X11 Error When Run as a Docker Container

Question

I'm trying to run an application from a Docker container which is supposed to open a GUI widow (a video stream in my case). The Docker container is run on a Raspberry Pi and I SSH into the Pi from my Mac and then I issue the Docker run command. I have one problem here:

When I run the whole thing as follows, it works flawlessly:

I run the command as:

docker run -it --net=host --device=/dev/vcsm --device=/dev/vchiq -e DISPLAY -v /tmp/.X11-unix joesan/motion_detector bash

From the bash, that opens up after issuing the Docker run command, I install xauth

root@cctv:/raspi_motion_detection/project# apt-get install xauth

I then add the Xauth cookie using Xauth add and then I then run my Python program which shows the GUI window with the video stream!

So far so good. But, every time I don't want to be doing these steps all over again. So I wrote a small script to do this as below:

HOST=cctv

DISPLAY_NUMBER=$(echo $DISPLAY | cut -d. -f1 | cut -d: -f2)
echo $DISPLAY_NUMBER

# Extract auth cookie
AUTH_COOKIE=$(xauth list | grep "^$(hostname)/unix:${DISPLAY_NUMBER} " | awk '{print $3}')

# Add the xauth cookie to xauth
xauth add ${HOST}/unix:${DISPLAY_NUMBER} MIT-MAGIC-COOKIE-1 ${AUTH_COOKIE}

# Launch the container  
docker run -it --net=host --device=/dev/vcsm --device=/dev/vchiq -e DISPLAY -v /tmp/.X11-unix  joesan/motion_detector`

But this time it fails with the error:

X11 connection rejected because of wrong authentication.
Unable to init server: Could not connect: Connection refused

I then tried to run the above script as a sudo user and I get the following:

xauth:  file /root/.Xauthority does not exist
xauth: (argv):1:  bad "add" command line
X11 connection rejected because of wrong authentication.
Unable to init server: Could not connect: Connection refused

Is there anything that I'm missing?

Solution 1

The apt-get install xauth command should only be required once, and so you can include it in your Dockerfile so that it gets executed when you build your image.

RUN apt-get install xauth

For the xauth add command, you seem to be depending upon the DISPLAY variable, which is passed on to the container on startup. In this case, it would be better to create a shell script which does all of the initialization that you need at startup, and then launches your Python program. For example:

#!/bin/bash

HOST=cctv
DISPLAY_NUMBER=$(echo $DISPLAY | cut -d. -f1 | cut -d: -f2)
AUTH_COOKIE=$(xauth list | grep "^$(hostname)/unix:${DISPLAY_NUMBER} " | awk '{print $3}')
xauth add ${HOST}/unix:${DISPLAY_NUMBER} MIT-MAGIC-COOKIE-1 ${AUTH_COOKIE}
python /path/to/program.py

Then, you can copy over this script during the build phase and set it as your command or entrypoint.

COPY init-script.bash /opt/program
CMD ["/bin/bash","/opt/program/init-script.bash"]

Solution 2

I solved this issue by using this command on the host before running the container:

xhost +

After that, I was able to run my container with:

sudo docker run -it --device=/dev/video0:/dev/video0 -e DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix test1

I didn't install xauth inside the container.

Comments

[Haxiel]

The sequence seems mixed up between the two approaches. When you run the docker -it .. command, it launches the container, creates a bash shell inside the container, and places you there. I guess you execute the apt-get install and xauth commands inside the container. In the shell script, you seem to be running the xauth commands on the host, not inside the container.

[joesan]

How do I fix this? I mean how can I get the same effect of running xauth commands from inside the container? Should I do apt-get install xauth inside the container by writing it as a RUN command in my Docker file?

[joesan]

Is there any help?

[joesan]

I almost ended up having a similar set up. I will test it and let you know if that worked!

[joesan]

Ok! So now I get this error: xauth: unable to link authority file /root/.Xauthority, use /root/.Xauthority-n

[Haxiel]

@sparkr : Sorry, I'm not too familiar with xauth itself. It has a -v flag for verbose output, so maybe you can use that to get more information?

[icarus]

Note that turning off security is not something that should be done for machines which might be subject to attacks, i.e. anything connected to the Internet.

[Romain]

Thank you for this comment. I looked for a more secure way to allow the docker container to access to the display and I found this : computerhope.com/unix/xhost.htm stackoverflow.com/questions/43015536/… So I replaced xhost + by xhost +local:root and it works (you can do xhost - if you previously allow access to everyone with xhost +) Is it safe enough ?

[icarus]

Everything is a tradeoff. I would put the extra time in to have authorization enabled rather than not. If only you log into the machine then the restricted xhost plus is probably good enough.