> The images work by mounting the X11 socket into the container! Yippeeeee! Well, yippee, now the application can read all keyboard input from that X11 socket,

> The images work by mounting the X11 socket into the container! Yippeeeee! Well, yippee, now the application can read all keyboard input from that X11 socket, there goes your "sandbox"... You really need Wayland to get a practical security benefit for GUI applications from containers.