[facile3232]

> You can boot a Linux kernel with an nfs root from the local machine and use headless vnc to run a browser in a vnc client window.

Not only is the VNC redirection unnecessary, so it is the entire filesystem. You could just render the vm directly to the window and boot a read only image. Plus then you don't have to deal with VNC.