Answers: <p>You can't run a program running on x11 without a x11 buffer somewhere, be it vnc, xvfb or whatever. You will always need x11 libraries on the system running the program or it couldn't work at all. That's akin to  trying to run a C program without libc on the system. </p>
  
  <p>Using system libraries from a different container with a volume is a bad idea, as it create a hard dependency on both containers using the same libraries, and is likely to crash somewhere when both systems try to acquire a lock on the library to load it.</p>
  
  <p>I assume with a lot of tweaks it should be doable, but the added complexity is a real <a href="https://www.urbandictionary.com/define.php?term=footgun" rel="nofollow noreferrer">footgun</a> and create more dependencies than should exist.</p>
  
Answers: CC BY-SA 4.0
Answers: 2018-11-05T13:29:39.087Z
Answers: Thank you. That is a reasonable explanation. So I guess what I am looking for then is the ability to build one image with gedit and x11 libraries (as I have done for an example). Then build a second image containing VNC, etc. Then share x11 socket shared between the two resulting containers. What I really want is the ability for privileged users to execute a script on their dev system, that actually spins up a containerized application on the server but passes the graphics on to their system.
Answers: dnk8n
Answers: CC BY-SA 4.0
Answers: 2018-11-05T13:47:12.337Z
Answers: you should be able to do this with a `docker-compose` topology, where the dependencies between the applications are clear. See the Docker documentation for [`depends_on`](https://docs.docker.com/compose/compose-file/#depends_on)
Answers: Bruce Becker
Answers: CC BY-SA 4.0
Answers: 2018-11-05T15:29:09.213Z
Answers: @DeanKayton X11 forwarding through ssh is made for that, I'd go with a user x11 server (like xming on windows for exemple) and launching the app against this display port, indeed you'll have to share it with the host.
Answers: Tensibai
Answers: CC BY-SA 4.0
Answers: 2018-11-05T15:33:18.973Z
Answers: @BruceBecker I'm more worried by the lock status of the lib files than the share itself, it may work but I'd advise against trying anyway :)
Answers: Tensibai
Answers: CC BY-SA 4.0
Answers: 2018-11-07T07:54:49.813Z
Answers: Personally I didn't need a dockerized ssh daemon because the host already had all of that configured. It is an interesting idea to have a fully dockerized solution on a server without even ssh activated, but that is actually beyond what I really needed. I have seen a few examples of how it can be done, but in all of them there is one huge container with 10+ processes running in one container. I am curious about a multi-container approach based off many light images. I have accepted this answer because it proposes a possible solution but advises not to go down that road, very thankful for that!
Answers: dnk8n
Answers: CC BY-SA 4.0
Answers: 2018-11-05T10:32:59.480Z
Answers: 2018-11-05T13:28:03.023Z
Answers: 2018-11-05T13:28:03.023Z
Answers: Tensibai
Body: <p>In this <strong>first section</strong> I detail some of the terms I have used:</p>
  
  <p><strong>Dockerized graphical applications</strong>: A Docker container run from a Docker image which runs an application which (traditionally) uses x11 (or similar) to display the application on the host machine. More details in second section.</p>
  
  <p><strong>packages required for display remotely on clients</strong>: For example, a VNC server which allows a user of a local client (e.g. a laptop with desktop Ubuntu 18.04 installed) to navigate through the browser to an particular host-name and port.</p>
  
  <hr>
  
  <hr>
  
  <p>In this <strong>second section</strong> I give an example of the usual way to run a Dockerized application, using gedit as an example: </p>
  
  <p>Example Dockerfile:</p>
  
  <pre><code>FROM ubuntu:18.04
  RUN apt-get update &amp;&amp; apt-get install -y gedit
  CMD gedit
  </code></pre>
  
  <p>Example Docker build command:</p>
  
  <pre><code>docker build -t gedit:latest .
  </code></pre>
  
  <p>Example Docker run command:</p>
  
  <p>Once-off (can potentially be a harmful command, use with caution):</p>
  
  <pre><code>xhost +local:docker
  </code></pre>
  
  <p>Subsequently:</p>
  
  <pre><code>docker run --rm --name=gedit -e DISPLAY=$DISPLAY -v /tmp/.X11-unix/:/tmp/.X11-unix gedit:latest
  </code></pre>
  
  <p>Please note: There are some security concerns running <code>xhost +local:docker</code> so to reverse this run <code>xhost -local:docker</code></p>
  
  <p>Sub-question / curiosity: The above installs x11, etc into the image. Is there any way to have a separate image with all of those dependencies and have multiple containers share folders in order to satisfy the x11 dependencies?</p>
  
  <hr>
  
  <hr>
  
  <p>In this <strong>third section</strong> I detail an example in which my question is relevant:</p>
  
  <p>I want to keep the Dockerized app as explained in section 2, which runs well locally on a client's laptop but have it as part of a cluster of docker containers (using docker-compose for example) so that the image built from the dockerfile in section 2 is unmodified.</p>
  
  <p>I want to include an additional container which has all the VNC and x11 packages required so that the client can run the application remotely. </p>
  
  <p><strong>Which mechanisms allow the above to take place?</strong></p>
  
Tags: <docker>
Title: How to run Dockerized graphical applications on a headless server with packages required for display remotely on clients as part of a separate image?
UserDisplayName: dnk8n
ThreadText: # How to run Dockerized graphical applications on a headless server with packages required for display remotely on clients as part of a separate image?
  
  (Asked by: username_0 on 2018-11-05)
  
  In this **first section** I detail some of the terms I have used:
  
  **Dockerized graphical applications**: A Docker container run from a Docker image which runs an application which (traditionally) uses x11 (or similar) to display the application on the host machine. More details in second section.
  
  **packages required for display remotely on clients**: For example, a VNC server which allows a user of a local client (e.g. a laptop with desktop Ubuntu 18.04 installed) to navigate through the browser to an particular host-name and port.
  
  ---
  
  ---
  
  In this **second section** I give an example of the usual way to run a Dockerized application, using gedit as an example:
  
  Example Dockerfile:
  
  ```
  FROM ubuntu:18.04
  RUN apt-get update && apt-get install -y gedit
  CMD gedit
  
  ```
  
  Example Docker build command:
  
  ```
  docker build -t gedit:latest .
  
  ```
  
  Example Docker run command:
  
  Once-off (can potentially be a harmful command, use with caution):
  
  ```
  xhost +local:docker
  
  ```
  
  Subsequently:
  
  ```
  docker run --rm --name=gedit -e DISPLAY=$DISPLAY -v /tmp/.X11-unix/:/tmp/.X11-unix gedit:latest
  
  ```
  
  Please note: There are some security concerns running `xhost +local:docker` so to reverse this run `xhost -local:docker`
  
  Sub-question / curiosity: The above installs x11, etc into the image. Is there any way to have a separate image with all of those dependencies and have multiple containers share folders in order to satisfy the x11 dependencies?
  
  ---
  
  ---
  
  In this **third section** I detail an example in which my question is relevant:
  
  I want to keep the Dockerized app as explained in section 2, which runs well locally on a client's laptop but have it as part of a cluster of docker containers (using docker-compose for example) so that the image built from the dockerfile in section 2 is unmodified.
  
  I want to include an additional container which has all the VNC and x11 packages required so that the client can run the application remotely.
  
  **Which mechanisms allow the above to take place?**
  
  **Tags:** docker
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2018-11-05. Score: 2 | Accepted answer
  
  You can't run a program running on x11 without a x11 buffer somewhere, be it vnc, xvfb or whatever. You will always need x11 libraries on the system running the program or it couldn't work at all. That's akin to trying to run a C program without libc on the system.
  
  Using system libraries from a different container with a volume is a bad idea, as it create a hard dependency on both containers using the same libraries, and is likely to crash somewhere when both systems try to acquire a lock on the library to load it.
  
  I assume with a lot of tweaks it should be doable, but the added complexity is a real [footgun](https://www.urbandictionary.com/define.php?term=footgun) and create more dependencies than should exist.
  
  > **Comments:**
  > **username_0**: Thank you. That is a reasonable explanation. So I guess what I am looking for then is the ability to build one image with gedit and x11 libraries (as I have done for an example). Then build a second image containing VNC, etc. Then share x11 socket shared between the two resulting containers. What I really want is the ability for privileged users to execute a script on their dev system, that actually spins up a containerized application on the server but passes the graphics on to their system.  
  > **username_2**: you should be able to do this with a `docker-compose` topology, where the dependencies between the applications are clear. See the Docker documentation for [`depends_on`](https://docs.docker.com/compose/compose-file/#depends_on)  
  > **username_1**: @DeanKayton X11 forwarding through ssh is made for that, I'd go with a user x11 server (like xming on windows for exemple) and launching the app against this display port, indeed you'll have to share it with the host.  
  > **username_1**: @username_2 I'm more worried by the lock status of the lib files than the share itself, it may work but I'd advise against trying anyway :)  
  > **username_0**: Personally I didn't need a dockerized ssh daemon because the host already had all of that configured. It is an interesting idea to have a fully dockerized solution on a server without even ssh activated, but that is actually beyond what I really needed. I have seen a few examples of how it can be done, but in all of them there is one huge container with 10+ processes running in one container. I am curious about a multi-container approach based off many light images. I have accepted this answer because it proposes a possible solution but advises not to go down that road, very thankful for that!  
  
  ---
  
  