Fast X for LXC guest on localhost?

Question

How can I run X apps inside an LXC container efficiently?

ssh -Y guest

is too slow - there is no graphics acceleration with ssh -Y - everything has to travel over the virtual network with the traditional X11 protocol.

Being able to copy-paste between host and guest apps is desirable but not essential. Running two X servers, one for the host and one for the guest, is (for my purposes) essential.

I can't run a native Xorg from within the guest because it complains about /dev/tty0 being missing, and I can't mknod that device in the guest because I get a permission denied, even when doing it as root.

Solution 1

You may want to try xpra or NX, VNC, etc Also take a look at VirtualGL if you want GL acceleration.

If you can share a directory with the host, you could then use mmap with xpra (specifying the path to the mmap file) which provides very significant performance improvements.

Solution 2

NOTE: This approach is a bit of a hack. It also does not support copy and paste between host and guest - and is totally insecure!

1. Add /tmp as an additional filesystem in the guest configuration, which passes through to /tmp on the host.
2. Ensure that your X server is not configured to accept network connections of any kind, because the next step disables X security.
3. Type xhost + in a terminal window.
4. Start the LXC guest
5. Log in as your desired ordinary user inside the guest (i.e. not as root), and type

DISPLAY=:0 Xephyr :2 -screen 1024x768 -dpi 96 &

DISPLAY=:2 /etc/X11/xinit/Xsession

inside the guest (replacing both 2s with the number of the screen to use if you are using this to connect to multiple LXC VMs.) Adjust the resolution (-screen) and DPI (-dpi) parameters to suit.

What this does is sets up "proxy" connections to a Xephyr nested X server running in the guest (which use both UNIX domain sockets and the MIT-SHM extension) and another connection from Xephyr to your host X server (which uses UNIX domain sockets, but cannot, as far as I can determine, use MIT-SHM, due to the design of LXC). This seems to be the fastest configuration possible with an LXC guest, at least with the open source driver for my hardware (nvidia).

Comments

[baptx]

Is there a secure way to use Xephyr with LXC? X11 isolation with Xephyr is supported by firejail so I guess we can do it properly with LXC too.

[baptx]

Can someone share a secure example on how to use Xpra and Xephyr with LXC?