Remote VM Setup

Pane can run your agents on a VM, WSL box, or any remote machine while you keep the UI on the device in front of you.

It works through a small daemon on the host machine. You connect with a pane-remote://... code from Settings > Remote Pane or the headless setup command. That’s it.

Install your agent CLIs (Codex, Claude Code, etc.) on the remote host. Agents use that host’s repos, shell, git config, env vars, and credentials.

Two Pieces

There are two sides to Remote Pane:

1. Host machine: the machine that owns the repos, terminals, worktrees, and agent processes.
2. Client device: the laptop, desktop, phone, or tablet running the Pane UI that imports the connection code.

The host can be your Windows PC, a WSL distro, a Mac mini, a Linux box, or a cloud VM. The client can be the Pane desktop app or the browser app at runpane.com/app .

Remote Pane is free and open source. The daemon ships with Pane and you run it on your own hardware. There’s no Pane cloud service or subscription. You bring the machine and the credentials.

Host Credentials

Configure runtime credentials on the host machine, because that is where the daemon, terminals, worktrees, and agent processes run.

For coding agents:

• Install the agent CLIs on the host, such as claude, codex, opencode, goose, or aider.
• Configure each agent’s auth on the host, either through the agent’s login flow or shell environment variables such as ANTHROPIC_API_KEY, OPENAI_API_KEY, or OPENROUTER_API_KEY.
• See AI providers for provider-specific env vars.

For PWA voice dictation:

1. Open Pane on the host machine.
2. Go to Settings > Voice Transcription.
3. Add the provider keys used by the remote browser app.

Live streaming voice uses Deepgram for realtime ASR and OpenRouter for transcript cleanup:

• Deepgram API Key
• OpenRouter API Key

Batch recorded voice uses Fal for Wizper transcription and OpenRouter for transcript cleanup:

• Fal API Key
• OpenRouter API Key

The daemon can also read these host environment variables: DEEPGRAM_API_KEY, OPENROUTER_API_KEY, and FAL_KEY. Settings are usually clearer for a remote daemon, especially when it runs as a background service.

Recommended Setup

The easiest path is through Pane itself:

1. Install Pane normally on the machine that should host your repos and agents.
2. On that host machine, open Settings > Remote Pane.
3. Under Set Up This Machine, choose a data mode.
4. Choose Tailscale.
5. Click Set Up Tailscale & Create Code.
6. Copy the generated pane-remote://... connection code. If Pane offers Open in Pane Terminal and Run Setup, use it. The terminal can install Tailscale when needed, walk through login, configure Tailscale Serve, and create the code.

Paste that full code into the client Pane app:

1. Open Settings.
2. Expand Remote Pane.
3. Paste the code into Connection Code.
4. Click Import & Connect.

If the client device does not have Tailscale installed or cannot resolve the host’s Tailscale hostname, Pane will show a recovery card. Use Open in Pane Terminal and Run Setup on the client, then retry the saved profile.

Phone and Browser Access

The same connection code works in the Remote Pane browser app:

https://runpane.com/app/

Use this when you want to check or steer terminal-backed sessions from a phone or tablet.

1. Set up the remote host with Tailscale or a trusted HTTPS tunnel.
2. Copy the full pane-remote://... code from Settings > Remote Pane on the host. If you used the headless installer, copy the code from the terminal output.
3. Open runpane.com/app  on the client device.
4. Paste the code and tap Import & Connect.

The browser app currently supports terminal-backed remote sessions. The desktop app has the full Pane surface, including every panel type.

For mobile, prefer Tailscale or Manual HTTPS. SSH tunnel mode is best for desktop clients, because the browser must be able to reach the forwarded daemon URL from the device where it is running.

If your question is specifically whether Remote Pane works over SSH, see Remote Pane over SSH. It explains the SSH tunnel flow, the exact setup commands, and why Pane uses a daemon instead of plain SSH.

Install the Browser App

On iPhone or iPad:

1. Install and sign in to Tailscale if your connection code uses a Tailscale URL.
2. Open https://runpane.com/app/ in Safari.
3. Tap the Share button.
4. Tap Add to Home Screen.
5. Open Remote Pane from the home screen and paste your connection code.

On Android:

1. Install and sign in to Tailscale if your connection code uses a Tailscale URL.
2. Open https://runpane.com/app/ in Chrome.
3. Open the browser menu.
4. Tap Add to Home screen or Install app.
5. Open Remote Pane from the launcher and paste your connection code.

On desktop Chrome or Edge:

1. Open https://runpane.com/app/.
2. Click the install icon in the address bar, or use the browser menu and choose Install app.
3. Open the installed app and paste your connection code.

On desktop Safari:

1. Open https://runpane.com/app/.
2. Choose File > Add to Dock.
3. Open Remote Pane from the Dock and paste your connection code.

Headless VM or Server Setup

For a headless VM or server, run the guided runpane CLI on the host and choose Set up this machine as a remote host:

The CLI setup flow installs Pane if needed, configures the remote daemon, configures Tailscale Serve when requested, and prints one pane-remote://... code.

