[GH-ISSUE #1075] RFC: --x11=xvfb mode #732

New issue

Closed

opened 2026-05-05 06:32:26 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 06:32:26 -06:00

Owner

Originally created by @zackw on GitHub (Jan 27, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1075

Xvfb is a headless X server -- it can run on computers with no graphics hardware whatsoever, and it enables you to run programs that insist on having access to an X server without giving them any access to the "real" display.

I would like to add --x11=xvfb mode to firejail; I need it for running a bunch of scripted instances of Firefox to access untrusted websites (hence, sandboxed) on a vhost with no graphics hardware. However, it's not as simple as just adding that one command-line switch. Many programs (including, indeed, Firefox) will not function correctly if they are talking to an X server with no active window manager, so firejail needs to start up a window manager, and there needs to be a way to tell it which one. Also, Xvfb's default fake screen allows only 8 bits per pixel (256 colors) and many programs (including, as I just discovered, Openbox) are not expecting this and will crash or draw garbage. The upshot of all that is that there needs to be a way to specify the window manager, and a way to pass arbitrary command-line arguments to the Xvfb process.

What I'm currently thinking of doing is adding three more command line options, in addition to --x11=xvfb:

--window-manager=PROGRAM Run PROGRAM as a window manager, connected to the X display established by the --x11 option. PROGRAM will get its own, independent sandbox, and any existing profile for it will be applied.
--x-server-args="blah blah blah" Pass "blah blah blah" as additional command line arguments to the X server spawned for the --x11 option.
--window-manager-args="..." Same, but for the window manager, if any.

Does that sound good to you? Would you prefer something else?

Originally created by @zackw on GitHub (Jan 27, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1075 [Xvfb](https://www.x.org/archive/X11R7.6/doc/man/man1/Xvfb.1.xhtml) is a headless X server -- it can run on computers with no graphics hardware whatsoever, and it enables you to run programs that insist on having access to an X server without giving them any access to the "real" display. I would like to add `--x11=xvfb` mode to firejail; I need it for running a bunch of scripted instances of Firefox to access untrusted websites (hence, sandboxed) on a vhost with no graphics hardware. However, it's not as simple as just adding that one command-line switch. Many programs (including, indeed, Firefox) will not function correctly if they are talking to an X server with no active window manager, so firejail needs to start up a window manager, and there needs to be a way to tell it which one. Also, Xvfb's default fake screen allows only 8 bits per pixel (256 colors) and many programs (including, as I just discovered, Openbox) are not expecting this and will crash or draw garbage. The upshot of all that is that there needs to be a way to specify the window manager, and a way to pass arbitrary command-line arguments to the Xvfb process. What I'm currently thinking of doing is adding three more command line options, in addition to `--x11=xvfb`: * `--window-manager=PROGRAM` Run PROGRAM as a window manager, connected to the X display established by the `--x11` option. PROGRAM will get its own, independent sandbox, and any existing profile for it will be applied. * `--x-server-args="blah blah blah"` Pass "blah blah blah" as additional command line arguments to the X server spawned for the `--x11` option. * `--window-manager-args="..."` Same, but for the window manager, if any. Does that sound good to you? Would you prefer something else?

gitea-mirror

2026-05-05 06:32:26 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 06:32:31 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 28, 2017):

Sure, send all of them in and I'll merge them, thanks.

@netblue30 commented on GitHub (Jan 28, 2017): Sure, send all of them in and I'll merge them, thanks.

gitea-mirror commented

2026-05-05 06:32:33 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 14, 2017):

still merging...

@netblue30 commented on GitHub (Apr 14, 2017): still merging...

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#732

No description provided.

Rows
Columns