Run graphical application in container

Run graphical application in container

[Pierre Neidhardt]

[-- Attachment #1: Type: text/plain, Size: 536 bytes --]

Hi,

I think this was mentioned before on the mailing list but I cannot find
it back.  The following won't work:

--8<---------------cut here---------------start------------->8---
$ guix environment -C -N --ad-hoc epiphany -- epiphany
Unable to init server: Could not connect: Connection refused
Failed to parse arguments: Cannot open display: 
--8<---------------cut here---------------end--------------->8---

Is it possible to start a graphical application in a container?

-- 
Pierre Neidhardt
https://ambrevar.xyz/

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: Run graphical application in container

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 1281 bytes --]

On Tue, Oct 16, 2018 at 04:22:43PM +0200, Pierre Neidhardt wrote:
> I think this was mentioned before on the mailing list but I cannot find
> it back.

I think the first discussion was here, regarding IceCat:

https://lists.gnu.org/archive/html/guix-devel/2016-07/msg00120.html

And a more recent discussion is here:

https://lists.gnu.org/archive/html/help-guix/2018-01/msg00056.html

> The following won't work:
> 
> --8<---------------cut here---------------start------------->8---
> $ guix environment -C -N --ad-hoc epiphany -- epiphany
> Unable to init server: Could not connect: Connection refused
> Failed to parse arguments: Cannot open display: 
> --8<---------------cut here---------------end--------------->8---
>
> Is it possible to start a graphical application in a container?

I think you'll need to share the host system's X socket, like
'--share=/tmp/.X11-unix' or '--share=/tmp/serverauth.$RANDOM' and then
`export DISPLAY=":0.0"` in the container. $RANDOM is a random string to
make the filename unpredictable.

So, it's definitely possible. In my experience, the hard part is finding
the myriad directories used by the software and sharing or exposing them
to the container. This is shown in the second discussion I linked above.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Run graphical application in container

[Pierre Neidhardt]

[-- Attachment #1: Type: text/plain, Size: 218 bytes --]

Yes, that was it, thanks a lot!

Is anyone interested in finishing the work that was sketched in
https://lists.gnu.org/archive/html/help-guix/2018-01/msg00056.html ?

-- 
Pierre Neidhardt
https://ambrevar.xyz/

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: Run graphical application in container

[Ludovic Courtès]

Hello Pierre,

Pierre Neidhardt <mail@ambrevar.xyz> skribis:

> Is anyone interested in finishing the work that was sketched in
> https://lists.gnu.org/archive/html/help-guix/2018-01/msg00056.html ?

Mike submitted several improvements to ‘guix environment’, all of which
but one were applied:

  https://issues.guix.info/issue/30256#8

As for ‘guix run’ and/or package transformation options to automatically
wrap binaries, I’m all for it!

Thanks,
Ludo’.

Re: Run graphical application in container

[Christopher Lemmer Webber]

Ludovic Courtès writes:

> Hello Pierre,
>
> Pierre Neidhardt <mail@ambrevar.xyz> skribis:
>
>> Is anyone interested in finishing the work that was sketched in
>> https://lists.gnu.org/archive/html/help-guix/2018-01/msg00056.html ?
>
> Mike submitted several improvements to ‘guix environment’, all of which
> but one were applied:
>
>   https://issues.guix.info/issue/30256#8
>
> As for ‘guix run’ and/or package transformation options to automatically
> wrap binaries, I’m all for it!
>
> Thanks,
> Ludo’.

... looking this up I see that the idea I submitted to guix-devel is
already "approved of", but just needs to be done. :)

Re: Run graphical application in container

[Christopher Lemmer Webber]

Leo Famulari writes:

