk deployment of Windows Servers ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"listitem","value":5,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"User Assignment — map users to dedicated server resources ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"listitem","value":6,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Container Logging Console Access — view workspace logs directly in the logging UI ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"}],"listType":"bullet","direction":"ltr"},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Why it matters: ","type":"text","style":"","detail":0,"format":0,"version":1},{"type":"linebreak","version":1},{"mode":"normal","text":"These features lower manual effort and simplify managing large deployments without downtime. ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"RDP Gateway and Infrastructure Enhancements ","type":"text","style":"","detail":0,"format":1,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"v1.18 modernizes RDP connectivity and improves platform infrastructure: ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"tag":"ul","type":"list","start":1,"format":"start","indent":0,"version":1,"children":[{"type":"listitem","value":1,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"RDP Gateway update to Apache Guacamole v1.5.5 ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"listitem","value":2,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"New workspace images including Debian Trixie, Fedora 41, Obsidian, and Cyberbro ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"listitem","value":3,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Vulkan GPU acceleration for Chromium-based browsers ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"listitem","value":4,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Redis chat depreciation (chat removed from session sharing) ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"listitem","value":5,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Security tightening, including removal, of file browsing from browser images ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"listitem","value":6,"format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Documentation migration to a new ecosystem at ","type":"text","style":"","detail":0,"format":0,"version":1},{"type":"autolink","fields":{"url":"https://docs.kasm.com","linkType":"custom"},"format":"","indent":0,"version":2,"children":[{"mode":"normal","text":"https://docs.kasm.com","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"mode":"normal","text":" ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"}],"listType":"bullet","direction":"ltr"},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Why it matters: ","type":"text","style":"","detail":0,"format":0,"version":1},{"type":"linebreak","version":1},{"mode":"normal","text":"You gain a more secure platform, more modern image options, and increased performance headroom for future workloads. ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Built for Secure, Scalable Workspaces—Anywhere ","type":"text","style":"","detail":0,"format":1,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Kasm Workspaces is a sophisticated container streaming platform that allows users to securely access desktops, applications, and web services from any device using a browser. By isolating workloads in Docker containers, Kasm helps prevent data leaks and supports strong security measures without compromising usability. ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Whether your organization needs secure browsing, app streaming, remote work environments, collaboration tool access, or education labs, Kasm Workspaces offers a flexible solution built for enterprise scale. ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Get the Full Release Details ","type":"text","style":"","detail":0,"format":1,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Want a deep dive into every feature, improvement, and fix in v1.18? ","type":"text","style":"","detail":0,"format":0,"version":1},{"type":"linebreak","version":1},{"mode":"normal","text":"Read the full release notes here: ","type":"text","style":"","detail":0,"format":0,"version":1},{"id":"692490dcea6cc988b617467c","type":"link","fields":{"url":"https://docs.kasm.com/docs/release_notes/1.18.0","newTab":true,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"https://docs.kasm.com/docs/release_notes/1.18.0","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"mode":"normal","text":"  ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":" ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":null,"textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"Ready to Try v1.18? ","type":"text","style":"","detail":0,"format":1,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"If you’re already running Kasm Workspaces, upgrade to v1.18 to take advantage of smarter access, smoother streaming, and admin features designed for real-world scaling. ","type":"text","style":"","detail":0,"format":0,"version":1},{"id":"692490dcea6cc988b617467d","type":"link","fields":{"url":"https://kasm.com/downloads","newTab":true,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"Install v1.18 here.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"mode":"normal","text":" ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"mode":"normal","text":"If you’re new to Kasm, now’s a great time to see what secure, browser-based workspaces can do for your team. Start with the demo or contact us to talk through your use case. ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"left","indent":0,"version":1,"children":[{"id":"692490dcea6cc988b617467e","type":"link","fields":{"url":"https://kasm.com/get-started","newTab":true,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"Get Started with Kasm Workspaces","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"mode":"normal","text":" ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":null,"textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0}],"direction":"ltr"}},"categories":[33,34,35,36,37,38,39,40,41],"meta":{"image":null,"description":"We are excited to announce Kasm Workspaces v1.18, a feature-rich release that makes it easier to deploy at scale, enhances the end-user experience, and introduces new enterprise features like Smartcard Passthrough. "},"publishedAt":"2025-11-24T20:00:00.000Z","authors":[6],"populatedAuthors":[{"id":6,"name":"Jessica Banerjee","image":"/api/media/file/Kasm_Logo_Final.png"}],"slug":"introducing-kasm-workspaces-v118-secure-access-simplified-scaling-and-enhanced-streaming"}],"categories":[{"id":41,"title":"Platform Updates","author":6,"slug":"platform-updates","slugLock":true,"updatedAt":"2025-12-29T21:24:20.149Z","createdAt":"2025-12-29T21:24:20.148Z"}],"meta":{"title":"Kasm Workspaces 1.19: Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production","image":{"id":62,"alt":"Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production ","caption":null,"author":6,"updatedAt":"2026-06-15T13:10:59.802Z","createdAt":"2026-06-15T13:10:56.200Z","url":"/api/media/file/Kasm%20Workspaces%201.19_%20Kubernetes%20Goes%20GA%2C%20Zero-Trust%20Egress%2C%20and%20a%20Release%20Built%20for%20Production%20(1).png","thumbnailURL":"/api/media/file/Kasm%20Workspaces%201.19_%20Kubernetes%20Goes%20GA%2C%20Zero-Trust%20Egress%2C%20and%20a%20Release%20Built%20for%20Production%20(1)-300x214.png","filename":"Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1).png","mimeType":"image/png","filesize":1303253,"width":2000,"height":1429,"focalX":50,"focalY":50,"sizes":{"thumbnail":{"url":"/api/media/file/Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-300x214.png","width":300,"height":214,"mimeType":"image/png","filesize":57112,"filename":"Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-300x214.png"},"square":{"url":"/api/media/file/Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-500x500.png","width":500,"height":500,"mimeType":"image/png","filesize":205155,"filename":"Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-500x500.png"},"small":{"url":"/api/media/file/Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-600x429.png","width":600,"height":429,"mimeType":"image/png","filesize":191426,"filename":"Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-600x429.png"},"medium":{"url":"/api/media/file/Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-900x643.png","width":900,"height":643,"mimeType":"image/png","filesize":383263,"filename":"Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-900x643.png"},"large":{"url":"/api/media/file/Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-1400x1000.png","width":1400,"height":1000,"mimeType":"image/png","filesize":853058,"filename":"Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-1400x1000.png"},"xlarge":{"url":"/api/media/file/Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-1920x1372.png","width":1920,"height":1372,"mimeType":"image/png","filesize":1394011,"filename":"Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-1920x1372.png"},"og":{"url":"/api/media/file/Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-1200x630.png","width":1200,"height":630,"mimeType":"image/png","filesize":527643,"filename":"Kasm Workspaces 1.19_ Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production (1)-1200x630.png"}}},"description":"Kasm Workspaces 1.19 brings Kubernetes GA, OpenZiti zero-trust egress, NVIDIA MiG support, self-service diagnostics, and enterprise-ready scalability."},"publishedAt":"2026-06-15T06:00:00.000Z","authors":[6],"populatedAuthors":[{"id":6,"name":"Jessica Banerjee","image":"/api/media/file/Kasm_Logo_Final.png"}],"slug":"kasm-workspaces-119-kubernetes-goes-ga-zero-trust-egress-and-a-release-built-for-production","slugLock":false,"updatedAt":"2026-06-15T13:11:11.972Z","createdAt":"2026-06-12T16:58:23.735Z","_status":"published"},{"id":31,"title":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale","description":"Kubernetes was designed to manage complex, distributed platform deployments declaratively. When Kasm’s management and control plane components are deployed via Helm into a Kubernetes cluster, the operational characteristics of the platform change fundamentally.","heroImage":{"id":63,"alt":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale ","caption":null,"author":6,"updatedAt":"2026-06-15T13:11:33.997Z","createdAt":"2026-06-15T13:11:32.128Z","url":"/api/media/file/Why%20Kubernetes%20Is%20the%20Right%20Foundation%20for%20Operating%20Kasm%20at%20Scale%20(1).jpg","thumbnailURL":"/api/media/file/Why%20Kubernetes%20Is%20the%20Right%20Foundation%20for%20Operating%20Kasm%20at%20Scale%20(1)-300x214.jpg","filename":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1).jpg","mimeType":"image/jpeg","filesize":144013,"width":2000,"height":1429,"focalX":50,"focalY":50,"sizes":{"thumbnail":{"url":"/api/media/file/Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-300x214.jpg","width":300,"height":214,"mimeType":"image/jpeg","filesize":7753,"filename":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-300x214.jpg"},"square":{"url":"/api/media/file/Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-500x500.jpg","width":500,"height":500,"mimeType":"image/jpeg","filesize":21338,"filename":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-500x500.jpg"},"small":{"url":"/api/media/file/Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-600x429.jpg","width":600,"height":429,"mimeType":"image/jpeg","filesize":23697,"filename":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-600x429.jpg"},"medium":{"url":"/api/media/file/Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-900x643.jpg","width":900,"height":643,"mimeType":"image/jpeg","filesize":46298,"filename":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-900x643.jpg"},"large":{"url":"/api/media/file/Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-1400x1000.jpg","width":1400,"height":1000,"mimeType":"image/jpeg","filesize":87307,"filename":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-1400x1000.jpg"},"xlarge":{"url":"/api/media/file/Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-1920x1372.jpg","width":1920,"height":1372,"mimeType":"image/jpeg","filesize":136231,"filename":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-1920x1372.jpg"},"og":{"url":"/api/media/file/Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-1200x630.jpg","width":1200,"height":630,"mimeType":"image/jpeg","filesize":54489,"filename":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-1200x630.jpg"}}},"content":{"root":{"type":"root","format":"","indent":0,"version":1,"children":[{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Most conversations about Kubernetes focus on application workloads — microservices, APIs, batch processing pipelines. The idea that Kubernetes should also be the operational home for your workspace delivery platform tends to generate a moment’s hesitation the first time you hear it.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"That hesitation is worth taking seriously. Then set it aside, because the operational model Kubernetes provides maps almost perfectly onto the day-2 management problems that make running workspace infrastructure at scale genuinely hard.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"The Problem with Static Desktop Infrastructure","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Legacy desktop delivery infrastructure is built around permanence. Virtual machines are provisioned, configured, and then managed indefinitely. Patches are applied in place. Images drift. The gap between what your gold image looked like at provisioning time and what a user’s environment looks like six months later is filled with accumulated state — installed software, configuration changes, browser extensions, downloaded files, and credentials stored in ways that were never sanctioned.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"This is not a criticism of the teams managing that infrastructure. It is a structural property of persistent desktop environments. The longer a desktop exists, the more it diverges from its intended state. And divergence creates risk.