Part of FlameNet is a "retro lab": period operating systems running in VMs, reachable from anywhere without installing a remote-desktop client. The combo: QEMU for the machines, Apache Guacamole for browser access.

QEMU for the metal

Each retro OS runs as a QEMU guest on an isolated bridge network, well away from anything that matters. systemd units bring them up on boot so the lab is always available.

The hardware you hand a twenty-five-year-old operating system needs to be as old as it is, which is the part that trips people up. The defaults on a modern QEMU are a machine full of devices Windows 2000 has never heard of, and it will either bluescreen at install or boot with no disk and no network. What it wants is the i440FX chipset rather than Q35, an IDE controller rather than virtio or AHCI, and an RTL8139 network card, which is the one NIC of that era whose driver actually ships in the box. Cirrus for video. It is also worth pinning an older CPU model rather than passing the host's, since a guest kernel from 2000 can get confused by instruction sets that did not exist when it was written.

Guacamole for access

Guacamole is a clientless remote-desktop gateway: it speaks RDP or VNC to the guests on the back end and renders the screen as HTML5 in your browser on the front end. No client install, works on a phone, and it tunnels through the same reverse proxy as everything else.

It is two pieces, which matters when you are debugging it. guacd is a native daemon that holds the actual protocol connections; the web application is a separate Java app that talks to guacd and serves the browser over a WebSocket. If the page loads but the screen stays black, the problem is almost always guacd reaching the guest, not the web tier.

The useful shortcut for retro guests is to skip in-guest remote desktop entirely. Windows 2000 needs Terminal Services installed and configured to speak RDP at all, and what it speaks is an ancient dialect. QEMU will expose the guest's framebuffer as a VNC server on its own, no software inside the guest and no drivers, and Guacamole connects to that happily. One less thing running on a machine you are trying to keep pristine.

Keeping it safe

Twenty-five-year-old operating systems have no business touching the open internet, so the lab sits on its own network segment with tight egress rules. Unpatched SMB and RPC on a public address is a live demonstration of 2003, and the worms that exploited them are still circulating. The rule set is the boring one: no route to the production network, no route to the cloud metadata endpoint, no outbound SMTP, and the VNC sockets bound to localhost so the only way in is through the gateway.

You can poke around a pristine Windows 2000 desktop. It just can't poke back.