FreeBSD ships desktop AMIs for EC2 that you reach over RDP
Serguey Asael Shinder2 min readFreeBSD now publishes desktop images for Amazon EC2. Colin Percival, who looks after FreeBSD's EC2 platform, announced them on 24 September: the AMIs boot into a KDE session with Chromium and LibreOffice already installed, and you connect with the Remote Desktop Protocol rather than SSH. Like every AMI the project publishes they come in UFS-root and ZFS-root flavours, carry no licence charge - you pay only for the EC2 capacity - and are offered in every commercial region except Bahrain and the UAE. Percival expects them to become part of FreeBSD 15.2-RELEASE; his walkthrough used a 15.1-STABLE build on an m7i-flex.large in ca-west-1.
The login model deliberately copies Windows. At first boot the instance creates ec2-user, generates a random password and encrypts it to the key pair you launched with, so you recover it through GetPasswordData exactly as you would for a Windows server. That only works with an RSA key stored in PEM format without a passphrase, which means the usual ssh-keygen defaults will not do. The instance also reports its RDP host certificate fingerprint in both SHA-1 and SHA-256 form, so the client can pin it instead of trusting on first use.
What it means
The interesting part is not that FreeBSD can run a desktop - people run it on Framework, Lenovo and Dell laptops already - but where the friction now sits. It has moved out of FreeBSD and into the AWS console. The launch wizard does not know these images speak RDP, so it proposes a security group with port 22 open instead of 3389, and the Connect page shows SSH instructions. Percival says he has asked Amazon for a way to mark an AMI as RDP-capable. Until that exists, anyone who launches through the console gets a working desktop behind a closed port and a set of instructions that do not apply.
For teams, this is a cheap way to hand someone a disposable FreeBSD workstation for evaluation, training or a port that needs a GUI to test, with nothing to install locally beyond an RDP client. Two things are worth doing on day one: open 3389 only to your own address, as the walkthrough does, and check the fingerprint the instance reports rather than clicking through the client's warning. The key-format requirement is the step most likely to fail silently, so generate a dedicated PEM key for these instances rather than reusing an existing Ed25519 one.