PoC: Add faster Guacamole container desktop

[Marcus Robinson (marrobi)]

Relates to #4311

What is being addressed

Issue #4311 reports that provisioning and signing in to a review VM can take 15 minutes or more. This PR adds a proof-of-concept Linux desktop running on Azure Container Instances (ACI), accessed through the existing Guacamole workspace service.

In the tested deployment, an uncached 2.14 GiB runtime image pull took approximately 2 minutes 32 seconds and the container started about 15 seconds later. This gets the desktop running in roughly three minutes even on a cold pull, substantially faster than the VM workflow described in #4311. Warm starts may be faster when ACI can reuse cached image layers.

The template is currently a general Guacamole user resource rather than an Airlock-specific review resource. It provides a concrete container-based option that can be evaluated for that workflow.

How is this addressed

• Add an Ubuntu 22.04 ACI desktop with XFCE, XRDP, Microsoft Edge, Visual Studio Code, Python/Jupyter, R/RStudio, Azure CLI, Storage Explorer, and Git.
• Install software in independently cached runtime-image layers so deployment only applies environment-specific configuration and starts desktop services.
• Integrate a private delegated ACI subnet into the Guacamole workspace service and reuse its existing connection and Key Vault credential conventions.
• Provide 2 CPU / 4 GB, 2 CPU / 8 GB, and 4 CPU / 16 GB compute profiles.
• Add start and stop actions, with documentation covering billing and ephemeral container state.
• Keep shared storage disabled by default because ACI's Azure Files integration requires Shared Key authorization, which Azure TRE disables by default.
• Add user and template-author documentation, including production limitations.

This proof of concept does not support Docker or nested containers. Its operating-system disk and user profile are ephemeral, and production use still requires validation of networking, storage policy, regional capacity, and Airlock workflow integration.

Validation

• Deployed and upgraded tre-service-guacamole-container end to end on ACI.
• Verified Guacamole login, XFCE, Microsoft Edge first launch, RDP, and packaged tools.
• Verified runtime image smoke tests, including non-root Edge rendering.
• porter lint
• terraform fmt -check and terraform validate
• Shell syntax and JSON schema parsing
• mkdocs build --strict
• Repository pre-commit hooks

[github-actions]

Unit Test Results

0 tests   0 ✅  0s ⏱️
0 suites  0 💤
0 files    0 ❌

Results for commit ce434c1.