Compare

An Apache Guacamole alternative, without the Java stack

Apache Guacamole is a mature, feature-rich platform. rustguac is a purpose-built alternative to its Java web application: one Rust binary in front of the same guacd, with OIDC sign-in, credentials in Vault, multi-hop SSH tunnels, web sessions and VDI desktops.

How to migrate Side by side

What rustguac is

rustguac is an open-source, Apache-2.0 licensed replacement for the Apache Guacamole Java webapp. It sits between web browsers and guacd, proxying the Guacamole protocol over WebSockets, and manages session lifecycle, authentication, session recording, VDI container orchestration and Vault-backed connection storage.

There is no Tomcat, no WAR file and no JVM to tune: a single Rust binary plus guacd, installed from a Debian 13 package, a Docker image or one script.

What stays the same

The same guacd

Both use guacd from Apache guacamole-server for protocol translation: the same C daemon, bundled with rustguac.

The same protocol

The wire protocol between webapp and guacd is identical, and rustguac uses the same guac-common-js client library and WebSocket framing.

The same recording format

Recordings are in the standard Guacamole format and play back in rustguac's bundled player.

The same SSH, RDP and VNC

The protocol backends come from guacd. rustguac adds web browser and VDI container session types on top.

Side by side

rustguac vs Apache Guacamole

How the two web applications differ, based on rustguac's own documentation. Both sit in front of guacd.

Area	rustguac	Apache Guacamole
Web application runtime	Rust, single binary	Java (Tomcat + Guice + Jersey)
Protocol daemonSame daemon, same Guacamole wire protocol and JavaScript client library.	guacd from guacamole-server, bundled	guacd from guacamole-server
Application database	SQLite, embedded	MySQL / PostgreSQL
Connection credentialsrustguac needs Vault or OpenBao for its Connections UI; without it only ad-hoc API sessions are available.	Vault / OpenBao KV v2, server-side only	Database tables
User authenticationGuacamole supports more authentication back ends. rustguac relies on your OIDC provider for MFA and directory integration.	OIDC SSO, API keys, user API tokens	LDAP, RADIUS, TOTP, SAML, database
Session typesrustguac's importer skips telnet and Kubernetes connections.	SSH, RDP, VNC, SPICE, Proxmox VE, web, VDI	SSH, RDP, VNC, telnet, Kubernetes and others
Web browser sessions	Headless Chromium on Xvnc, with autofill and domain allowlists	Not supported
VDI desktops	Ephemeral Docker container per user	Not supported
Multi-hop SSH tunnels	Chain bastions per entry or session	Not supported
Ephemeral SSH keys	Ed25519 keypair per session	Not supported
Network allowlists	CIDR allowlists per protocol	Not supported
Rate limiting	Per-IP, per-endpoint	Not built in
Clipboard control	Disable copy and/or paste per entry	Not per-connection
File transfer encryption	LUKS with keys in Vault	Not supported
Session sharing	Control and view-only share links, admin shadowing	Connection sharing
Recording	Guacamole format, in-app player, MP4 download, SSH typescripts	Guacamole format
Maturity	Newer project; built and tested on Debian 13, Docker elsewhere	Mature, feature-rich platform
Migration pathGuacamole users, groups and permissions are not imported; use OIDC group mappings and folder access instead.	Imports SSH, RDP and VNC connections from a Guacamole MySQL/MariaDB dump	n/a

Honest fit

Which one should you run?

Both put SSH, RDP and VNC in a browser through guacd. The right choice depends on how you authenticate users and where you want credentials to live.

rustguac is a good fit if

You'd rather not run Java, Tomcat and a WAR file for the web tier.
Your users already sign in through an OIDC provider such as Authentik, Keycloak, Okta or Entra ID.
You want credentials held in Vault or OpenBao and never sent to the browser.
You need to reach targets through SSH bastions, or want locked-down web sessions and per-user VDI desktops.
You want CIDR allowlists, rate limiting and per-entry clipboard control out of the box.

Apache Guacamole may suit you better if

You need LDAP, RADIUS, SAML, TOTP or database accounts directly in the remote access gateway, rather than through an OIDC identity provider.
You rely on protocols rustguac doesn't support, such as telnet or Kubernetes.
You want connection data in MySQL or PostgreSQL and would rather not run HashiCorp Vault or OpenBao.
You value a long-established, mature platform over a newer project.

Migration

Moving from Apache Guacamole

rustguac imports SSH, RDP and VNC connections from a Guacamole MySQL/MariaDB dump straight into Vault. The import is additive and has a dry run, so you can run both side by side while you switch.

Install rustguac alongside Guacamole
Run it from the Docker image or the Debian 13 package next to your existing setup. guacd is bundled, so nothing changes on your targets. Installation guide.
Connect Vault or OpenBao and OIDC
Connections live in Vault or OpenBao KV v2, and users sign in with OIDC. contrib/vault-quickstart.sh provisions Vault in one command. Deployment guide.

Export three tables from Guacamole

Dump only the connection, parameter and group tables from the Guacamole MySQL or MariaDB database.

mysqldump -u guacamole_user -p guacamole_db \
  guacamole_connection \
  guacamole_connection_parameter \
  guacamole_connection_group \
  > guacamole-dump.sql

Preview, then import
Run with --dry-run to see what would be imported, then again without it to write the entries to Vault. SSH, RDP (including RemoteApp) and VNC connections are imported; telnet and Kubernetes are skipped with a warning.
```
rustguac --config /opt/rustguac/config.toml \
  import-guacamole --file guacamole-dump.sql --dry-run
```
Map passthrough tokens
Guacamole's ${GUAC_USERNAME} and ${GUAC_PASSWORD} tokens become rustguac credential variables with repeatable --map FROM=TO flags. Each user then fills them in once under My Credentials.
Recreate access with OIDC groups
Guacamole users, groups and permissions are not imported. Map OIDC groups to rustguac's four roles and restrict folders with allowed groups, then switch users over.

Read the full migration guide

See it for yourself

One Docker command gets you a running instance with guacd included.

Quickstart View on GitHub