12

How can I run X apps inside an LXC container efficiently?

ssh -Y guest

is too slow - there is no graphics acceleration with ssh -Y - everything has to travel over the virtual network with the traditional X11 protocol.

Being able to copy-paste between host and guest apps is desirable but not essential. Running two X servers, one for the host and one for the guest, is (for my purposes) essential.

I can't run a native Xorg from within the guest because it complains about /dev/tty0 being missing, and I can't mknod that device in the guest because I get a permission denied, even when doing it as root.

Improve this question

2 Answers 2

Reset to default
12

You may want to try xpra or NX, VNC, etc Also take a look at VirtualGL if you want GL acceleration.

If you can share a directory with the host, you could then use mmap with xpra (specifying the path to the mmap file) which provides very significant performance improvements.

Improve this answer
1
  • Can someone share a secure example on how to use Xpra and Xephyr with LXC? Commented Feb 11, 2020 at 15:25
3

NOTE: This approach is a bit of a hack. It also does not support copy and paste between host and guest - and is totally insecure!

  1. Add /tmp as an additional filesystem in the guest configuration, which passes through to /tmp on the host.
  2. Ensure that your X server is not configured to accept network connections of any kind, because the next step disables X security.
  3. Type xhost + in a terminal window.
  4. Start the LXC guest
  5. Log in as your desired ordinary user inside the guest (i.e. not as root), and type

DISPLAY=:0 Xephyr :2 -screen 1024x768 -dpi 96 &

DISPLAY=:2 /etc/X11/xinit/Xsession

inside the guest (replacing both 2s with the number of the screen to use if you are using this to connect to multiple LXC VMs.) Adjust the resolution (-screen) and DPI (-dpi) parameters to suit.

What this does is sets up "proxy" connections to a Xephyr nested X server running in the guest (which use both UNIX domain sockets and the MIT-SHM extension) and another connection from Xephyr to your host X server (which uses UNIX domain sockets, but cannot, as far as I can determine, use MIT-SHM, due to the design of LXC). This seems to be the fastest configuration possible with an LXC guest, at least with the open source driver for my hardware (nvidia).

Improve this answer
1
  • Is there a secure way to use Xephyr with LXC? X11 isolation with Xephyr is supported by firejail so I guess we can do it properly with LXC too. Commented Feb 11, 2020 at 15:22

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.