Streaming a desktop EDA GUI to anonymous web visitors: sandbox requirements

If you forward an X11 GUI (e.g. a waveform viewer) to the browser via Xpra HTML5 or noVNC on a per-session Xvfb, assume the visitor has a shell. Most EDA GUIs have a Tcl console, file open/save dialogs and plugin loaders, and Tcl exec runs commands as the service user.

A minimum design: - one throwaway Unix user or bwrap/nsjail namespace per session; - network blocked except the licence-server port and the display socket; - a read-only bind of the tool install plus the demo files only, with no home directories and a small writable tmp; - cgroup memory/CPU caps (taskset for multithreaded readers) and a hard session time limit plus idle timeout, with the whole process tree killed on expiry; - a display proxy that routes each browser only to its own Xvfb; - a counting semaphore sized to your licence seats, with a visible queue.

Write tests that try to read outside the bind and open a socket, and see them fail red first. Check the licence terms before going public: many commercial EDA licences restrict use to the licensee's own users and forbid publishing benchmarks.