Today, we expose the /tmp/.X11-unix socket to the container (ref) and allow root permission to the X server (ref) .
It doesn't look safe or correct. This issue addresses the effort to find a better solution. mviereck/x11docker sounds like a good reference.