Running the Xserver in a container

[metux]

Hello folks,

anybody where who's running the Xserver within containers / jail / chroot ?
The testing ground has (limited) ability to do so, but it's just for pure testing purpose there.

I wonder whether it makes sense offering a container or chroot build (plus a bit of startup script) that can be deployed independent of individual distro.

What are your thoughts on that ?

[metux]

@callmetango

[callmetango]

@metux In general a very good idea! Especially for testing other architectures than amd64.

I made a small POC running some distribution provided Xorg Xserver with XFCE in QEMU and it worked very well with the modesetting driver on QEMU's standard VGA emulation and KVM acceleration. Only Chromium and Firefox completly crashed QEMU even when given loads of RAM. I think this could to be related to missing graphics acceleration like OpenGL/VirGL etc.

My next step is to bring in the "real thing" 😉 by compiling it and make it work too. I'll report back once I've done so.

Some additional goodies were to make the VMware driver work for basic acceleration and add some SPICE there too. Using network bridging it should even be possible to use the builtin network transparency feature to run xclock/xeyes/... or any other X program on the host and have it rendered on the guest's XLibre Xserver, shouldn't it?

[callmetango]

As promised, I have been working on containerizing a Linux distribution in qemu. There is a guide how to do this at XLiberating Alpine Linux · X11Libre · Discussion #290.

[metux]

cool :)

[Tautvydas411]

Tangential and a lot of extra effort: What about offering static build - everything in single executable ?

[metux]

Tangential and a lot of extra effort:

Already have most pieces in the testing ground. Yet missing is storing the final chroot tree as a OCI image.
Plus some startup script with a bit trickery (eg. bind-mount udev state dir, etc, grant device permissons, etc)

What about offering static build - everything in single executable ?

Not so easy for various reasons, eg. we'd first make sure that all of the dependencies can be built as static archives, and the driver loader still works (drivers are still external repos and have to be shared objects). And finally still depending on dynamically linked glibc (on most Linux'es at least).

[callmetango]

I just stumbled upon mviereck/x11docker: Run GUI applications and desktops in docker and podman containers. Focus on security. and according to the README this could be interesting in this context. Sure, they use the "wrong" 😉 X server but still...