ZimaOS currently documents per-user storage permissions, but not per-user dashboard app visibility. That means member accounts can be restricted to specific files/shares while installed app tiles remain a separate global dashboard concern.
The source thread correctly identified a product limitation: hiding Cloudflared, Jellyfin, or other app icons from selected base users was not supported there. Because current docs still describe one installed-app page without a role-based app-visibility control, treat this as an access-design problem rather than a hidden setting.
File Permissions and App Visibility Are Different
The current ZimaOS multi-user permissions guide supports member accounts with share-level permissions. That does not imply each member gets a different Apps dashboard.
Do Not Rely on Hiding an Icon for Security
Even if a future UI lets you hide an app tile, the app itself still needs authentication and network access control. Security should live at the application or proxy layer.
Protect Admin Apps with Their Own Authentication
Cloudflared, reverse proxies, databases, download clients, and monitoring tools should require app credentials or be reachable only from an admin LAN/VPN. A base user should not gain administrative control merely because they know the port.
Use App-Level Users for Jellyfin and Similar Services
Jellyfin, Nextcloud, Immich, and many other self-hosted applications already provide their own user/role systems. Give family members accounts inside the service rather than shared admin credentials.
Use Cloudflare Access or a Reverse Proxy for Public URLs
If you publish an app through your domain, use the reverse proxy's authentication/access policy where appropriate. The ZimaOS dashboard shortcut can point to the public URL, but that does not replace app authorization.
Avoid Duplicate App Tiles Where Possible
If one internal tile and one external-link tile point to the same service, keep the one that works for your intended audience and remove redundant shortcuts where ZimaOS allows it. Do not remove the actual container merely to clean up the dashboard.
Keep Management Apps Private
Tools such as Cloudflared should be treated as infrastructure, not normal family apps. If ZimaOS cannot hide them per member, restrict their actual network endpoint so visibility does not equal control.
The app access guide provides the safer architecture.
Current Product Boundary
The current ZimaOS features page says installed apps are managed from one page, while user-account permissions are described around storage access. No current first-party documentation exposes role-based app-tile visibility.
FAQ
Can ZimaOS hide apps from one member account?
No current first-party per-user app visibility control is documented.
Can a base user stop Cloudflared?
If the app UI itself allows unauthenticated/admin access, protect that service separately; do not rely on the dashboard tile.
How should I share Jellyfin?
Use Jellyfin's own user accounts and permissions, optionally behind a secure reverse proxy for remote use.
Is app visibility the same as app permission?
No. A hidden icon is UI convenience; application authentication and network policy provide real access control.