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"At scale, these problems multiply. A fleet of five hundred persistent VMs is five hundred independent state management problems. Rolling out an image update means coordinating reboots, managing user interruption windows, and handling the inevitable edge cases where the update interacts badly with accumulated local state. For security-sensitive environments — government agencies, financial services firms, healthcare organizations — the compliance overhead of auditing that kind of fleet is substantial.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Kasm Workspaces was designed around an ephemeral session model: sessions that are created from a known-good image, run for the duration of a user’s work, and are discarded completely. No accumulated state. No drift. Every session starts from the same baseline.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"The operational challenge is managing the platform that delivers those sessions consistently, at scale, across environments. That is where Kubernetes enters the picture.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Why Kubernetes Changes the Game for Platform Operations","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Kubernetes was designed to manage complex, distributed platform deployments declaratively. When Kasm’s management and control plane components are deployed via Helm into a Kubernetes cluster, the operational characteristics of the platform change fundamentally.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Declarative configuration.","type":"text","style":"","detail":0,"format":1,"version":1},{"mode":"normal","text":" Kubernetes deployments are defined as code — Helm charts, values files, configuration exports stored in version control. The state of your Kasm deployment, including how it is configured and how it is connected to the rest of your infrastructure, is expressed in files that can be reviewed, versioned, and audited. For compliance-driven organizations, the ability to demonstrate that your infrastructure matches a documented, version-controlled specification is operationally significant.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Portability.","type":"text","style":"","detail":0,"format":1,"version":1},{"mode":"normal","text":" Kubernetes runs on every major cloud provider and on-premises. An organization that deploys Kasm’s management layer on a self-hosted Kubernetes cluster today can migrate to a managed Kubernetes service later without rearchitecting the workspace platform. The Helm charts work. The configuration works. The operational knowledge transfers. Infrastructure decisions no longer lock the workspace platform in place.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Managed upgrade paths.","type":"text","style":"","detail":0,"format":1,"version":1},{"mode":"normal","text":" Helm-managed deployments make upgrading Kasm a controlled, reversible process. Rolling updates reduce disruption. Failed updates can be rolled back without manual intervention. For organizations managing multiple Kasm environments, this matters: keeping deployments current becomes an operational routine, not a project.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"What Kasm Workspaces on Kubernetes Looks Like in Practice","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Deploying Kasm Workspaces on Kubernetes starts with the official Helm charts, which cover Kasm’s management and control plane components — the parts of the platform responsible for orchestrating sessions, managing users and policies, handling authentication, and exposing the administrative interface. A minimal evaluation install can be up and running in a cluster with a handful of commands. A production deployment is more involved, but the configuration lives in values files that are readable, diffable, and stored in version control.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Importantly, workspace sessions themselves — the secure browsers, virtual desktops, and streamed applications that users connect to — run on dedicated Kasm agent servers, not inside the Kubernetes cluster. The Kubernetes deployment manages Kasm’s control plane. The agent infrastructure that delivers sessions is provisioned and scaled separately, according to the organization’s capacity model. This is a meaningful architectural distinction: Kubernetes provides the operational foundation for managing the platform, while session delivery remains on agent infrastructure designed for that purpose.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"The Configuration Import/Export system is a meaningful part of the operational story. The ability to export Kasm platform configuration — workspace types, access policies, image registries, network settings — as a portable, sanitized artifact means your Kasm configuration can live in the same repository as your Helm values files. Promoting a configuration from a staging environment to production becomes a controlled, reviewable process rather than a manual re-configuration exercise. Environment drift between staging and production, one of the most persistent sources of “it worked in staging” failures, becomes manageable.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"For organizations connecting workspace sessions to internal services, Kasm supports configurable egress providers. The OpenZiti integration gives administrators the option to route session egress traffic through an existing OpenZiti-based zero-trust network — organizations that already run OpenZiti infrastructure can extend it to cover Kasm session connectivity without additional VPN configuration or broad network access grants. This is a complement to Kubernetes network policy, not a replacement for it: Kubernetes controls platform component communication inside the cluster; OpenZiti governs how workspace sessions reach internal services.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"The Operational Case for Platform Teams","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Three operational questions tend to drive the adoption of Kubernetes-based Kasm deployments among platform engineering teams.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"How do we keep multiple Kasm environments consistent?","type":"text","style":"","detail":0,"format":1,"version":1},{"mode":"normal","text":" Organizations running separate Kasm instances for different departments, regions, security classifications, or development stages face a consistency problem. Without a declarative, version-controlled deployment model, environments diverge. Helm-based deployment with shared charts and environment-specific values files makes consistency a structural property of the deployment model rather than a discipline that has to be enforced manually.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"How do we manage Kasm upgrades without disrupting operations?","type":"text","style":"","detail":0,"format":1,"version":1},{"mode":"normal","text":" Rolling Kasm upgrades through Helm means upgrade operations are predictable, reversible, and integrated with the same change management process the team uses for everything else. There is no separate “Kasm upgrade procedure” that lives outside the standard operational workflow.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"How do we demonstrate infrastructure compliance?","type":"text","style":"","detail":0,"format":1,"version":1},{"mode":"normal","text":" Regulated organizations need to show that their infrastructure matches a documented, authorized configuration. Helm charts in version control, GitOps deployment pipelines, and exportable Kasm configuration artifacts together provide a clear configuration audit trail — from the Kubernetes deployment specification down to the Kasm platform settings.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Where This Deployment Model Makes the Most Sense","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Enterprise deployments with multiple environments.","type":"text","style":"","detail":0,"format":1,"version":1},{"mode":"normal","text":" Organizations running Kasm across multiple regions, data centers, or tenancy boundaries benefit most from a deployment model that enforces consistency at scale. Helm-based deployment with config-as-code practices makes managing a distributed Kasm fleet operationally tractable.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Government and classified environments.","type":"text","style":"","detail":0,"format":1,"version":1},{"mode":"normal","text":" Agencies handling sensitive or classified data need workspace infrastructure that can demonstrate consistent configuration. Kubernetes-based deployments with Helm chart management and GitOps workflows provide an auditable configuration trail. Air-gapped Kubernetes clusters are supported for environments where the management plane must remain isolated. The zero-trust egress integration means workspace network access can be scoped tightly to authorized services.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Developer and engineering workspaces.","type":"text","style":"","detail":0,"format":1,"version":1},{"mode":"normal","text":" Platform teams managing Kasm as developer workspace infrastructure benefit from treating it as a first-class platform service: versioned, monitored, upgraded through a pipeline, and configured alongside the rest of the organization’s infrastructure. Developer workspaces running through Kasm on Kubernetes are fully consistent, fully ephemeral — code and credentials stay inside the session, not on the endpoint — and operationally managed through the same tooling the platform team uses everywhere else.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Getting Started","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"For teams evaluating a Kubernetes-based Kasm deployment, the documentation at ","type":"text","style":"","detail":0,"format":0,"version":1},{"id":"6a2c3e733183f472e901c2f3","type":"link","fields":{"url":"https://kasmweb.com/docs","newTab":false,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"kasmweb.com/docs","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"mode":"normal","text":" covers both single-node evaluation configurations and multi-zone production architectures. The Helm charts are the right starting point for understanding the deployment model.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"The gap between “interesting technology” and “production infrastructure” closes when the operational model is sound. Kubernetes provides that model for managing Kasm at scale: declarative, portable, GitOps-compatible, and built for the day-2 operations that determine whether platform infrastructure is actually sustainable to run.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"About Kasm Workspaces","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Kasm Technologies delivers a modern platform for secure, containerized desktop and application access. Kasm Workspaces streams browsers, desktops, and applications directly to users through ephemeral, policy-controlled sessions — eliminating the cost, rigidity, and risk of traditional VDI. Built by a team with deep roots in federal cybersecurity and offensive/defensive operations, Kasm is used by organizations ranging from government agencies to Fortune 500 companies to deliver secure, scalable developer and end-user environments.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Learn more at ","type":"text","style":"","detail":0,"format":0,"version":1},{"id":"6a2c3e733183f472e901c2f5","type":"link","fields":{"url":"https://kasm.com","newTab":false,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"kasm.com","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"mode":"normal","text":".","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0}],"direction":"ltr"}},"relatedPosts":[{"id":32,"title":"Kasm Workspaces 1.19: Kubernetes Goes GA, Zero-Trust Egress, and a Release Built for Production","description":"Kubernetes deployment in Kasm Workspaces is now Generally Available. That means standardized backends, production-ready Helm charts, and Helm-based RDP Gateway configuration - all shipping as a supported, first-class deployment path. ","heroImage":62,"content":{"root":{"type":"root","format":"","indent":0,"version":1,"children":[{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"The gap between “interesting technology” and “production-ready infrastructure” is real, and it takes deliberate engineering to close it. Kasm Workspaces 1.19 is a release that closes several of those gaps at once - moving Kubernetes support from preview to Generally Available, hardening the networking layer with a native OpenZiti egress provider, and delivering a set of platform improvements that make Kasm Workspaces meaningfully easier to operate at scale.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"This is not a release full of shiny features for the demo. It is a release built for teams who are running Kasm Workspaces in production and need the platform to grow with them.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Kubernetes Is Now Generally Available","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"For teams that have been watching Kasm’s Kubernetes support from a distance, 1.19 is the moment to look again.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Kubernetes deployment in Kasm Workspaces is now Generally Available. That means standardized backends, production-ready Helm charts, and Helm-based RDP Gateway configuration - all shipping as a supported, first-class deployment path. If your organization already runs workloads on Kubernetes, you now have a clean, declarative way to run Kasm Workspaces alongside them.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"The practical implications go beyond just “it works now.” Helm-based deployment means your Kasm Workspaces configuration lives in version control. It means your infrastructure team can review workspace platform changes the same way they review application deployments - as code, in a pull request, with a traceable history. That is a different operational posture than a wizard-driven install, and it matters for compliance-focused environments.