1

While experimenting with docker, I realized I can run a browser in a container for improved security. I managed to start with a clean Docker Fedora, in which I installed the openssh-daemon package. From there I built a new image in which I installed firefox.

I was eventually able to start a graphical Firefox from the host computer, with the following command line:

ssh -p2222 localhost -X firefox   

So far so good, but two very related weird things happen here:

  • If I launch firefox from my real machine, and then I start it from the container, I get a second window configured as in my real machine;

  • The exact opposite, that is, if I start Firefox from the container, and then I start another one from my real machine, a second window as in the container appears.

I was surprised to say the least. The contaner is suposed to isolate completely the process, is it not?

EDIT: I believe I found a related question. The --no-remote option fixes the problem. Still I don't understand how this could happen. I guess this has something to do with the XWindow protocol, since I don't see any other connection between the two instances.

4

Nothing running under X is isolated from other programs running under X.

A program running on an X server, using the X11 protocol, can check which other windows are open.

There are several other security issues with X11. When configuring sshd, I've only ever seen recommendations for turning access through X off, never on. Wayland is supposed to be an improvement in this area.

Note that docker is about process isolation, but for other reasons than security. You get native speed, nice isolation and control over what's running in the container, but there are no guarantees that processes will be 100% contained, unlike for a proper sandbox (or something like running SELinux within a docker container).

Saying docker is defeated is a bit like kicking in an open door.

  • 1
    Thanks for the answer. I also updated the title to something more appropriate. – Dacav Mar 16 '15 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.