In my case Java app is JDownloader. I prepared chroot environment as explained here:

So, I have java installed, added group and user, JDownload files copied, but when I try to run it (as regular user under chroot; I run chroot as root, but once I am in chroot, I switch to chroot regular user):

java -Xmx512m -jar JDownloader.jar

I got some positive messages like loading skins by JDownloader

10 4/6/11 2:15:17 PM - FINER [jd.JDClassLoader(<init>)] -> Look and Feel JAR loaded: /mnt/jd/libs/laf/syntheticaSilverMoon.jar

but that's end of the story – app does not show up. No matter if I use chroot to run chroot environment or openroot, the outcome is the same.

When I run JDownload as chroot-root I got a little more output but at the end exception occurs:

10 4/6/11 2:39:23 PM - FINER [jd.config.DatabaseConnector(<init>)] -> Loading database
10 4/6/11 2:39:23 PM - FINER [jd.config.DatabaseConnector(checkDatabaseHeader)] -> Checking database

10 4/6/11 2:39:23 PM - INFO [jd.Main(main)] -> init Splash

------------------------  Thread: 11  -----------------------

11 4/6/11 2:39:25 PM - INFO [jd.gui.swing.laf.LookAndFeelController(setUIManager)] -> Use Look & Feel: de.javasoft.plaf.synthetica.SyntheticaSimple2DLookAndFeel

11 4/6/11 2:39:25 PM - SEVERE [jd.controlling.JDLogger(exception)] -> SEVERE Exception occurred java.lang.reflect.InvocationTargetException

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)

I have the same Java installed in chroot and normal system, and I can run the same JDownloader in normal system; no problems here.

What I am missing here? How do I run GUI Java app?

  • 1
    Consider using cgroups or LXC, they might suit you better (and are much easier to deal with). Commented Apr 6, 2011 at 13:54
  • @Let_Me_Be Many thanks. cgroups is pretty new I guess, because I didn't find anything to read really, but LXC looks VERY promising. However I will try to finish chroot approach first, and then move to LXC. Commented Apr 7, 2011 at 8:21
  • Actually LXC is built on top of cgroups :) Commented Apr 7, 2011 at 9:35
  • Use schroot and set the $DISPLAY environment variable in the chroot.
    – Ken Sharp
    Commented Jun 6, 2021 at 18:08

3 Answers 3


If you're trying to get any chrooted app to show up in X11, you will need a couple of things set up correctly. One is a valid DISPLAY environment variable, second is a proper Xauthority file, and third and most important, access to the socket used by X11/Xorg. X11 can use either a TCP network socket or a Unix Domain socket. A TCP socket will be easier to use from a chroot, but most modern desktops have TCP turned off with -nolisten tcp or something similar set on the X server. TCP sockets start at TCP port 6000 for display :0 up through 6063 for the last display. As long as TCP sockets are listening, you shouldn't need to do anything more with sockets. You still need to worry about DISPLAY and Xauthority. Unix domain sockets require a little more work and, at least on Linux, reside under /tmp/.X11-unix/X? where ? is a number from 0 to 63. If your chroot resided on the same filesystem as /tmp then you can use hard links, at least on Linux. Symbolic links won't leave a chroot. Replace ? with the correct display number:

mkdir /path/to/chroot/tmp
chmod 1777 /path/to/chroot/tmp
mkdir /path/to/chroot/tmp/.X11-unix
chmod 1777 /path/to/chroot/tmp/.X11-unix
ln -f /tmp/.X11-unix/X? /path/to/chroot/tmp/.X11-unix/X?

mkdir and chmod only need to be done once, but the socket file will need to be recreated with ln on each X session. If /tmp is not on the same file system, life is harder and you will need some kind of hackery such as making /tmp/.X11-unix a symbolic link to the corresponding directory under the chroot. Next, make sure the DISPLAY environment variable is set and matches what is used by your terminal and other X11 apps. Lastly, to copy over the .Xauthority, use xauth. You need to find the matching cookie for your X11 session and this cookie will be different for every session. Use xauth list $DISPLAY to print out cookies for your DISPLAY. The name will look like host:? or host/unix:? where host is the hostname of the computer and ? is the display number. The display number can be retrieved with echo $DISPLAY and it will be the number following the colon (:) and before any period (.) To copy over the Xauthority, use something like this:

xauth extract /path/to/chroot/.Xauthority host/unix:1
xauth -f /path/to/chroot/.Xauthority list