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Zero-Trust Egress with OpenZiti","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Network access control is one of the more underappreciated dimensions of a workspace platform. You can isolate the session itself beautifully and still create exposure through permissive egress.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Kasm Workspaces 1.19 adds a native OpenZiti egress provider, giving administrators the ability to route workspace traffic through a software-defined zero-trust network fabric rather than relying on traditional VPN or firewall rules. OpenZiti connections are mutually authenticated, encrypted by default, and scoped to specific services - not the broad network access that VPNs typically grant.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"For security teams that have been working toward a zero-trust architecture, this is a meaningful integration. It brings the egress layer into the same policy-driven model that governs the session itself.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Self-Service Diagnostics: Less Time Fighting the Platform","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"One of the quieter but consistently impactful investments in any platform is making it easier to understand what is happening when something goes wrong.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Version 1.19 introduces a self-service diagnostics and metrics system covering metrics collection and export, system health checks, and a support bundle generator. Administrators can now pull structured diagnostic data without needing to escalate to a support ticket or dig through logs manually. For teams running Kasm Workspaces as part of a larger observability stack, the metrics export feeds directly into existing monitoring pipelines.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"This is the kind of work that does not generate excitement in a feature announcement but meaningfully reduces operational friction over time.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Configuration as Code, Done Properly","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Kasm Workspaces 1.19 delivers a substantial refresh to configuration import and export. The improvements include table-level selection so you can export exactly what you need, UUID tokenization to make configs portable across environments, a sanitize option to strip environment-specific values, additive imports that merge rather than overwrite, and preset export modes for common scenarios.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Taken together, these changes make it practical to treat Kasm Workspaces configuration as a versioned artifact - something you can promote from development to staging to production, review in a diff tool, and roll back if needed. That is what “config as code” actually means in practice, and most platforms do not get there cleanly.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"GPU Workloads and AI/ML Use Cases: MiG Support","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Organizations running AI and ML workloads have increasingly needed a way to share expensive GPU resources across multiple container sessions without the overhead of full GPU passthrough. NVIDIA Multi-Instance GPU (MiG) partitioning solves that problem at the hardware level, but the platform delivering those sessions needs to understand MiG topology to take advantage of it.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Kasm Workspaces 1.19 adds native NVIDIA MiG support, so administrators can assign MiG slices to container sessions. This makes GPU-accelerated workspaces practical for larger teams where a single high-end card needs to serve multiple concurrent users - a common scenario in data science and ML engineering environments.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"vSphere: Faster Provisioning with Instant Clones and CloudInit","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"For environments running Kasm Workspaces on VMware vSphere, 1.19 delivers two complementary improvements: Instant Clone support and CloudInit startup scripts.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Instant Clones reduce the time it takes to provision a new VM session by forking from a running parent VM rather than starting from a snapshot. CloudInit startup scripts let administrators run configuration logic at session start without baking everything into the base image. Together, these changes tighten the provisioning loop - meaning users spend less time waiting and infrastructure teams have more flexibility in how they manage session images.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Linux VMs via RDP, Windows Autoscale Fixes, and More","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Version 1.19 also includes Phase 1 of Linux VM support via RDP, expanding the range of session types Kasm Workspaces can deliver beyond containers and Windows machines. Windows autoscale deployments now correctly use the Kasm Server Name as the hostname, resolving a long-standing friction point for teams managing larger Windows fleets.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"On the infrastructure side: PostgreSQL has been updated from version 14 to a newer release, SQLAlchemy has been updated to 2.0, and Guacamole has been updated to version 1.6. Debian 13 (Trixie) is now a supported install and upgrade target.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"The public exec_kasm API is available for teams that need programmatic control over session execution. Server Auto-Expiration lets administrators define a lifecycle for servers so they do not accumulate indefinitely. Rolling builds are now the default, improving release stability. The install script now supports copying existing SSL certificates at install time - a small thing that eliminates a common deployment friction point.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"An Honest Assessment","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"1.19 is a release that rewards teams who are already invested in the platform. The Kubernetes GA milestone, the OpenZiti integration, and the configuration import/export overhaul are all changes that compound over time - they make the platform more operable, more auditable, and more adaptable to the infrastructure practices that serious engineering organizations already follow.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"For teams evaluating Kasm Workspaces for the first time, 1.19 is also a meaningful moment. The Kubernetes deployment path being Generally Available means you are not adopting an experimental feature - you are adopting a supported, Helm-driven deployment model that integrates with the toolchain you already use.