Fincer
commented
6 years ago I have used systemd-nspawn to run Pale Moon web browser in a container with graphical interface (X11) + Pulseaudio enabled. Pulseaudio is needed for any web media content that have audio in it (such as Youtube videos).
I have read it is possible to run graphical applications with docker, too.
Please take also a look on x11docker project which claims to focus on X11 security issues and should provide a somewhat easy set-up for X11 + docker container environment.
For loose reference: Running Firefox in a systemd-nspawn container
You can very likely use firejail inside systemd-nspawn container so that the end-user environment is kind of having two containers stacked. I have planned to use firejail in my systemd-nspawn containers after issue private-lib doesn't work with Palemoon & Firefox is fixed.
Security & X11
Problem of sharing X11 environment with the host is the shared memory which, in some cases, can be a security issue. This is likely an issue with Pulseaudio, too.
Setting up systemd-nspawn container + X11 application (my personal setup)
I have done this on Arch Linux, so some parts are specific for that distribution. The following stuff assumes you have your main system's current user in sudo group and you have working internet connection available in the system.
-
Create a new container folder (in your home folder, for example):
mkdir -p ~/my-containerYou can choose whatever path you want to. ~/my-container is just an example here.
-
Set up container environment by running the following in your main system (this is Arch Linux specific approach):
sudo pacman -S arch-install-scripts sudo pacstrap -i -c ~/my-container curl pacman coreutils systemd nano -
Login to the Arch Linux container environment:
sudo systemd-nspawn -b -D ~/my-container -
In container environment, login as root when login credentials are asked.
-
In this step, we request public keys of Arch Linux package maintainers and run database updates. In container environment, run:
pacman-key --init && pacman-key --populate archlinux pacman -Syy && pacman -Fy -
In container environment, create a new user 'default' & set home directory óf this user to /home/default:
useradd -d /home/default -u 1000 default mkdir -p /home/default && chown 1000:1000 /home/default -
In container environment, install your program (as root):
pacman -S program_name -
In container environment, add password to user 'default' and change to user 'default' shell. In default user's shell, create a new file called 'launch.sh' in his/her home directory and set it as executable:
passwd default su default touch /home/default/launch.sh chmod +x /home/default/launch.sh
The last two commands (touch & chmod) must be run as 'default' user.
- In container environment, edit the created 'launch.sh' file as user 'default' (nano /home/default/launch.sh). Add the following contents in it:
#!/bin/sh
su default -c "QT_X11_NO_MITSHM=1 PULSE_SERVER=unix:/run/user/host/pulse/native DISPLAY=:0 my_command"
where 'my_command' is the name of your program's executable file in container environment. If you don't use Pulseaudio in container environment, remove _PULSE_SERVER=unix:/run/user/host/pulse/native_ part.
Note: any environment variables you describe in the command above depends on your set-up. If you use ALSA, for example, write a correct string for that.
10. Exit the container environment by pressing _CTRL + %_ key combination (or _CTRL + ]_ with en_US keyboard) rapidly three times sequentially.
11. Execute your program in container by running the following command in your main system:sudo xhost local:root && sudo systemd-nspawn \ --bind-ro=$HOME/.Xauthority:/home/default/.Xauthority \ --bind-ro=/tmp/.X11-unix \ --bind-ro=/run/user/1000/pulse:/run/user/host/pulse \ --bind-ro=/dev/snd \ -D ~/my-container \ /home/default/launch.sh
The above command does as follows:
- Share main system X11 environment
- Initialize systemd-nspawn container
- bind your main system's current user .Xauthority file to the container's default user home directory (read-only).
- bind your main system's X11 sockets to the container environment (read-only)
- bind your main system's Pulseaudio to the container environment (read-only)
- specify container path (-D ~/my-container)
- in container environment, execute _home/default/launch.sh_ (in which we have set up that our command is executed as user 'default')
Additional Pale Moon parameters
-----------
NOTE: bind parameters you might want to use vary, depending on the requirements for the program. For example, I have additional parameters for my 'Pale Moon' web browser environment:
--bind-ro=/usr/share/icons/:/usr/share/icons/ \ --bind-ro=/usr/share/themes/:/usr/share/themes/ \ --bind-ro=/usr/share/fonts/:/usr/share/fonts/ \ --bind-ro=$HOME/.gtkrc-2.0:/home/browser/.gtkrc-2.0 \ --bind=$HOME/Downloads:/home/browser/Downloads \
Note that I have binded my main system's _$HOME/Downloads_ folder as writable.
Some of these bindings are irrelevant if I have set up a working GTK2 environment or installed fonts/icons into the container. As I haven't installed fonts/icons in the container, I bind the ones I have in my main system. And, for example, without GTK2/icon bindings the program (Pale Moon) works but looks awful.
Which systemd-nspawn bindings to use?
-----------
How do you know which bindings you want to use? Check your program requirements.
Does your containerized program use Qt5, GTK2 or GTK3? Does it require ALSA or Pulseaudio? Does it require some fonts installed? Does it require some icons installed? Just find out (can be tricky) and by your findings, set up your _--bind-ro_ parameters correctly to the command in step 11.
Firefox/Palemoon + systemd-nspawn X11 workaround
-----------
For Firefox and Pale Moon, there seems to be a bug of some sort which prevents these web browsers to start ([ABORT: X_ShmPutImage](https://bugzilla.mozilla.org/show_bug.cgi?format=default&id=1129790)).
If you encounter this issue, you may try the following as a workaround: set up a short while loop for the launch command (in _/home/default/launch.sh_) which executes it twice unless the program has already been started successfully. So, in my case with Pale Moon, I replace the contents of _/home/default/launch.sh_ with the following:
!/bin/sh
i=1 while [[ i -ge 0 ]]; do su browser -c "QT_X11_NO_MITSHM=1 PULSE_SERVER=unix:/run/user/host/pulse/native DISPLAY=:0 palemoon" 2>/dev/null if [[ $(ps -C palemoon | wc -l) -gt 2 ]]; then break fi let i-- done
NOTE: Executable name varies depending on your program of choice. In my case, it is _palemoon_, as seen in the above command.
NOTE: I don't guarantee this workaround works for you but I can say "It works for me".
In the above command, I need _procps-ng_ package to be installed in my Arch Linux container. To do that, I simply execute the following in the main system:sudo pacstrap -i -c ~/my-container procps-ng
Now I should be able to launch the program correctly with the command introduced in step 11, with additional Pale Moon parameters (see 'Additional Pale Moon parameters' section above).
Setting up a shortcut for the container
-----------
12. To set up a shortcut for your container in your main system, simply create a new _.desktop_ file (such as my-container.desktop) with the following 'Exec=' parameter (NOTE: this applies to KDE environment, use your preferred terminal emulator here):Exec=konsole -e /home/user/launch-my-container.sh
13. Create a new file _launch-my-container.sh_ in the home folder of your system's current user with the contents described in step 11. Make this file as executable:
chmod +x /home/user/launch-my-container.sh
Other contents of your desktop file vary depending on your program of choice.
Controlling systemd-nspawn container resources
-----------
Please check [this](https://copyninja.info/blog/taming_systemd_nsapwn.html), [this](https://blog.selectel.com/systemd-containers-introduction-systemd-nspawn/) and [this link](https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html) for some details.
-----------
I hope this helps you a little bit in your issue. Remember to fit my instructions depending on your running system environment (do you run Ubuntu/Debian/Fedora...etc.) and program requirements.
-Fincer
punksta
netblue30
I'd like to run time-tracking app with ide and browser in single x11 sandbox. Is it possible?