mviereck / x11docker

Run GUI applications and desktops in docker and podman containers. Focus on security.
MIT License
5.62k stars 378 forks source link

docker-for-win: Xvfb in cygwin #123

Closed eine closed 5 years ago

eine commented 5 years ago

This is the output I get if I try to execute x11docker with option --xvfb in cygwin:

$ ./x11docker --xvfb x11docker/lxde pcmanfm
x11docker note: Failed to check for sshd. ps -p not supported.

x11docker note: Per default x11docker stores its cache files on drive C:.
  docker setup may not allow to share files from drive C:.
  If startup fails with an 'access denied' error,
  please either allow access to drive C: or specify a custom folder for cache
  storage with option '--cachebasedir D:/some/cache/folder'.
  Same issue can occur with option '--home'.
  Use option '--homebasedir D:/some/home/folder' in that case.

x11docker note: Windows firewall settings can forbid application access
  to the X server. If no application window appears, but no obvious error
  is shown, please check your firewall settings. Compare issue #108 on github.

x11docker note: Option --xvfb: Specifying quite big virtual screen size
  for --xvfb: 4720x3840
  This costs some memory, but will fit most possible remote screens.
  To save memory, specify needed screen size only with e.g. --size=1980x1200
  Check output of 'xrandr | grep current' on your target display.

x11docker note: Did not find container init system 'tini'.
  This is a bug in your distributions docker package.
  Normally, docker provides init system tini as '/usr/bin/docker-init'.

  x11docker uses tini for clean process handling and fast container shutdown.
  To provide tini yourself, please download tini-static:
    https://github.com/krallin/tini/releases/download/v0.18.0/tini-static
  Store it in one of:
    /home/eine/.local/share/x11docker/
    /usr/local/share/x11docker/

x11docker note: setxkbmap not found. Need setxkbmap and xkbcomp to set keyboard layout.

x11docker ERROR: Error during startup of X server --xvfb.
  Last lines of xinit log:
[mi]    COMPOSITE
[mi]    DAMAGE
[mi]    MIT-SCREEN-SAVER
[mi]    DOUBLE-BUFFER
[mi]    RECORD
[mi]    DPMS
[mi]    X-Resource
[mi]    GLX
(EE) Fatal server error:
(EE) Cannot establish any listening sockets - Make sure an X server isn't already running(EE)

  Type 'x11docker --help' for usage information
  Debug options: '--verbose' (full log) or '--debug' (log excerpt).
  Logfile will be: /cygdrive/c/Users/eine/x11docker/cache/x11docker.log
  Please report issues at https://github.com/mviereck/x11docker

x11docker.log

I am quite sure that there is no other X server running on the port. I also tried with --display=30.

mviereck commented 5 years ago

It looks like an issue within Xvfb.exe. x11docker runs it with:

/usr/bin/Xvfb :100 -screen 0 4720x3840x24 \
  -dpms -s off -retro \
  +extension RANDR +extension RENDER +extension GLX \
  +extension XVideo +extension DOUBLE-BUFFER \
  -extension X-Resource +extension SECURITY +extension DAMAGE \
  -extension XINERAMA -xinerama -extension MIT-SHM \
  -auth /cygdrive/c/Users/eine/x11docker/cache/x11docker-lxde-014aba6f82dc918acd746a69d9eb0592/Xservercookie \
  -nolisten tcp -nolisten local \
  +extension Composite +extension COMPOSITE \
  +extension XTEST

Please try to run Xvfb on itself. A shorter setup that should work is:

/usr/bin/Xvfb :200 -screen 0 4720x3840x24 -ac

x11docker would have to set up an IP:DISPLAY connection to allow access within container, I can add this. But Xvfb already fails before that.

eine commented 5 years ago

The provided minimal example seems to work ok, or not, idk:

$ /usr/bin/Xvfb :200 -screen 0 4720x3840x24 -ac
MIT-SHM extension disabled due to lack of kernel support
XFree86-Bigfont extension local-client optimization disabled due to lack of shared memory support in the kernel

No error. No more output. Since it is not visible, I don't know how to check it is working.

I tried adding arguments one by one. This also works:

