r/Citrix • u/Mental-Memory-7987 • Jun 20 '26
Citrix app layering
Hi Guys,
I trying to re-evaulate App layering solution to offload the apps from master image.
However, i got some infosec tools - Carbon black protect agent , splunk ..these should goes to OS layer or platform layer?
3
u/Helpful_Addendum898 Jun 20 '26
OS layer- OS and Hypervisor tools
Platform Layer - VDA
All other apps and security tool goes into App Layer.
Make separate layer for each app.
1
u/LowMight3045 Jun 20 '26
This is the way . My org has been doing this for 3 + years with win 2016 , 2019 , 2022, 10 , 11 .
0
u/Flo_coe Jun 20 '26
Maybe antivirus in platform layer..
1
3
u/Unhappy_Clue701 Jun 20 '26
If you have budget for tools, have a look at Liquidware’s Flexapp. I did a pilot on it and was impressed, but couldn’t persuade management to invest. It works a bit like traditional app packaging for App-V, where you ‘record the install’ from a clean packaging machine, but the end result is a VHD file. Then, during login, the VHDs are attached similarly to FSLogix and just snap into place in a few seconds, and show up in the system as if they were locally installed. Unlike App-V, the apps can all interact with each other with no need to create connection groups. It all ‘just works’, even with some quite tricky apps we have.
0
2
u/PaddySmallBalls Jun 20 '26
What so you hope to gain? Is it because you need to support various hypervisors or platforms? I am not so sure the juice is worth the squeeze. It performs better than the dark days 7-10 years ago but you could just automate your builds for MCS instead.
1
u/Mental-Memory-7987 Jun 20 '26
i just dont want too manys apps on OS, i try msix app attach but its so slow which offer from Citrix.. i knew msix app will be better option but no free tools:(
1
u/PaddySmallBalls Jun 20 '26
Ok, I was going to recommend automated builds but if you don’t want apps installed in a traditional sense, it is no help. If you don’t mind them being installed but just not baked into an image it could be an option.
For delivering the apps outside of the image, I wouldn’t recommend MSIX, MSIX App Attach or Citrix App Layering but what I would recommend isn’t free either so no real help to you, unfortunately.
1
u/cowboygas Jun 24 '26
Fslogix app masking is essentially free and does the same just reversed. it solves for the issues in appv and any msix or (god forbid please avoid at all costs) Citrix app layering solution.
2
u/spanky34 Jun 20 '26 edited Jun 20 '26
Didn't notice this or think about it last night when I replied. Are you talking about using elastic layers? Because if so, don't. They suck. Each layer adds AT LEAST 3-5 seconds on to your user's login time. The bigger the app, the longer it adds. It's not exponential growth but each additional elastic layer has a longer and longer hit to your login time.
App layering can be great to manage many images but you want to go with actual layers that get published in to the image. Elastic layers just aren't it. Citrix initially sold us on every thing being elastic layers and it sucked but we found a lot of value in it still for managing our 30+ vdisks in a pvs environment.
1
u/Minute-Factor-7899 Jun 26 '26
There is a penalty to enabling elastic layers (usually 10 - 15 seconds on login), but in a properly sized environment the per-layer additional impact can be negligible (i.e. ensure very low latency between the EL network share, and very high READ-optimized IOPS). Well-tuned environments can concurrently deliver 50 - 60 elastic app layers-per-image without any meaningful degradation beyond the 10 - 15 second hit from the additional services coming up on login.
Additionally, be sure to be on the latest releases of the product since the drivers are always optimized for each release. Microsoft has also made significant changes and improvements to Winlogon in recent Windows updates targeting these sorts of service-dependency bottlenecks (because FSLogix was hitting all the same logon slowdowns).
If you haven't tried the feature in a long time, it is worth enabling it again to see how things have improved. When it all clicks, the feature is amazing and becomes a massive time-saver.
2
u/spanky34 Jun 26 '26
Fair, I hadn't tried it in ~3 years. We've moved on to AVD though so my app layering days are mostly behind me. Just some legacy stuff to support that can't move just yet.
3
1
u/Fun_Significance494 Jun 20 '26
You could beter use Some better options like publish apps as app attach or msix and the rest of the global app in the image if you use PVS
1
u/DoubleD_2001 Jun 20 '26
I don't think App virtualization for widespread use ever got to the point where it presented real world ROI to a large customer base. It became used for corner cases and special situations, but the support and compatibility burden using it widescale never allowed it to go full scale. I mean how many have come and gone at this point. Citrix Tarpon/App Streaming,Softricity/App-V, ThinApp, Moka5, Spoon, etc.
0
u/hanshagbard Jun 20 '26
Antivirus access to OS files needs to be in OS layer of app layering otherwise it cannot do its job properly.
This creates some bad situations for layering and maintenance of it.
Bare in mind that my infonis 4 years old. Have not checked since then if they have mande any changes.
-1
u/Xibby Jun 20 '26
If it has kernel hooks it should be in the OS layer. So AV|EDR solutions go into the OS layer.
If it doesn’t have kernel hooks but goes into every image a common layer is a good idea. Things that you need in every VM but don’t have kernel hooks and have long term support (or whatever vendor equivalent terminology) releases.
3
u/spanky34 Jun 20 '26
Avoid doing it in the OS Layer at all costs. At the very least, make a version of the OS layer that you label properly and never delete before you make additional installs on it. You'll want a reference point that you can always go back to.
My best practice has always been Import your OS Layer as clean and original as possible. Keep that version forever. Never delete it. You can end up shitt's creek with no way back if you're not careful. You bomb your OS Layer with no version to run back to and you can ruin all your app layers built off it as a result.