If you want a direct command for automation:

npx --yes runpane@latest install daemon --label "My Server"
pnpm dlx runpane@latest install daemon --label "My Server"
pipx run runpane install daemon --label "My Server"

If Pane is already installed on the host, run setup directly:

pane --remote-setup --label "My Server"

If you are working from a source checkout instead of an installed build:

pnpm remote:setup -- --label "My Server"

Host Data Modes

Remote Pane supports two host modes:

Current Pane Data

Use this when you want another device to control the same Pane app data that is already open on the host.

• Uses this Pane install’s projects, sessions, and settings.
• The remote host is live while Pane is open on the host.
• Best for a desktop, WSL machine, or laptop you actively keep running.

Isolated Daemon Data

Use this when you want a separate remote daemon data directory.

• Uses separate daemon data instead of the host app’s current Pane data.
• Can install a background service where supported.
• Best for a VM, server, or always-on remote host.

Tailscale Details

Pane keeps the daemon bound to loopback (127.0.0.1) by default. Tailscale Serve exposes that loopback daemon safely inside your tailnet.

tailscale serve --bg http://127.0.0.1:42137

Both devices must be signed into the same Tailscale account or tailnet. On macOS and Windows, the Tailscale app may need a moment after first login before MagicDNS and Serve are ready. If the profile times out immediately after setup, wait a minute or two and click Retry Connection.

The connection code may include a Tailscale hostname and a Tailscale IP fallback so Pane can still connect when the OS DNS resolver is slow to pick up MagicDNS.

Host Controls

When this machine is accepting remote connections, Settings > Remote Pane shows a live host status.

From the host, you can:

• see whether the remote host is live
• see connected remote clients
• disconnect live clients
• revoke a paired client’s access token
• stop the remote host

Disconnecting a client drops the current connection. Revoking a client removes its saved access, so that client cannot reconnect with the same imported profile.

The sidebar also shows a Remote status dot. Green means this machine is hosting. Blue means this app is connected to a remote runtime.

Multi-Client Device Labels

When multiple clients connect to the same host, the sidebar shows a viewer badge next to each session indicating which client is viewing it.

Each client is identified by its device label, set automatically from the connecting device.

Permissions in Remote Mode

Permission prompts route to the client that owns the session. If a Claude Code or Codex agent asks for permission, the dialog appears on the client that started that session.

When the owning client is disconnected, prompts queue until it reconnects. Unanswered prompts are auto-denied after five minutes. Clients viewing a session they do not own see a read-only indicator instead of the permission dialog.

Remote Desktop For GUI Apps

Pane controls the coding runtime: worktrees, terminals, Git actions, and AI agent panels run on the remote host.

For GUI work on the host, use Remote Desktop alongside Pane. This is the right path for:

• Electron apps
• native app windows
• browser previews that open on the host
• OS-level setup screens

When Pane is connected to a remote runtime, the sidebar shows a Remote Desktop shortcut that opens Chrome Remote Desktop. Set up Chrome Remote Desktop on the host if you want full visual access to that machine.

When connected to a remote runtime, the sidebar shows a Remote Desktop shortcut button that opens Chrome Remote Desktop directly.

CLI Options

For a custom label:

npx --yes runpane@latest install daemon --label "GPU VM"

For SSH tunnel mode:

npx --yes runpane@latest install daemon --label "GPU VM" --prefer-tunnel ssh

For an already-installed Pane build:

pane --remote-setup --label "GPU VM" --prefer-tunnel ssh

For Python-only hosts:

pipx run runpane install daemon --label "GPU VM"

For a dry run:

npx --yes runpane@latest install daemon --label "GPU VM" --dry-run --verbose

curl -fsSL https://runpane.com/install-remote.sh | sh -s -- --channel nightly

& ([scriptblock]::Create((irm https://runpane.com/install-remote.ps1))) -Label "Windows VM"

& ([scriptblock]::Create((irm https://runpane.com/install-remote.ps1))) -Label "Windows VM" -PreferTunnel ssh

Useful setup flags:

• --label "Name": set the host label shown in the client.
• --pane-dir <path>: choose the daemon data directory.
• --listen-port 42137: choose the local daemon port.
• --auto-listen-port: pick a nearby open port if the requested one is busy.
• --prefer-tunnel tailscale: prefer Tailscale Serve. This is the default and is the easiest path for phones.
• --prefer-tunnel ssh: print an SSH local-forward command and use a local http://127.0.0.1:42137 profile.
• --prefer-tunnel manual --base-url <url>: use your own trusted HTTPS tunnel or reverse proxy.
• --no-install-service: skip background service installation.
• --no-tailscale-serve: skip Tailscale Serve setup.
• --print-only: print commands without applying setup. Use it with --prefer-tunnel ssh or --prefer-tunnel manual --base-url <url>; default Tailscale setup must configure Tailscale Serve before it can print a usable cross-device code.

Fallbacks

If Tailscale is not available, use one of the advanced connection modes in Settings:

SSH Tunnel

The setup output prints an SSH local-forward command:

ssh -N -L 42137:127.0.0.1:42137 user@your-host

Run that on the client machine before connecting the saved profile.

Manual HTTPS

Use Manual HTTPS when you already have a trusted tunnel or reverse proxy that forwards to the host daemon.

Only expose the daemon through a trusted private tunnel or HTTPS endpoint. Do not expose the raw loopback daemon directly to the public internet.

Security

The import code contains a bearer token. Treat it like a secret. If a code or client profile is shared accidentally, open Settings > Remote Pane on the host and revoke that client.