KDE Plasma has an RDP server, KRdp. It is good, but it does one thing: it shares a session that is already running on a machine with a screen. If you have a server and want every user to log in over RDP and get their own Plasma desktop, kept alive between connections, KRdp does not do that. Plasma also cannot start on a headless machine: KWin wants a monitor.

I work on Waydesk, a free multi-user RDP desktop server for Linux (Debian, Ubuntu and Arch), and I wanted Plasma to be one of the desktops an account can choose. This is how it works, what it costs and what I have not tested.

Why not just use KRdp?

KRdp is built to share the session of someone sitting at a machine: one user, one running desktop, a monitor attached. That is the right design for remote support. It is not meant to start a separate desktop for each account on a server nobody sits at, which is what I needed, so I went around it instead of trying to bend it.

The trick: Plasma as one window of a headless sway

Waydesk already starts one headless sway compositor per account, with a virtual output sized to whatever the RDP client asks for. It captures that output, encodes it as H.264 and feeds client input back in. That part has nothing to do with Plasma.

For a Plasma account, the session's sway config simply runs startplasma-wayland. KWin notices it is started inside another Wayland compositor and runs as a window of it, the same way KWin runs nested for development. The window is fullscreen, so the RDP client sees Plasma and nothing else. Capture and input stay sway's job; Plasma never needs a real monitor.

RDP client <-> Waydesk <-> headless sway (virtual output) └─ fullscreen window: KWin + Plasma

Choosing it is one command:

sudo waydesk-admin users set alice --desktop plasma

That command selects a sway configuration for the account. The whole of it, trimmed to the lines that matter:

# every window is fullscreen: the client sees Plasma and nothing else default_border none for_window [title=".*"] fullscreen enable # the session's own terminal stays alive but out of sight for_window [title="waydesk-server-session"] move scratchpad # start Plasma; when it quits (Log out, or a crash), end the session too exec sh -c 'startplasma-wayland; swaymsg exit'

That is the entire integration on the compositor side. An account can also replace the file with its own in ~/.config/waydesk/config, if you want a different panel layout or a different starting command.

Four of the desktops an account can choose: the Waydesk sway desktop, KDE Plasma, COSMIC and Omarchy (Hyprland)

COSMIC works the same way (its own compositor also refuses to run without a monitor), and Hyprland runs as a compositor of its own: the fourth desktop in the picture is Omarchy, an Arch-based setup built on Hyprland.

The small things that make it usable

Nesting a desktop inside a desktop breaks a few things you would not think about:

  • Clipboard. The clipboard bridge talks to the inner desktop through KWin's own display, which offers ext-data-control. Text only for now.
  • Keyboard layout. KWin reads sway's raw key codes and applies its layout, so the layout the client asked for has to be written into Plasma's own settings (kxkbrc, then kwriteconfig6 --notify so KWin applies it immediately). Without this you type y and get z.
  • Logging out. In a nested setup, "Log out" ends Plasma and leaves the outer sway running with nothing in it: the client sits on a dark screen, and reconnecting lands on the same dark screen. The sway config now exits sway when Plasma exits, so the client is disconnected and the next login starts a fresh desktop.
  • A stray terminal. Every Waydesk session starts a small terminal that the session itself uses. On Debian's sway 1.10 it was drawn above the fullscreen Plasma window, so users saw a terminal instead of their desktop. The config above moves it to the scratchpad: still running, never visible.
  • Cursor. KWin hands sway the cursor image and the client draws it. Nothing to do.

What I tested, and what it costs

On a 4-core Hetzner box with an i7-7700 (Intel HD 630), Arch, Plasma 6.8.2:

  • An idle Plasma session takes about 750 MB and 46 processes (COSMIC is about 940 MB).
  • Login, lock screen (unlocked with the account's password in the RDP client), logout, reconnect, and 30 minutes idle all behave.
  • Several accounts at once: three Plasma sessions beside nine others (sway, COSMIC, Omarchy), all drawing, on the hardware H.264 encoder. Four Plasma accounts also ran on a 4-core Debian 13 server (Plasma 6.3.6).
  • Clients: FreeRDP and the Windows App on macOS.

What I have not tested

  • Capacity under load. I have the numbers for idle sessions and a mixed handful of sessions, not for how many busy Plasma users a server holds. Waydesk refuses a new session when memory is short, so a full server fails safely, but I cannot tell you the number yet.
  • AMD and NVIDIA on Arch. Only Intel was tried there.
  • It is a nested desktop, so anything that expects to own the display (some power and session features) may not behave like a real login.

Try it

On Arch (signed pacman repository, see docs/ARCH.md):

sudo pacman -Syu waydesk-server sudo pacman -S plasma-desktop konsole sudo systemctl enable --now waydesk-helper.service waydesk.service sudo waydesk-setup-admin sudo waydesk-admin users add alice sudo waydesk-admin users set alice --desktop plasma

On Debian 13 or Ubuntu 26.04 (signed apt repository):

curl -fsSLO https://waydesk.dev/apt/waydesk-repo.deb sudo apt install ./waydesk-repo.deb gpg --show-keys --with-fingerprint /usr/share/keyrings/waydesk-archive-keyring.gpg # must be C646 72B2 5ECD 4773 196C 3958 9D8E 8874 E676 17F4 sudo apt update && sudo apt install waydesk sudo apt install plasma-desktop konsole sudo waydesk-setup-admin sudo waydesk-admin users add alice sudo waydesk-admin users set alice --desktop plasma

Compare the fingerprint with the one printed, because the first download cannot be verified by the repository itself. Then connect any RDP client (the Windows App, Remmina, FreeRDP) through an SSH tunnel or WireGuard: the port listens on loopback only by default.

The notes are in docs/PLASMA.md, the code is AGPL-3.0 on GitHub, and I would like to hear from anyone who runs Plasma users on a server: what breaks, and what you would want from it.