x11docker

Curious that there's no comparison to https://github.com/mviereck/x11docker , which I would describe as the incumbent in this space.

I don't know anything about Xwayland, but there's this sentence in this socat writeup: > If you want to access an X server that does not provide -listen tcp (Xwayland) or just did not have enabled it during startup (like most likely your host Xorg), you can use socat to provide TCP/IP access. https://github.com/mviereck/x11docker/wiki/How-to-access-X-o... This makes me think that socat is exactly what you need to make it work with Xwayland?

I was just looking into various approaches to use process isolation for security on the desktop in Linux. Containers within VMs are a norm for security in cloud-native [1]. Some lessons there could be applied to desktop. One option is the approach of Spectrum OS [2]. They use crosvm (same as what Firecracker "micro VMs" uses) and virtio_wl [3][4]. Another approach might be x11docker [5] with Kata Containers [6]. Curiously, the work for WSLg (WSL with graphics) [7][8] to support graphical Linux guest VMs could also be applied on a Linux host. 1: https://archive.fosdem.org/2020/schedule/event/kernel_address_space_isolation/atta… 2: https://spectrum-os.org/ 3: https://spectrum-os.org/design.html 4: ht

The wiki of x11docker describes some short setups without x11docker, too: https://github.com/mviereck/x11docker/wiki/Short-setups-to-p...

I've been looking for something like this. So far I've looked into x11docker (https://github.com/mviereck/x11docker) and dx11 (https://gitlab.com/brickpop/dx11-nim#dx11) but dx11 looks unmaintained and the whole solution feels incomplete. Yes, I know it's not LXD, but I was willing to accept docker as an alternative. The solution I'm currently checking is ContainerBox (https://github.com/AlexandreDey/ContainerBox). I'm building a container for KDE and I'll get back with results. My main goals is not to achieve the same security like QubesOS, but to have multiple isolated environments within the same window manager (something like KDE Activities but for separate users).

This seems really interesting. A somewhat related project is x11docker[0] which attempts to make it easier to run gui applications through docker. It works pretty well with docker, though I've not used it since I switched to podman as there wasn't any support for it at the time. I've not tried recently. It does seem this project is at a dead end based on the recent development activity in recent months. [0] https://github.com/mviereck/x11docker/

jessfraz has a great collection of Dockerfiles for various applications: https://github.com/jessfraz/dockerfiles x11docker provides tooling: https://github.com/mviereck/x11docker

Firejail is probably what you want. I'd be wary of considering Docker as a jail - it does some isolation, but I've yet to see any serious effort or analysis of "safely run arbitrary code as root in docker and avoid escape" (the scenario being at least a full compromise of the app, with potentially an elevation to root in the container). Docker is "(shipping) container first" not "(CIA black site) container first". Firejail isn't perfect - but it's at least designed to be a jail/sandbox. There's also the possibility to use lxc via lxd - if you're running xorg you can forward x11 over ssh to the container (or vm). However access to xorg is problematic (eg shared clipboard, window/screen access). Wayland supposedly does "everything x does" - but I don't know how you connect displays via the network. But in the end (even though you requested

I use x11docker to run a recent firefox on Guix for now. https://github.com/mviereck/x11docker