Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to run GUI applications directly in containers

github.com

Post reply on HN
Print view View original

11–20 of 40 posts

Re: How to run GUI applications directly in containers

#11

Post by dylan-m »

wmf wrote: post #6

I don't want to be negative but Flatpak is a container runtime specifically designed for GUI apps and Docker isn't.

Another thing to look at is bubblewrap (https://github.com/containers/bubblewrap), which is what implements the sandboxing in Flatpak. It's handy if you want to run a command from your host in a particular sandbox as kind of a one-off, or if you just want to understand more about how that sandboxing works :)

Re: How to run GUI applications directly in containers

#13

Post by kccqzy »

razemio wrote: post #7
wmf wrote: post #6

I don't want to be negative but Flatpak is a container runtime specifically designed for GUI apps and Docker isn't.

I think this depends on your use case. As a dev I would take dockerized gui applications over flatpak all day, as it allows me to quickly add additional packages and networking for example. The possibilities would be endless while all can reside in a small docker-compose stack right in the repository.

Your perspective is understandable. When you say "as a dev" it sounds like you really want to be a docker dev but not a flatpak dev: you are used to writing docker files and docker-compose files but you are not interested in writing flatpak apps. That's okay because docker is focused on developers whereas flatpak is more user-centric.

Re: How to run GUI applications directly in containers

#14

Post by mmh0000 »

art0rz wrote: post #2

> The source of the GUI application is untrusted, or its safety is uncertain. Afaik Docker doesn't promise security

I'll agree that "Docker" has a history of "interesting" security practices.

But the core technologies underlying containers: Namespaces, cgroups, POSIX Capabilties, and SELinux. "Should" provide a level of isolation equivalent to a virtual machine[1].

If you're using a decent container platform like Podman, you should feel relatively good about the application's security and isolation.

[1] https://www.redhat.com/en/blog/how-selinux-separates-contain...

Re: How to run GUI applications directly in containers

#16

Post by dnndndej »

wmf wrote: post #6

I don't want to be negative but Flatpak is a container runtime specifically designed for GUI apps and Docker isn't.

But doesn't flatpack offer much deeper system Integration by default? Like being able to access the home directory by default and being able to talk to dbus?

To me flatpack looks like a way achieve application compatibility not security

Re: How to run GUI applications directly in containers

#17

Post by mg »

Is this solution different from just executing this:

    docker run -it --rm -e DISPLAY --net=host -v $XAUTHORITY:/root/.Xauthority -v /tmp/.X11-unix:/tmp/.X11-unix debian:12-slim
And then run the GUI app in the container? For example for Firefox:

    apt update
    apt install firefox-esr
    firefox
That is an approach I sometimes use to try GUI applications in a Docker container.

Re: How to run GUI applications directly in containers

#19

Post by dnndndej »

mg wrote: post #17

Is this solution different from just executing this: docker run -it --rm -e DISPLAY --net=host -v $XAUTHORITY:/root/.Xauthority -v /tmp/.X11-unix:/tmp/.X11-unix debian:12-slim And then run the GUI app in the container? For example for Firefox: apt update apt install firefox-esr firefox That is an approach I sometimes use to try GUI applications in a Docker container.

Isn't this working just for X11?
Post reply on HN