Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.ascii.dev/llms.txt

Use this file to discover all available pages before exploring further.

Every box includes a browser-accessible Linux desktop. Use it when you need to inspect a running app visually, use Chrome, debug Electron apps, or control GUI tools that are awkward over SSH.

​
Open the desktop

From your local machine: 
box desktop bx_f7k2q9hd
You can also open the desktop from the Box dashboard when the box is running.
Desktop streaming is available only after the box’s machine is up. If the box is provisioning, archived, or stopped, start or resume it first.

​
What happens when you open it

Box does not expose the raw streaming server directly from the CLI. The CLI or dashboard asks the Box API for a fresh authenticated desktop URL for your box. The API checks that you own the box, verifies that your Box access is active, and asks the running machine to prepare desktop streaming. If the machine has already prepared a stream, Box reuses the cached streaming credentials. If not, the machine creates them before the URL is returned. The returned URL opens a browser page like this: 
https://<box-desktop-host>/stream.html?hostId=<host>&appId=<app>&token=<token>&theme=light
The exact host, IDs, and token are generated for the running box. Treat the full URL as sensitive because the token is what lets the browser attach to that desktop session.

​
Streaming stack

Inside the box, the desktop stream is built from three services:
ServiceRole
sunshineCaptures the box’s Linux desktop session and exposes it as a streaming host.
moonlight-webBridges the Sunshine stream into a browser page.
xdotool-serverSupports browser-side desktop control such as pointer and keyboard input.
When the desktop endpoint is called, the box checks that these services are running and starts any missing service. It then logs in to Moonlight Web, pairs Moonlight Web with the local Sunshine server on the same machine, finds the Sunshine Desktop app, and returns the stream credentials to the Box API. The pairing result is cached on the machine, so later desktop opens usually skip the full pairing flow and return the existing host ID, app ID, and session token.

​
Security model

Desktop URLs are generated through the authenticated Box API. The API verifies your Box account and box ownership before returning a stream URL. The stream URL contains a token for the Moonlight Web session. Do not paste the full URL into shared chats or logs. If you need to give someone else access to a box, use the intended Box account and access controls rather than sharing a desktop URL. Stopping or archiving a box makes the desktop unavailable until the box is resumed. When a box is restored onto a new machine, Box refreshes the desktop connection details for that machine.