Arch Linux

netpumber

Member

Registered: 2009-09-20

Posts: 134

Cannot pass the /tmp/X11-unix/X0 file into an LXC container

Hi everybody.

I've created an unprivileged container and I'm trying to run X11 applications within the containers using the host's X11 server.
So the idea is to pass the /tmp/.X11-unix directory to the container.

Just to note here that I'm using the linux-hardened and I'm running the containers using sudo command.  The containers are also running arch linux.

So first things first.

Here is the config file of the container along with the mappings, the mounts etc.

# Distribution configuration
lxc.include = /usr/share/lxc/config/common.conf
lxc.include = /usr/share/lxc/config/userns.conf
lxc.arch = x86_64

# Container specific configuration
lxc.idmap = u 0 100000 1000
lxc.idmap = u 1000 1000 1
lxc.idmap = u 1001 101001 64535
lxc.idmap = g 0 100000 1000
lxc.idmap = g 1000 1000 1
lxc.idmap = g 1001 101001 64535
#lxc.idmap = u 0 100000 65536
#lxc.idmap = g 0 100000 65536
#lxc.idmap = u 1000 1000 1
#lxc.idmap = g 1000 1000 1
#lxc.idmap = u 1001 101001 65536
#lxc.idmap = g 1001 101001 65536
lxc.mount.entry = /tmp/.X11-unix tmp/.X11-unix none bind,optional,create=dir,ro
lxc.environment = XAUTHORITY=/root/.Xauthority
lxc.environment = DISPLAY=:0
lxc.rootfs.path = dir:/var/lib/lxc/base-arch/rootfs
lxc.uts.name = base-arch

# Network configuration
lxc.net.0.type = veth
lxc.net.0.link = lxcbr0
lxc.net.0.flags = up
lxc.net.0.hwaddr = 00:16:3e:a4:40:79

Accordingly my /etc/sub{g,u}id files are filled with:

root:1000:1
root:100000:65536

So while the ls -la /tmp/.X11-unix command in the host returns the following:

srwxrwxrwx 0 myuser 10 Sep 21:51 X0

when I run the same in the attached container I got nothing:

total 0
drwxrwxrwt  2 root root  40 Sep 10 21:42 .
drwxrwxrwt 10 root root 200 Sep 10 21:42 ..

One suggestion that I read on the internet is that while the container is booting up clears all the /tmp directory. To test this assumption I edited the /usr/lib/tmpfiles.d/tmp.conf file and added

x /tmp/.X11-unix

But nothing changed. Could there be another mechanism in arch that wipes out the /tmp ?

Something else that I'm thinking of, is that there could be a problem because the host's /tmp/.X11-unix/X0 file belongs to my personal user and I'm running the container as root. Could this be the root cause?

Any other ideas on how to debug this situation would be very helpful.

Last edited by netpumber (2021-09-10 22:12:05)

Gregosky

Member

From: UK

Registered: 2013-07-26

Posts: 184

Re: Cannot pass the /tmp/X11-unix/X0 file into an LXC container

I have done something similar but with podman, here is example for running firefox in unprivileged container within podman which is using host X session https://github.com/grzegorzk/ff_in_podman