`DISPLAY=:1 firefox` within a LXC to a vncserver [kinda-solved]

graysky · 2015-04-21 21:05:58

Setup: On my host machine, I have a vncserver running in on port 5901. I also have a linux container running.
Goal: Run a command in a linux container and have it display a GUI program in the vncserver.

What works:
* From the host, open a terminal and run `DISPLAY=:1 firefox` and a firefox loads inside the vncserver.
* From the container (ssh or lxc-attach), run `DISPLAY=:0 firefox` and a firefox from the container loads inside my Xsession on the physical display.

What doesn't work:
* From the container (ssh or lxc-attach), run `DISPLAY=:1 firefox` which ends in this error:

No protocol specified
Error: cannot open display: :1

Now, it DOES work with this insecure hack so I know nothing is setup incorrectly in the container or the vncserver:
1) In the vncserver, run `xhost +`
2) From the container (ssh or lxc-attach), run `DISPLAY=:1 firefox` and a firefox from the container loads inside my vncserver.

So what am I doing incorrectly?

Last edited by graysky (2015-04-24 19:16:49)

graysky · 2015-04-22 23:58:03

I thought my use case was a bit obscure...

R00KIE · 2015-04-23 08:56:45

If it works after you do 'xhost +' in the vncserver then that points to an authentication issue. Something less insecure would be 'xhost +local' or you could try 'xhost +si:hostname:lxc_hostname' where lxc_hostname is the hostname configured inside the container (not sure if this will work though; I have zero experience with lxc so I don't know if this applies). There is also the option of restricting by username but that should be a local username I suppose, xhost's man page is a bit terse on this.

I suspect you are going to be pulling your hair trying to sort this out the way you want but it should be possible, get yourself enough cookies and coffee and dive into the man pages. Some googling and lots of trial and error will be needed.

graysky · 2015-04-23 18:55:38

I agree that it is something within the authentication since opening up via xhosts works as-is. I have spent 2+ h in google hits but nothing I found seems to work here. From what I know from the man pages, all I *should* need to do is add the proper entry to ~/.Xauthority within the container. That doesn't work. Further, if I remove that file entirely from within the container, I can still send programs to DISPLAY=:0 just fine. It's as if something in the vncserver is not accepting the connection that the local machine is accepting.

moetunes · 2015-04-23 19:56:46

Have a look at /etc/X11/xinit/xserverrc and see if it has
-nolisten tcp

graysky · 2015-04-23 20:26:45

@moetunes - On this host:

% grep tcp /etc/X11/xinit/xserverrc 
exec /usr/bin/X -nolisten tcp "$@"

In the container:

% grep tcp /etc/X11/xinit/xserverrc
exec /usr/bin/X -nolisten tcp "$@"

R00KIE · 2015-04-24 13:34:47

It seems that somehow a vncserver is not exactly the same as a real X server. I was testing something similar to what you were trying and I see somewhat the same thing.

my user -> vnc: works no authentication problems (vnc server running under my user account)
test user -> my user: works but I need to use either 'xhost +local:' or 'xhost +si:localuser:test'
test user -> vnc: does not work unless 'xhost +' or 'xhost +local:' is used

I'd say that the least of two evils is using 'xhost +local:' although this will allow any user on the local machine to connect to the vncserver.

graysky · 2015-04-24 19:16:04

I agree with you, Rookie. Thanks for testing as well. Perhaps the 'xhost +local:' can be added to ~/.vnc/xstartup to make it automatic. I think that coupled with the '-localhost' flag in the vncserver init script should make it as good as it can be.

smudge · 2015-04-25 21:31:21

I've not played around with containers or vncserver so this maybe completely irrelevant but it popped into my head reading this thread.

https://wiki.archlinux.org/index.php/Xo … su.22_fail

Maybe you need to enable pam_xauth.so in one of the /etc/pam.d/ conf files.

moetunes · 2015-04-25 23:52:33

graysky wrote:

@moetunes - On this host:

% grep tcp /etc/X11/xinit/xserverrc 
exec /usr/bin/X -nolisten tcp "$@"

In the container:

% grep tcp /etc/X11/xinit/xserverrc
exec /usr/bin/X -nolisten tcp "$@"

I had to remove the -nolisten tcp to run X apps on a different host when I last tried

graysky · 2015-04-26 10:14:36

I tired commenting it out but upon restart the vncserver, no change... the vncserver doesn't actually use /usr/bin/X though.

Last edited by graysky (2015-04-26 10:16:01)

R00KIE · 2015-04-26 11:00:51

I guess the best qualified persons to give a definitive answer would be tigervnc upstream, as this isn't a common use case I suppose. It might work like it does for security reasons, imagine a shared machine where everyone could get easy access to everyone else's vnc display, not a nice prospect.

On the other hand giving access to a specific user should work like it does for "normal" X. I've been running skype in its own user account and I give access to my display only to that user account (with 'xhost +si:localuser:skype') and it works just fine, but apparently vncserver does not like that.

graysky · 2015-04-26 13:27:29

I have opened a thread in their discussion group but haven't gotten an answer.

Arch Linux

#1 2015-04-21 21:05:58

`DISPLAY=:1 firefox` within a LXC to a vncserver [kinda-solved]

#2 2015-04-22 23:58:03

Re: `DISPLAY=:1 firefox` within a LXC to a vncserver [kinda-solved]

#3 2015-04-23 08:56:45

Re: `DISPLAY=:1 firefox` within a LXC to a vncserver [kinda-solved]

#4 2015-04-23 18:55:38

Re: `DISPLAY=:1 firefox` within a LXC to a vncserver [kinda-solved]

#5 2015-04-23 19:56:46

Re: `DISPLAY=:1 firefox` within a LXC to a vncserver [kinda-solved]

#6 2015-04-23 20:26:45

Re: `DISPLAY=:1 firefox` within a LXC to a vncserver [kinda-solved]

#7 2015-04-24 13:34:47

Re: `DISPLAY=:1 firefox` within a LXC to a vncserver [kinda-solved]

#8 2015-04-24 19:16:04

Re: `DISPLAY=:1 firefox` within a LXC to a vncserver [kinda-solved]

#9 2015-04-25 21:31:21

Re: `DISPLAY=:1 firefox` within a LXC to a vncserver [kinda-solved]

#10 2015-04-25 23:52:33

Re: `DISPLAY=:1 firefox` within a LXC to a vncserver [kinda-solved]

#11 2015-04-26 10:14:36

Re: `DISPLAY=:1 firefox` within a LXC to a vncserver [kinda-solved]

#12 2015-04-26 11:00:51

Re: `DISPLAY=:1 firefox` within a LXC to a vncserver [kinda-solved]

#13 2015-04-26 13:27:29

Re: `DISPLAY=:1 firefox` within a LXC to a vncserver [kinda-solved]

Board footer