[GH-ISSUE #1029] giving lxc a restricted x server or wayland session? #700

New issue

Closed

opened 2026-05-05 06:28:32 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 06:28:32 -06:00

Owner

Originally created by @xahare on GitHub (Jan 8, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1029

is there an easy way to give an unprivileged lxc a restricted x server or wayland session?

Originally created by @xahare on GitHub (Jan 8, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1029 is there an easy way to give an unprivileged lxc a restricted x server or wayland session?

gitea-mirror

2026-05-05 06:28:32 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 06:28:37 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 9, 2017):

Although I didn't try wayland or an unprivileged firejail, it should be possible. X11 is just a UNIX socket, nothing in seccomp and namespaces should prevent it. The technology is definitely there, maybe there are some obscure details to be hammered out.

Unprivileged LXC uses a SUID program to configure networking, I am not sure how this is playing out with seccomp restricting privileges. I would try LXC without any kind of network namespace and without seccomp to get started.

@netblue30 commented on GitHub (Jan 9, 2017): Although I didn't try wayland or an unprivileged firejail, it should be possible. X11 is just a UNIX socket, nothing in seccomp and namespaces should prevent it. The technology is definitely there, maybe there are some obscure details to be hammered out. Unprivileged LXC uses a SUID program to configure networking, I am not sure how this is playing out with seccomp restricting privileges. I would try LXC without any kind of network namespace and without seccomp to get started.

gitea-mirror commented

2026-05-05 06:28:39 -06:00

Author

Owner

@xahare commented on GitHub (Jan 11, 2017):

ok, so priviledged :)

the goal is a container with a gui that doesnt have access to the hosts gui. kinda what firejail does when you turn on private everything and give it xephyr or xpra, but going all the way with it.

@xahare commented on GitHub (Jan 11, 2017): ok, so priviledged :) the goal is a container with a gui that doesnt have access to the hosts gui. kinda what firejail does when you turn on private everything and give it xephyr or xpra, but going all the way with it.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#700

No description provided.

Rows
Columns