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Get Started","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Upgrade instructions, Helm chart documentation, and the full 1.19 changelog are available at ","type":"text","style":"","detail":0,"format":0,"version":1},{"id":"6a2c3b123183f472e901c2e6","type":"link","fields":{"url":"https://kasm.com/downloads","newTab":false,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"kasm.com/downloads","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"mode":"normal","text":".","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"If you are new to Kasm Workspaces, the documentation at ","type":"text","style":"","detail":0,"format":0,"version":1},{"id":"6a2c3b123183f472e901c2e7","type":"link","fields":{"url":"https://kasmweb.com/docs","newTab":false,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"kasmweb.com/docs","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"mode":"normal","text":" is the right starting point.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"center","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"tag":"h2","type":"heading","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"About Kasm Workspaces","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Kasm Technologies delivers a modern platform for secure, containerized desktop and application access. Kasm Workspaces streams browsers, desktops, and applications directly to users through ephemeral, policy-controlled sessions - eliminating the cost, rigidity, and risk of traditional VDI. Built by a team with deep roots in federal cybersecurity and offensive/defensive operations, Kasm is used by organizations ranging from government agencies to Fortune 500 companies to deliver secure, scalable developer and end-user environments.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Learn more at ","type":"text","style":"","detail":0,"format":0,"version":1},{"id":"6a2c3b123183f472e901c2e9","type":"link","fields":{"url":"https://kasm.com","newTab":false,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"kasm.com","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"mode":"normal","text":".","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0}],"direction":"ltr"}},"categories":[41],"meta":{"image":62,"description":"Kasm Workspaces 1.19 brings Kubernetes GA, OpenZiti zero-trust egress, NVIDIA MiG support, self-service diagnostics, and enterprise-ready scalability."},"publishedAt":"2026-06-15T06:00:00.000Z","authors":[6],"populatedAuthors":[{"id":6,"name":"Jessica Banerjee","image":"/api/media/file/Kasm_Logo_Final.png"}],"slug":"kasm-workspaces-119-kubernetes-goes-ga-zero-trust-egress-and-a-release-built-for-production"}],"categories":[{"id":41,"title":"Platform Updates","author":6,"slug":"platform-updates","slugLock":true,"updatedAt":"2025-12-29T21:24:20.149Z","createdAt":"2025-12-29T21:24:20.148Z"}],"meta":{"title":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale","image":{"id":63,"alt":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale ","caption":null,"author":6,"updatedAt":"2026-06-15T13:11:33.997Z","createdAt":"2026-06-15T13:11:32.128Z","url":"/api/media/file/Why%20Kubernetes%20Is%20the%20Right%20Foundation%20for%20Operating%20Kasm%20at%20Scale%20(1).jpg","thumbnailURL":"/api/media/file/Why%20Kubernetes%20Is%20the%20Right%20Foundation%20for%20Operating%20Kasm%20at%20Scale%20(1)-300x214.jpg","filename":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1).jpg","mimeType":"image/jpeg","filesize":144013,"width":2000,"height":1429,"focalX":50,"focalY":50,"sizes":{"thumbnail":{"url":"/api/media/file/Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-300x214.jpg","width":300,"height":214,"mimeType":"image/jpeg","filesize":7753,"filename":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-300x214.jpg"},"square":{"url":"/api/media/file/Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-500x500.jpg","width":500,"height":500,"mimeType":"image/jpeg","filesize":21338,"filename":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-500x500.jpg"},"small":{"url":"/api/media/file/Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-600x429.jpg","width":600,"height":429,"mimeType":"image/jpeg","filesize":23697,"filename":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-600x429.jpg"},"medium":{"url":"/api/media/file/Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-900x643.jpg","width":900,"height":643,"mimeType":"image/jpeg","filesize":46298,"filename":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-900x643.jpg"},"large":{"url":"/api/media/file/Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-1400x1000.jpg","width":1400,"height":1000,"mimeType":"image/jpeg","filesize":87307,"filename":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-1400x1000.jpg"},"xlarge":{"url":"/api/media/file/Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-1920x1372.jpg","width":1920,"height":1372,"mimeType":"image/jpeg","filesize":136231,"filename":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-1920x1372.jpg"},"og":{"url":"/api/media/file/Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-1200x630.jpg","width":1200,"height":630,"mimeType":"image/jpeg","filesize":54489,"filename":"Why Kubernetes Is the Right Foundation for Operating Kasm at Scale (1)-1200x630.jpg"}}},"description":"Learn how Kubernetes helps platform teams scale, secure, and simplify Kasm operations with Helm, GitOps, and declarative infrastructure."},"publishedAt":"2026-06-15T02:44:15.835Z","authors":[6],"populatedAuthors":[{"id":6,"name":"Jessica Banerjee","image":"/api/media/file/Kasm_Logo_Final.png"}],"slug":"why-kubernetes-is-the-right-foundation-for-operating-kasm-at-scale","slugLock":true,"updatedAt":"2026-07-08T02:29:59.635Z","createdAt":"2026-05-14T17:20:34.692Z","_status":"published"},{"id":29,"title":"Copy Fail (CVE-2026-31431), Container Escape, and the Case for Ephemeral Architecture","description":"Containerization changed how most organizations think about workload isolation. The mental model is intuitive: each container runs in its own space, with its own filesystem, its own network stack, its own identity. ","heroImage":{"id":61,"alt":null,"caption":null,"author":6,"updatedAt":"2026-05-04T17:43:49.596Z","createdAt":"2026-05-04T17:43:46.523Z","url":"/api/media/file/copy%20fail%20blog.png","thumbnailURL":"/api/media/file/copy%20fail%20blog-300x214.png","filename":"copy fail blog.png","mimeType":"image/png","filesize":4418438,"width":2000,"height":1429,"focalX":50,"focalY":50,"sizes":{"thumbnail":{"url":"/api/media/file/copy fail blog-300x214.png","width":300,"height":214,"mimeType":"image/png","filesize":135003,"filename":"copy fail blog-300x214.png"},"square":{"url":"/api/media/file/copy fail blog-500x500.png","width":500,"height":500,"mimeType":"image/png","filesize":467172,"filename":"copy fail blog-500x500.png"},"small":{"url":"/api/media/file/copy fail blog-600x429.png","width":600,"height":429,"mimeType":"image/png","filesize":495987,"filename":"copy fail blog-600x429.png"},"medium":{"url":"/api/media/file/copy fail blog-900x643.png","width":900,"height":643,"mimeType":"image/png","filesize":1065488,"filename":"copy fail blog-900x643.png"},"large":{"url":"/api/media/file/copy fail blog-1400x1000.png","width":1400,"height":1000,"mimeType":"image/png","filesize":2474749,"filename":"copy fail blog-1400x1000.png"},"xlarge":{"url":"/api/media/file/copy fail blog-1920x1372.png","width":1920,"height":1372,"mimeType":"image/png","filesize":4330960,"filename":"copy fail blog-1920x1372.png"},"og":{"url":"/api/media/file/copy fail blog-1200x630.png","width":1200,"height":630,"mimeType":"image/png","filesize":1445765,"filename":"copy fail blog-1200x630.png"}}},"content":{"root":{"type":"root","format":"","indent":0,"version":1,"children":[{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"The Trust Assumption Nobody Talks About","type":"text","style":"","detail":0,"format":1,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Containerization changed how most organizations think about workload isolation. The mental model is intuitive: each container runs in its own space, with its own filesystem, its own network stack, its own identity. What happens inside one container stays inside one container.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"That model has a flaw, and Copy Fail (CVE-2026-31431) exposes it cleanly. The flaw is not in how containers are built. It is in what they share: the kernel.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Every container on a host runs on the same Linux kernel. That shared kernel manages memory, handles system calls, and - critically - maintains the page cache, the in-memory representation of files on disk. When a vulnerability allows an unprivileged process to write into that shared page cache, the container boundary becomes irrelevant. A write from one container is a write that every other container on that host can be affected by.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"That is what Copy Fail does. A 732-byte Python script, executable by any unprivileged local user, triggers a logic flaw in the kernel's cryptographic subsystem to corrupt a target file in the page cache - including setuid binaries - and obtain root. CISA added it to the Known Exploited Vulnerabilities catalog within days of disclosure. The vulnerability has been present in Linux kernels since 2017.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Why This Pattern Keeps Appearing","type":"text","style":"","detail":0,"format":1,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Copy Fail is not an anomaly. It is an example of a class of vulnerability that surfaces regularly: a flaw at the OS layer that bypasses the isolation mechanisms built on top of it. The Linux kernel is an extraordinarily complex piece of software, maintained across decades, with subsystems interacting in ways that no individual reviewer sees in full. Logic bugs accumulate. Some stay dormant for years before someone finds the right combination of system calls to trigger them reliably.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"The security tooling most organizations rely on - EDR, container scanning, image signing, SBOM verification - operates above the kernel. It catches problems in application code, in package dependencies, in runtime behavior. It does not catch a kernel logic flaw that lets any user rewrite arbitrary files in memory. That is a different layer, and it requires a different architectural response.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"How Kasm Workspaces Is Built for This","type":"text","style":"","detail":0,"format":1,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Kasm Workspaces was designed around a specific premise: the endpoint and the underlying OS cannot be fully trusted. That premise shapes every architectural decision in the platform - and it turns out to be exactly the right frame for thinking about a vulnerability like Copy Fail.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"The most important property is ephemerality. Every Kasm workspace is a container that is created on demand and destroyed when the session ends. There is no persistent filesystem, no stored credentials, no accumulated state for an attacker to return to. Gaining root inside a Kasm workspace during an active session means gaining root in a container that will not exist in an hour. The attacker's foothold evaporates with the session.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Persistence is what transforms a privilege escalation into a serious breach. Without it, the blast radius of an exploit like Copy Fail is bounded by the session lifetime. An attacker who exploits Copy Fail inside an ephemeral workspace gains root over nothing that persists.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"The platform also manages seccomp policies centrally across workspace images. Blocking AF_ALG socket creation - the first step in the Copy Fail exploit chain - is a configuration that can be enforced at the image level, across every user session, without depending on individual users or developers to secure their own environments. That kind of centralized enforcement is not possible when workloads run on unmanaged endpoints.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"We run our own development environment on Kasm Workspaces, so this is not a theoretical architecture for our team - it is how we work every day. ","type":"text","style":"","detail":0,"format":0,"version":1},{"id":"69f8d9fa014048249ab58900","type":"link","fields":{"url":"https://kasm.com/solutions/platform","newTab":false,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"Learn more about the Kasm Workspaces platform.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"The Right Question to Be Asking","type":"text","style":"","detail":0,"format":1,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Every organization running Linux workloads should patch for Copy Fail. That is not optional. But patching is reactive, and kernel vulnerabilities are not going away. The more useful question is structural: when the next one surfaces, how much can an attacker actually accomplish before you respond?","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Ephemeral sessions, centrally managed images, no persistent endpoint state, and workloads that assume a hostile OS underneath - these properties do not prevent kernel vulnerabilities. They determine how much those vulnerabilities cost when they appear.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Copy Fail is a good test case for that question. For environments built on these principles, the answer is: not much.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":" ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":null,"textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"About Kasm Workspaces","type":"text","style":"","detail":0,"format":1,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Kasm Technologies delivers a modern platform for secure, containerized desktop and application access. Kasm Workspaces streams browsers, desktops, and applications directly to users through ephemeral, policy-controlled sessions - eliminating the cost, rigidity, and risk of traditional VDI. Built by a team with deep roots in federal cybersecurity and offensive/defensive operations, Kasm is used by organizations ranging from government agencies to Fortune 500 companies to deliver secure, scalable developer and end-user environments.","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"Learn more about how Kasm Workspaces delivers secure, ephemeral environments for developer and end-user access at ","type":"text","style":"","detail":0,"format":0,"version":1},{"id":"69f8d959014048249ab588f9","type":"link","fields":{"url":"https://kasm.com","newTab":false,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"kasm.com","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"},{"mode":"normal","text":".","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":" ","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":null,"textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[],"direction":null,"textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"References","type":"text","style":"","detail":0,"format":1,"version":1}],"direction":"ltr","textStyle":"","textFormat":1},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"1. Wiz","type":"text","style":"","detail":0,"format":1,"version":1},{"mode":"normal","text":" - \"Copy Fail: Universal Linux Local Privilege Escalation Vulnerability\"","type":"text","style":"","detail":0,"format":0,"version":1},{"type":"linebreak","version":1},{"id":"69f8d959014048249ab588fa","type":"link","fields":{"url":"https://www.wiz.io/blog/copyfail-cve-2026-31431-linux-privilege-escalation-vulnerability","newTab":false,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"https://www.wiz.io/blog/copyfail-cve-2026-31431-linux-privilege-escalation-vulnerability","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"2. The Hacker News","type":"text","style":"","detail":0,"format":1,"version":1},{"mode":"normal","text":" - \"CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV\"","type":"text","style":"","detail":0,"format":0,"version":1},{"type":"linebreak","version":1},{"id":"69f8d959014048249ab588fb","type":"link","fields":{"url":"https://thehackernews.com/2026/05/cisa-adds-actively-exploited-linux-root.html","newTab":false,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"https://thehackernews.com/2026/05/cisa-adds-actively-exploited-linux-root.html","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"3. Microsoft Security Blog","type":"text","style":"","detail":0,"format":1,"version":1},{"mode":"normal","text":" - \"CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments\"","type":"text","style":"","detail":0,"format":0,"version":1},{"type":"linebreak","version":1},{"id":"69f8d959014048249ab588fc","type":"link","fields":{"url":"https://www.microsoft.com/en-us/security/blog/2026/05/01/cve-2026-31431-copy-fail-vulnerability-enables-linux-root-privilege-escalation/","newTab":false,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"https://www.microsoft.com/en-us/security/blog/2026/05/01/cve-2026-31431-copy-fail-vulnerability-enables-linux-root-privilege-escalation/","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"4. Help Net Security","type":"text","style":"","detail":0,"format":1,"version":1},{"mode":"normal","text":" - \"Nine-year-old Linux kernel flaw enables reliable local privilege escalation (CVE-2026-31431)\"","type":"text","style":"","detail":0,"format":0,"version":1},{"type":"linebreak","version":1},{"id":"69f8d959014048249ab588fd","type":"link","fields":{"url":"https://www.helpnetsecurity.com/2026/04/30/copyfail-linux-lpe-vulnerability-cve-2026-31431/","newTab":false,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"https://www.helpnetsecurity.com/2026/04/30/copyfail-linux-lpe-vulnerability-cve-2026-31431/","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"5. Xint","type":"text","style":"","detail":0,"format":1,"version":1},{"mode":"normal","text":" - \"Copy Fail: 732 Bytes to Root on Every Major Linux Distribution\"","type":"text","style":"","detail":0,"format":0,"version":1},{"type":"linebreak","version":1},{"id":"69f8d959014048249ab588fe","type":"link","fields":{"url":"https://xint.io/blog/copy-fail-linux-distributions","newTab":false,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"https://xint.io/blog/copy-fail-linux-distributions","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"}],"direction":"ltr","textStyle":"","textFormat":0},{"type":"paragraph","format":"","indent":0,"version":1,"children":[{"mode":"normal","text":"6. CERT-EU","type":"text","style":"","detail":0,"format":1,"version":1},{"mode":"normal","text":" - \"High Vulnerability in the Linux Kernel (Copy Fail)\"","type":"text","style":"","detail":0,"format":0,"version":1},{"type":"linebreak","version":1},{"id":"69f8d959014048249ab588ff","type":"link","fields":{"url":"https://cert.europa.eu/publications/security-advisories/2026-005/","newTab":false,"linkType":"custom"},"format":"","indent":0,"version":3,"children":[{"mode":"normal","text":"https://cert.europa.eu/publications/security-advisories/2026-005/","type":"text","style":"","detail":0,"format":0,"version":1}],"direction":"ltr"}],"direction":"ltr","textStyle":"","textFormat":0}],"direction":"ltr"}},"relatedPosts":[],"categories":[],"meta":{"title":"Copy Fail (CVE-2026-31431), Container Escape, and the Case for Ephemeral Architecture","image":{"id":61,"alt":null,"caption":null,"author":6,"updatedAt":"2026-05-04T17:43:49.596Z","createdAt":"2026-05-04T17:43:46.523Z","url":"/api/media/file/copy%20fail%20blog.png","thumbnailURL":"/api/media/file/copy%20fail%20blog-300x214.png","filename":"copy fail blog.png","mimeType":"image/png","filesize":4418438,"width":2000,"height":1429,"focalX":50,"focalY":50,"sizes":{"thumbnail":{"url":"/api/media/file/copy fail blog-300x214.png","width":300,"height":214,"mimeType":"image/png","filesize":135003,"filename":"copy fail blog-300x214.png"},"square":{"url":"/api/media/file/copy fail blog-500x500.png","width":500,"height":500,"mimeType":"image/png","filesize":467172,"filename":"copy fail blog-500x500.png"},"small":{"url":"/api/media/file/copy fail blog-600x429.png","width":600,"height":429,"mimeType":"image/png","filesize":495987,"filename":"copy fail blog-600x429.png"},"medium":{"url":"/api/media/file/copy fail blog-900x643.png","width":900,"height":643,"mimeType":"image/png","filesize":1065488,"filename":"copy fail blog-900x643.png"},"large":{"url":"/api/media/file/copy fail blog-1400x1000.png","width":1400,"height":1000,"mimeType":"image/png","filesize":2474749,"filename":"copy fail blog-1400x1000.png"},"xlarge":{"url":"/api/media/file/copy fail blog-1920x1372.png","width":1920,"height":1372,"mimeType":"image/png","filesize":4330960,"filename":"copy fail blog-1920x1372.png"},"og":{"url":"/api/media/file/copy fail blog-1200x630.png","width":1200,"height":630,"mimeType":"image/png","filesize":1445765,"filename":"copy fail blog-1200x630.png"}}},"description":"Explore the “Copy Fail” Linux kernel vulnerability (CVE-2026-31431) and why container isolation isn’t enough—plus how Kasm Workspaces’ ephemeral architecture limits risk and reduces attack impact."},"publishedAt":"2026-05-04T17:44:03.456Z","authors":[6],"populatedAuthors":[{"id":6,"name":"Jessica Banerjee","image":"/api/media/file/Kasm_Logo_Final.png"}],"slug":"copy-fail-cve-2026-31431-container-escape-and-the-case-for-ephemeral-architecture","slugLock":true,"updatedAt":"2026-05-04T17:44:03.458Z","createdAt":"2026-05-04T17:37:12.065Z","_status":"published"}],"hasNextPage":true,"hasPrevPage":false,"limit":3,"nextPage":2,"page":1,"pagingCounter":1,"prevPage":null,"totalDocs":22,"totalPages":8}