$ /usr/bin/Xvfb :100 -screen 0 4720x3840x24 \
>   -dpms -s off -retro \
>   +extension RANDR +extension RENDER +extension GLX \
>   +extension XVideo +extension DOUBLE-BUFFER \
>   -extension X-Resource +extension SECURITY +extension DAMAGE \
>   -extension XINERAMA -xinerama -extension MIT-SHM \
>   +extension Composite +extension COMPOSITE \
>   +extension XTEST \
>   -nolisten tcp
[mi] Extension "XVideo" is not recognized
[mi] Only the following extensions can be run-time enabled:
[mi]    Generic Event Extension
[mi]    MIT-SHM
[mi]    XTEST
[mi]    XINERAMA
[mi]    XFIXES
[mi]    XFree86-Bigfont
[mi]    RENDER
[mi]    RANDR
[mi]    COMPOSITE
[mi]    DAMAGE
[mi]    MIT-SCREEN-SAVER
[mi]    DOUBLE-BUFFER
[mi]    RECORD
[mi]    DPMS
[mi]    X-Resource
[mi]    GLX
[mi] Extension "SECURITY" is not recognized
[mi] Only the following extensions can be run-time enabled:
[mi]    Generic Event Extension
[mi]    MIT-SHM
[mi]    XTEST
[mi]    XINERAMA
[mi]    XFIXES
[mi]    XFree86-Bigfont
[mi]    RENDER
[mi]    RANDR
[mi]    COMPOSITE
[mi]    DAMAGE
[mi]    MIT-SCREEN-SAVER
[mi]    DOUBLE-BUFFER
[mi]    RECORD
[mi]    DPMS
[mi]    X-Resource
[mi]    GLX
[mi] Extension "Composite" is not recognized
[mi] Only the following extensions can be run-time enabled:
[mi]    Generic Event Extension
[mi]    MIT-SHM
[mi]    XTEST
[mi]    XINERAMA
[mi]    XFIXES
[mi]    XFree86-Bigfont
[mi]    RENDER
[mi]    RANDR
[mi]    COMPOSITE
[mi]    DAMAGE
[mi]    MIT-SCREEN-SAVER
[mi]    DOUBLE-BUFFER
[mi]    RECORD
[mi]    DPMS
[mi]    X-Resource
[mi]    GLX
XFree86-Bigfont extension local-client optimization disabled due to lack of shared memory support in the kernel

But it fails if I add -nolisten local:

$ /usr/bin/Xvfb :100 -screen 0 4720x3840x24 \
>   -dpms -s off -retro \
>   +extension RANDR +extension RENDER +extension GLX \
>   +extension XVideo +extension DOUBLE-BUFFER \
>   -extension X-Resource +extension SECURITY +extension DAMAGE \
>   -extension XINERAMA -xinerama -extension MIT-SHM \
>   +extension Composite +extension COMPOSITE \
>   +extension XTEST \
>   -nolisten tcp -nolisten local
[mi] Extension "XVideo" is not recognized
[mi] Only the following extensions can be run-time enabled:
[mi]    Generic Event Extension
[mi]    MIT-SHM
[mi]    XTEST
[mi]    XINERAMA
[mi]    XFIXES
[mi]    XFree86-Bigfont
[mi]    RENDER
[mi]    RANDR
[mi]    COMPOSITE
[mi]    DAMAGE
[mi]    MIT-SCREEN-SAVER
[mi]    DOUBLE-BUFFER
[mi]    RECORD
[mi]    DPMS
[mi]    X-Resource
[mi]    GLX
[mi] Extension "SECURITY" is not recognized
[mi] Only the following extensions can be run-time enabled:
[mi]    Generic Event Extension
[mi]    MIT-SHM
[mi]    XTEST
[mi]    XINERAMA
[mi]    XFIXES
[mi]    XFree86-Bigfont
[mi]    RENDER
[mi]    RANDR
[mi]    COMPOSITE
[mi]    DAMAGE
[mi]    MIT-SCREEN-SAVER
[mi]    DOUBLE-BUFFER
[mi]    RECORD
[mi]    DPMS
[mi]    X-Resource
[mi]    GLX
[mi] Extension "Composite" is not recognized
[mi] Only the following extensions can be run-time enabled:
[mi]    Generic Event Extension
[mi]    MIT-SHM
[mi]    XTEST
[mi]    XINERAMA
[mi]    XFIXES
[mi]    XFree86-Bigfont
[mi]    RENDER
[mi]    RANDR
[mi]    COMPOSITE
[mi]    DAMAGE
[mi]    MIT-SCREEN-SAVER
[mi]    DOUBLE-BUFFER
[mi]    RECORD
[mi]    DPMS
[mi]    X-Resource
[mi]    GLX
(EE) Fatal server error:
(EE) Cannot establish any listening sockets - Make sure an X server isn't already running(EE)
mviereck commented 5 years ago

But it fails if I add -nolisten local:

A good find, thanks! Latest update removes -nolisten local and add options --xtest and --xcomposite. I might remove these options again if we find a well suited solution to provide X for xpra. But for now it makes checks easier.

I still have to adjust Xvfb setup for Cygwin to use X over IP, so your x11docker command will fail at another point for now. https://github.com/mviereck/x11docker/commit/2eae875f135bfd27cdc1df00f1d8f41321718ac5 will run arbitrary X servers (and Xvfb.exe, too) in MSYS2 and Cygwin over TCP/IP.

If it fails, you can make sure that X over IP is used if you check X command in --debug for -listen tcp and DISPLAY for the IP. If both are not set, change https://github.com/mviereck/x11docker/blob/master/x11docker#L6371 to Xoverip=yes. If Xvfb.exe does not understand -listen tcp, change https://github.com/mviereck/x11docker/blob/master/x11docker#L2578 to --nxagent|--xvfb) ;;.

mviereck commented 5 years ago

Feel free to re-open if this is of interest again.