BZFlag runs in the browser on desktop, phone and VR via the bzo project

A browser client for a multiplayer tank game

bzo, short for Battlezone Online, is a free 3D multiplayer tank game that runs entirely in the browser — on a desktop, a phone or a VR headset — and, according to the project's GitHub repository, interoperates with existing BZFlag clients and servers. The project, published under the timriker GitHub account, reached Hacker News's front page on October 21, 2026, and is playable now at bz.rikers.org without installing anything.

A companion page at bz.rikers.org/list shows the public bzo servers and the BZFlag servers they proxy. Clicking a row puts the player straight into that game.

How it is built

The repository describes the server as Node.js and the client as Three.js, connected over WebSockets, WebTransport and WebRTC. Because a bzo server can proxy ordinary BZFlag servers, browser players can join games already running in the native ecosystem rather than waiting for a separate browser-only community to form. In the other direction, launch links on the list page can hand a game to an installed native BZFlag client through bzflag:// links on Linux, Windows and macOS. The documentation also defines an HTTP API that polling sites and server browsers can query for stats.

VR handled natively

The VR mode uses native WebXR and requires a browser and headset that support the immersive-vr session type. Remote deployments have to serve over HTTPS, and the client automatically switches to wss:// for its WebSocket connection when the page is secure.

The README describes a particularly fussy launch path: a script called xr-launch.js requests the immersive session before the rest of the client loads, and retries on every signal that could carry the user activation such a session needs — window load, focus, page show, visibility change and the Launch Handler. Where none of that lands, a VR Mode button remains. Text entry in XR leans on the headset's system keyboard, which Quest Browser 26.1 and later provide; on headsets without one, the affected rows are marked desktop-only and the server assigns a name instead. A one-tap VR button is hidden on phones, because Chrome on Android claims immersive-vr support on any device through Cardboard, so there VR Mode stays in the settings menu. Deployments sending a restrictive Permissions-Policy header must allow xr-spatial-tracking=(self). WebGPU rendering is explicitly outside the project's validation checklist.

Every flag, with one quirk

bzo carries every flag BZFlag has. The README singles out WA (Wide Angle) as the odd case: it widens the field of view, but in VR the headset handles the projection itself, so the flag effectively does nothing there. The reasoning is documented in the project's flags reference. Controls span keyboard and mouse, on-screen touch, gamepads and XR controllers, with the keyboard map shown in-game through / or ?.

Operators and releases

For self-hosters, every tagged release publishes a GitHub release with notes generated from the changelog, a source tarball, and Docker images at GitHub Container Registry. Images are built on Ubuntu 26.04 using Ubuntu's own Node.js 22 package, in both linux/amd64 and linux/arm64 variants, with moving tags alongside versioned ones. Release tags follow stable SemVer only, and the docs cover installation, reverse proxies, listing your server and proxying BZFlag servers.

A licensing caveat

The code is AGPLv3, but the assets are a mixed story: some come from the BZFlag project under its own licence, some were made for bzo, and some arrived with contributions whose origins were never recorded. The README is candid that not every file in the tree meets its own documentation bar, and that assets of unrecorded provenance remain an open question.

Why it matters

The interesting part is not that another game runs in a browser, but that this one plugs into infrastructure that already exists. Browser players can join live BZFlag servers through a proxy, and native client users keep working unchanged, so bzo expands the ecosystem instead of forking it. It is also a compact demonstration of how far the web platform has come as a games runtime: Three.js rendering, three transport options including WebTransport and WebRTC, and standards-based WebXR with careful handling of real headset quirks like session activation and system keyboards. For maintainers of other open-source games that ship only native clients, it is a workable template for adding a zero-install front end. And its frank licensing section is a useful reminder that when reviving older game projects, asset provenance is often messier than the code licence itself.