How to run GUI applications directly in containers
1–10 of 40 posts
Re: How to run GUI applications directly in containers
#2> The source of the GUI application is untrusted, or its safety is uncertain.
Afaik Docker doesn't promise security
Re: How to run GUI applications directly in containers
#3> The source of the GUI application is untrusted, or its safety is uncertain. Afaik Docker doesn't promise security
This is correct.
I think it may add a bit of security, but containers are better thought of as mechanism to deploy and manage applications/services.
They can be useful as part of a security posture, but you kinda have to wrap everything up in SELinux or as part of some other system. Which is a lot easier to do with containers then it is to do with normal applications.
Also for most purposes:
If you want to integrate container applications into your desktop you'd be better off with something like Flatpak or distrobox/toolbx.
there are lots of things that these applications do to setup the environment and integrate into your home directory that isn't going to be done with simple scripts like this.
That doesn't mean that these scripts are useless, of course. I you want to run a application with more isolation and less integration then it is a lot easier to do it this way then with something like distrobox.
Like if you don't want to give a application access to your home directory. Or want to emulate a container environment for the cloud locally so you can hack on it.
Re: How to run GUI applications directly in containers
#4> The source of the GUI application is untrusted, or its safety is uncertain. Afaik Docker doesn't promise security
Even if it did, if you end up connecting your GPU, display manager, dbus, pipewire and a bunch of other devices to the untrusted application, you would kind of lose out on it anyways.
Only benefit I can see here is the separation of the filesystems, but there are easier and simpler ways than docker to do that.
Re: How to run GUI applications directly in containers
#5> The source of the GUI application is untrusted, or its safety is uncertain. Afaik Docker doesn't promise security
Not promising is not the same as offering none. I don't think any technology solution "promises" when it comes to security.
Re: How to run GUI applications directly in containers
#6I don't want to be negative but Flatpak is a container runtime specifically designed for GUI apps and Docker isn't.
Re: How to run GUI applications directly in containers
#7I don't want to be negative but Flatpak is a container runtime specifically designed for GUI apps and Docker isn't.
I think this depends on your use case. As a dev I would take dockerized gui applications over flatpak all day, as it allows me to quickly add additional packages and networking for example. The possibilities would be endless while all can reside in a small docker-compose stack right in the repository.
Re: How to run GUI applications directly in containers
#8I don't want to be negative but Flatpak is a container runtime specifically designed for GUI apps and Docker isn't.
I think this depends on your use case. As a dev I would take dockerized gui applications over flatpak all day, as it allows me to quickly add additional packages and networking for example. The possibilities would be endless while all can reside in a small docker-compose stack right in the repository.
You can always build your own flatpak image with whatever else you need. I think the only thing you're losing is the layered architecture of OSI images.
Re: How to run GUI applications directly in containers
#9I don't want to be negative but Flatpak is a container runtime specifically designed for GUI apps and Docker isn't.
This is a nicely written description of some of the things that flatpak does under the hood for people who know docker. Of course, flatpak does a lot more (e.g. filtered dbus access).
I personally think that flatpak is not the end of history and we should continue to experiment with different approaches.
Re: How to run GUI applications directly in containers
#10I've run an X app from Docker, a Linux container on a macOS host. I was able to move the incantations to a Makefile: https://github.com/ryanfb/docker_scantailor