Virtual desktops and published apps are among the stickiest platforms in the enterprise, which is exactly why the per-user bill hurts. Citrix (now under Cloud Software Group) and VMware Horizon (now Omnissa, after its divestiture from Broadcom) both price per named or concurrent user, both have raised costs or created roadmap uncertainty in recent years, and both wrap you in a stack of brokers, provisioning services, and agents that is hard to unpick. So teams look for a way out. The important thing to get right first is what you are actually trying to replace.
Separate the need from the product
“VDI” bundles several distinct jobs: brokering user sessions, provisioning and maintaining desktop images, layering applications, managing user profiles, and delivering the whole thing securely to remote clients. A full commercial platform does all of that. Before you shop for a replacement, work out which of those jobs you genuinely rely on. Many estates discover that what they actually need is secure remote access to a set of existing Windows session hosts, not the full desktop-lifecycle machinery, and that changes the answer completely.
The two open directions
There is no single open-source product that is a drop-in Citrix or Horizon. The credible open options solve different slices of the problem:
- Apache Guacamole is a clientless, browser-based gateway to RDP, VNC, and SSH. It brokers access to desktops and session hosts you already run, with single sign-on and MFA at the gateway. It does not manage images, provision pools, or layer apps. When the real requirement is “let people reach their existing Windows desktops from a browser, securely,” it is an excellent, low-cost fit. When you need image lifecycle and elastic pools, it is only part of the answer.
- Kasm Workspaces streams containerized apps and desktops to the browser. Because it provisions ephemeral workspaces from images, it is closer to published-app and non-persistent-desktop delivery, and it suits browser isolation and app-streaming use cases well. It is still container streaming rather than a traditional persistent-VDI broker, so match it to workloads that fit that model.
The honest trade
Leaving a commercial VDI suite removes per-user licensing and its lock-in, but you take on more assembly: you may run a remote-access gateway for some users, a workspace-streaming tool for others, and keep image or profile management on your hypervisor or a separate tool. For estates whose real need is remote access to existing hosts, that assembly is modest and the savings are real. For estates that lean hard on image layering, instant clones, or GPU-accelerated persistent desktops, be realistic: the open tools cover part of the ground, and a phased, use-case-by-use-case migration beats a big-bang swap.
How to approach it
Inventory your user groups by what they actually do, not by the license they hold. Pilot the open gateway or workspace tool with one low-risk group end to end, wire single sign-on and MFA, and validate performance and peripheral behavior (printing, USB, multi-monitor) before you widen it. Model the per-user savings with the calculator on each path page, and remember the figures are illustrative until you price your own infrastructure and support. Then migrate group by group, keeping the incumbent running for the users who genuinely need what only it provides.