X11 forwarding from a docker container in remote server

Question

I want to ssh into my linux mint 18 server (running X11) and log into a docker container and have iPython matplotlib plots forwarded to the local client (also mint). All in the local network.

The closest question I found was: https://stackoverflow.com/questions/25281992/alternatives-to-ssh-x11-forwarding-for-docker-containers

Following this, I could get a plot GUI out from the docker to the local machine's display (e.i., the mint server) by -e DISPLAY=$DISPLAY option passed to the docker run command. I can also ssh with -X option to the server to get xeyes window to the client.

But if I ssh into the server with -X option and login to the container ran with -DISPLAY=localhost or client IP, I still cannot get a plot to the client machine.

I know I could use VNC to go around it. But, how can I do this with X11 forwarding properly?

Solution 1

You need to resolve these things for it to work:

1. That the X application can find the X server
   • For SSH there needs to be a tunnel ("ssh -X" and "X11Forwarding yes" in /etc/ssh/sshd_config)
   • The address must be in $DISPLAY (using -e). You must replace "localhost" with the actual IP address of the Docker host seen from the Docker container.
2. That the X application is authorised to talk to the X server
   • Propagate the xauth magic cookie into the Docker container
   • Open up any firewall ports from the Docker host to the Docker container for the X11 port
   • Make sure the SSH server is configured to accept X11 TCP connections on a remote IP.

See my question (and answer) here on StackOverflow for details of how it can be done: https://stackoverflow.com/questions/48235040/run-x11-application-in-a-docker-container-reliably-on-a-server-connected-via-ssh

Solution 2

To run a GUI app in a remote docker container, you do not need X11 forwarding from the server. You can make the X11 server listen on TCP:6000, and run the remote docker container with -e DISPLAY=$IP:0 , which the $IP is the ip address of computer that run X11 server.

I have got it work on an macbook with XQuarz to display a remote docker container on remote ubuntu:

• On macbook use socat to make the X11 server listen on TCP, follow Running GUI’s with Docker on Mac OS X.

• On remote ubuntu

docker run -it --rm -e DISPLAY=$macbook_ip:0 fr3nd/xeyes

Then the xeyes show on the macbook

Solution 3

The Python module dockerx is intended to solve this problem.

You can install it running:

python3 -m pip install dockerx --user

To run a container with X11 support:

$ python3 -m dockerx.run --image ubuntu --command 'sleep infinity'

To get a container terminal run:  docker exec -it b05bd722477e /bin/bash
To kill the container run:        docker kill b05bd722477e
To remove the container run:      docker rm b05bd722477e

$ docker exec -it b05bd722477e /bin/bash
root@b05bd722477e:/# apt update && apt install -y x11-apps
root@b05bd722477e:/# xclock

After this, you should see xclock displayed in your screen.

If you want CUDA support (requires the Docker NVIDIA Runtime to be installed in your system), launch the container using:

$ python3 -m dockerx.run --image nvidia/cuda:11.0-base --nvidia 1 --command 'sleep infinity'

dockerx requires that the SSH server running in the remote computer has the option X11UseLocalhost no set in /etc/ssh/sshd_config.

For more details, check the GitHub of the dockerx Python module.

Comments

[Stephen Kitt]

DISPLAY=$DISPLAY should work in the SSH case too (ssh -X sets the variable to the appropriate value, it’s not just an IP address). Have you tried that?