The second command simple list the copied entries. If you need to copy while using sudo or other command to change users, try something like this:

xauth extract - host/unix:1 | sudo xauth -f /path/to/chroot/.Xauthority merge -

If the place you put the .Xauthority file is not the home directory for the chrooted user, you will have to set the XAUTHORITY environment variable:

export XAUTHORITY=/path/to/chroot/.Xauthority

As you can probably tell, it's not typical to run a GUI app under a chroot.

  • Many, many thanks. Thank to your tutorial I was able to run xterm without problems (btw. I thought that openroot is design to "hide" all those scary details from user), however when I run JDownloader -- no change, literally. It fails with exception (the one, I posted in question). Commented Apr 7, 2011 at 9:46
  • 2
    chroot's can be difficult to debug. Obviously something's still missing, but I'm not sure what. Sometimes I can figure out by using strace or equivalent program. Comparing a working strace with a broken one. Mostly likely it's attempting to access some file, possibly a socket. strace -efile -oprog.trace prog limits tracing to only file access, stores the trace to prog.trace and runs prog.
    – penguin359
    Commented Apr 7, 2011 at 19:06
  • 2
    Note: if your chroot is not on the same filesystem as /tmp, then you can bind mount .X11-unix
    – totaam
    Commented Feb 23, 2014 at 17:25

Make sure the environment variable XAUTHORITY is set (usually to ~/.Xauthority). Then, in the host:

$ xauth list
latitude/unix:0  MIT-MAGIC-COOKIE-1  d4474d13c

Now, within the chroot environment:

# chroot some-debian
# xauth add latitude/unix:0 MIT-MAGIC-COOKIE-1 d4474d13c
# xcalc
  • 1
    Well that just telly me: xauth: error in locking authority file /tmp/kde-panzi/xauth-1000-_0 ... Ah, probably the env vars!
    – panzi
    Commented Jul 9, 2014 at 0:47
  • 1
    I got xauth: file /tmp/xauth-1000-_0 does not exist or running xauth add ... but on running that with sudo (sudo xauth add ..) that error is gone.
    – Ajeeb.K.P
    Commented Apr 7, 2019 at 7:32
  • I also got the above problems. I think the answer is good, but a short additional subsection could be added for the Xauthority file. Otherwise I like the answer since it is so concise and to the point.
    – shevy
    Commented Jul 22, 2020 at 11:47
  • This works perfectly. You do have to remember to point XAUTHORITY to a proper .Xauthority file (you can just copy the one from your host).
    – DUO Labs
    Commented Sep 9, 2021 at 17:12

I don't think there's anything you need to do specifically for Java apps, but you do have to do something for GUI apps in general.

I've done this on my home computer, but I'm not at home right now so bear with me. I have a script that mounts everything into my chroot like /dev and /proc, but it also copies ~/.X* as well. If I remember correctly, in your home folder there are files that start with .Xauth, and you copy those into the home folder of your chroot environment. In my experience these files need to be copied every time that X is restarted.

What I would do to test this method out was I'd just run a simple X application like xterm. It was just a fast and simple app I could test with. xterm should give you an error message if it can't connect to the X server.

I happen to have the full X11 package installed into my chroot, but I don't know enough about X to know if chroot'd apps run on a chroot'd X server or on the host X server.

  • Good point. With openroot and root user within chroot environment I get error: "Invalid MIT-MAGIC-COOKIE-1 keyWarning: This program is an suid-root program or is being run by the root user." and with regular simply "xterm Xt error: Can't open display: :0". Commented Apr 7, 2011 at 9:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .