I'm trying to run a docker container (for security reasons) from which I want to see a GUI application.

I'm between two options at the moment, I'm not sure if I should forward its traffic to my X server (1) or run an X server inside of the container and then connect to it (2).

My current solution is (1), however I'm concerned about security. Assuming the container is authenticated in my host machine's server could it, for e.g:

  • grab my mouse and keyboard input when interacting with other applications
  • could it query for information regarding other windows? or know their state at all?

EDIT: If any of the above were to be true, would (2) solve it?


Yes, all the X11 clients have full access to the all the windows and every other resource on the display.

Not only can they grab the keyboard and mouse, get the full content of the windows and pixmaps (or deface them ;-)), but they can also fake keyboard and mouse input via the XTEST extension.

The design of the X11 protocol is purely cooperative and assuming well-behaved clients -- any badly written X11 application can create absolute havoc, and many of them do (java apps steal the focus uninvited, firefox pops itself on top when updating a page, etc).

run an X server inside of the container and then connect to it (2).

Run Xvfb inside the container -- which is an X11 server with no access to hardware. Or if you want to interact with your gui program, a nested X11 server like Xephyr [1]. Notice that unless you pass it an -auth argument, an X11 server will allow any local client to connect to it.

  • I haven't thought about (2) extensively. I've managed to run it headlessly with Xvfb. How would you approach connecting it to the host machine's X server? – asantos Nov 3 '19 at 22:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.