Official pre-built OCI VM images (Ubuntu, Android), the Windows artifact, and the os-image/ build harness.
Pre-built OS images are hosted on GitHub Container Registry.
Multi-arch (linux/amd64, linux/arm64).
| Image | Tag | IMAGE_NAME |
|---|---|---|
| Ubuntu 22.04 (Jammy) | 22.04 |
ghcr.io/cocoonstack/cocoon/ubuntu:22.04 |
| Ubuntu 24.04 (Noble) | 24.04 |
ghcr.io/cocoonstack/cocoon/ubuntu:24.04 |
| Ubuntu 24.04 + Chrome | 24.04-chrome |
ghcr.io/cocoonstack/cocoon/ubuntu:24.04-chrome |
| Ubuntu 24.04 + Xfce | 24.04-xface |
ghcr.io/cocoonstack/cocoon/ubuntu:24.04-xface |
| Ubuntu 24.04 + PicoClaw | 24.04-picoclaw |
ghcr.io/cocoonstack/cocoon/ubuntu:24.04-picoclaw |
linux/amd64 only. Runs Android via Redroid directly as PID 1 in the VM — no Ubuntu/systemd layer.
| Image | Tag | IMAGE_NAME |
|---|---|---|
| Android 14 | 14.0 |
ghcr.io/cocoonstack/cocoon/android:14.0 |
| Android 15 | 15.0 |
ghcr.io/cocoonstack/cocoon/android:15.0 |
Access via adb connect <vm-ip>:5555 or scrcpy -s <vm-ip>:5555 --no-audio.
linux/amd64 only. Build automation and pre-built images are maintained in cocoonstack/windows.
Pre-built images are published to GHCR as split qcow2 parts (each part ≤ 1.9 GiB to stay within the GHCR per-layer limit):
ghcr.io/cocoonstack/windows/win11:25h2 # moving alias, latest good build
ghcr.io/cocoonstack/windows/win11:25h2-<YYYYMMDD> # dated immutable tag
The Windows image is published as an OCI artifact (split qcow2 parts pushed via ORAS), not a runnable OCI container image — use oras pull (not cocoon image pull or docker pull).
Pull and import into Cocoon:
# 1. Pull split parts via oras (https://oras.land)
oras pull ghcr.io/cocoonstack/windows/win11:25h2
# 2. Reassemble and verify
cat windows-11-25h2.qcow2.*.qcow2.part > windows-11-25h2.qcow2
sha256sum -c SHA256SUMS
# 3. Import into Cocoon
cocoon image import win11-25h2 windows-11-25h2.qcow2
cocoon vm run --windows --name win11 --cpu 4 --memory 4G win11-25h2
See cocoonstack/windows for build steps and version requirements.
IMAGE_NAME="ghcr.io/cocoonstack/cocoon/ubuntu:24.04" bash start.sh # run from os-image/ in the repo
IMAGE_NAME="ghcr.io/cocoonstack/cocoon/android:14.0" bash start.sh # run from os-image/ in the repo
Every official OS image bakes the following on top of its base distro:
cocoon vm exec (kubectl-style stdin/stdout/stderr/exit, no SSH/network dependency). Ubuntu uses a systemd unit; Android uses /system/etc/init/cocoon-agent.rc.openssh-server enabled with PermitRootLogin yes. Default credentials are root:cocoon. SSH covers the human-on-keyboard case while cocoon-agent handles control-plane traffic.Default credentials apply to fresh VMs. If you fork an image you should rotate the root password and (if you keep sshd) flip PermitRootLogin back to no once you have a non-root sudoer.
All Ubuntu images configure systemd-networkd with ClientIdentifier=mac in their DHCP settings. This ensures that when a VM is cloned from a snapshot, each clone uses its unique MAC address as the DHCP client identifier instead of the machine-id-derived DUID. Without this, clones from the same snapshot share an identical DUID and dnsmasq treats them as a single client, causing IP conflicts.
The setting is applied in two places:
os-image/ubuntu/network.sh — the initramfs DHCP fallback path20-wired.network — the default systemd-networkd config/dev/kvm must be writable)wget, mkfs.erofs, mkfs.ext4 installedsudo required on first run to set CAP_NET_ADMINIMAGE_NAME in a daemonless manner via cranevmlinuz) and initramfs (initrd.img) from the image, and compresses the rootfs into EROFSVisit the GitHub Packages page for the full list of images and tags:
https://github.com/orgs/cocoonstack/packages?repo_name=cocoon