Console
The console gives you a keyboard on the machine when nothing else works — no network, no SSH daemon, a firewall you locked yourself out of, a boot that stops at an initramfs prompt.
What runs underneath
Section titled “What runs underneath”| Layer | Technology |
|---|---|
| Serial console | xterm.js in the browser, relayed to the VM’s serial device |
| Graphical console | noVNC, relayed to the VM’s VNC display |
| Relay | The panel proxies the stream over a WebSocket. Proxmox is never exposed to your browser and you never receive hypervisor credentials |
| Authorisation | A short-lived, single-use ticket, scoped to one machine |
Your browser talks to the panel. The panel talks to the region. Nothing in between is exposed, and the ticket you receive cannot be replayed against another machine.
Serial or VNC
Section titled “Serial or VNC”Serial is the better console when it is available: real text, fast, and copy-paste works properly. It requires the machine to have a serial device — every image zone9 creates does.
VNC is a graphical framebuffer. It is what Windows needs, and what an adopted machine gets when it has no serial device.
An adopted virtual machine may lack a serial device entirely, because it was created outside the panel; VNC then is the only option.
Copy and paste
Section titled “Copy and paste”Serial console: normal browser copy and paste.
VNC: pasting into a graphical console is not a browser operation — the browser cannot put text into a remote framebuffer’s clipboard unless a clipboard agent is running inside the guest. Where that is not the case, the console offers a panel that types the text as keystrokes instead. It is slower, and it always works.
Windows
Section titled “Windows”Windows opens in VNC. First boot takes minutes while sysprep specialisation runs; the console shows exactly where it is, which is the main reason to open it during a first boot.
Kubernetes
Section titled “Kubernetes”Clusters have a different console: kubectl running in a short-lived pod inside your
own cluster, streamed to the browser. See Kubernetes.
Appliances
Section titled “Appliances”Load balancers, gateways and storage nodes have no login: no SSH daemon, no shell, no accounts. Their console shows the boot log and nothing else, which is deliberate — see Appliances and the pull model. Diagnose them from the status they report to the panel.
Security notes
Section titled “Security notes”- Console sessions are audited like any other privileged action.
- A ticket is single-use and short-lived.
- The console is a keyboard, not a bypass: it grants no more access than sitting in front of the machine would.