search

mviereck / x11docker

Run GUI applications and desktops in docker and podman containers. Focus on security.
MIT License
5.62k stars 378 forks source link

[Q] difference between x11docker and plain ct with bind mount to /tmp/.X11-unix #348

Closed dmnc-net closed 3 years ago

dmnc-net commented 3 years ago

Hi, recently I tried to run xterm, Firefox, Kodi, etc. from the docker rendering on my XServer:

docker run -ti --rm --name mytest -e DISPLAY=$DISPLAY -e uid=$(id -u) -e gid=$(id -g) -v /tmp/.X11-unix:/tmp/.X11-unix mytest:deb

Now I found x11docker and it seems to be really nice and mature project. But I'm still not sure why I eventually need it and why I shouldn't continue in my previous approach. Any flaws and limitations?

eine commented 3 years ago
  1. Shorter and less error prone CLI command.
  2. Consistent CLI commands regardless of the host (Linux or Windows).
  3. Applies secure defaults for reducing attack vectors.

Bonus: why reinvent something or learn all of it yourself if mviereck is so responsive and always open to understanding/explaining the technical details? Better add value to the open source ecosystem.

mviereck commented 3 years ago

x11docker does a lot of security setup to isolate the container from host. Compare https://github.com/mviereck/x11docker#security. Also it provides a lot of options for convenience, like GPU and sound support. See x11docker --help.

In your setup container applications can watch and control host applications. Also you can get RAM access failures and broken graphics due to missing MIT-SHM support. Compare https://github.com/mviereck/x11docker/wiki/Short-setups-to-provide-X-display-to-container

dmnc-net commented 3 years ago

I don't care about the command length which will be stored in single script and at the end of the day in comparison with whole x11docker it's just a few bytes of data. But...

But ok, after going thru the wiki it seems to be good tool without any overhead or "bloat-layers" which was my initial concern. In my case when I trust the application (as I'm running it directly in my OS) and the reason for docker is just because the application requires older packages than my up-to-date Arch Linux now provides, then x11docker will be probably some handy running script and will safe my time in case I'll decide to do some tuning of my previous direct approach.

Thanks guys.