> On Tue, Oct 16, 2018 at 04:22:43PM +0200, Pierre Neidhardt wrote:
>> I think this was mentioned before on the mailing list but I cannot find
>> it back.
>
> I think the first discussion was here, regarding IceCat:
>
> https://lists.gnu.org/archive/html/guix-devel/2016-07/msg00120.html
>
> And a more recent discussion is here:
>
> https://lists.gnu.org/archive/html/help-guix/2018-01/msg00056.html
>
>> The following won't work:
>> 
>> --8<---------------cut here---------------start------------->8---
>> $ guix environment -C -N --ad-hoc epiphany -- epiphany
>> Unable to init server: Could not connect: Connection refused
>> Failed to parse arguments: Cannot open display: 
>> --8<---------------cut here---------------end--------------->8---
>>
>> Is it possible to start a graphical application in a container?
>
> I think you'll need to share the host system's X socket, like
> '--share=/tmp/.X11-unix' or '--share=/tmp/serverauth.$RANDOM' and then
> `export DISPLAY=":0.0"` in the container. $RANDOM is a random string to
> make the filename unpredictable.
>
> So, it's definitely possible. In my experience, the hard part is finding
> the myriad directories used by the software and sharing or exposing them
> to the container. This is shown in the second discussion I linked above.

Yikes.  I gave this a try today.  I was trying to do the eolie container
example from the manual.  I couldn't figure it out.

  guix environment \
    --verbosity=2 --preserve='^DISPLAY$' --container --network \
    --expose=/etc/machine-id \
    --expose=/etc/ssl/certs/ \
    --share=$HOME/.local/share/eolie/=$HOME/.local/share/eolie/ \
    --share=/tmp/.X11-unix/=/tmp/.X11-unix/ \
    --share=$HOME/.Xauthority=$HOME/.Xauthority \
    --ad-hoc eolie nss-certs dbus -- eolie

Do we generally lack a reproducible way to be able to link in whatever
xauthority foo?

Docker and flatpack and etc must have already figured this out, right?
(Or maybe things are easier in wayland?  I'm skeptical though...)

(Of course, this does mean that any application that can run X can
escape the container, but I guess that was already the case.  Really
looking forward to a day when we have sane, ocap security as our
security foundation instead of this nonsense...)

Re: Run graphical application in container

[Pierre Neidhardt]

[-- Attachment #1: Type: text/plain, Size: 927 bytes --]

For me, Eolie now fails with

--8<---------------cut here---------------start------------->8---
(org.gnome.Eolie:1): GLib-GIO-ERROR **: 20:53:32.105: Settings schema 'org.gnome.settings-daemon.plugins.color' is not installed
--8<---------------cut here---------------end--------------->8---

This was not the case a few weeks ago when I published the eolie example
in the manual, so I guess this issue was introduced with a recent update.

Installing gnome-settings-daemon to the default profile works when
running eolie outside a container.

About your question:

> Do we generally lack a reproducible way to be able to link in whatever
> xauthority foo?
>
> Docker and flatpack and etc must have already figured this out, right?
> (Or maybe things are easier in wayland?  I'm skeptical though...)

I think not, it's just our Eolie package that's broken :)

-- 
Pierre Neidhardt
https://ambrevar.xyz/

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: Run graphical application in container

[zimoun]

Hi,

On Wed, 01 Jul 2020 at 22:57, Pierre Neidhardt <mail@ambrevar.xyz> wrote:

> For me, Eolie now fails with
>
> --8<---------------cut here---------------start------------->8---
> (org.gnome.Eolie:1): GLib-GIO-ERROR **: 20:53:32.105: Settings schema 'org.gnome.settings-daemon.plugins.color' is not installed
> --8<---------------cut here---------------end--------------->8---
>
> This was not the case a few weeks ago when I published the eolie example
> in the manual, so I guess this issue was introduced with a recent
> update.

I remember it was working because initially we discussed that for
testing s/Next/Nyxt. :-)

However, even with the time-machine, it does not work.  Hum!

--8<---------------cut here---------------start------------->8---
guix time-machime --commit=caf90167fb7e9fe4cefe7b2dd7609b04b128b11f
       -- environment --preserve='^DISPLAY$' --container --network \
       --expose=/etc/machine-id \
       --expose=/etc/ssl/certs/ \
       --share=$HOME/.local/share/eolie/=$HOME/.local/share/eolie/ \
       --ad-hoc eolie nss-certs dbus --  eolie
Updating channel 'guix' from Git repository at 'https://git.savannah.gnu.org/git/guix.git'...

[...]

(org.gnome.Eolie:1): GLib-GIO-ERROR **: 21:45:34.281: Settings schema 'org.gnome.settings-daemon.plugins.color' is not installed
--8<---------------cut here---------------end--------------->8---

What do I miss?

Cheers,
simon