3 ms·
The container would only be able to record the screens or key presses that occur in the same xserver, right? I never thought about access to localhost services.
by joombaga 5y ago
The container would only be able to record the screens or key presses that occur in the same xserver, right? I never thought about access to localhost services. I'm guessing there's some xserver configuration that could prevent that.
- 0x0 5y agoNobody runs more than one X server. And the X server isn't involved with other localhost services.
- joombaga 5y agoI don't intend to run more than one X server. Most of my GUI applications don't use X.
- d110af5ccf 5y agoWait I thought distros ran one X server per logged in user account and put them on different ttys. Out of the box on Ubuntu I can log in as two separate users simultaneously and switch between those unlocked sessions as well as the login screen by changing the tty. If you pass the GPU device node through to an LXC container I believe you can run an X or Wayland server fully inside of it but I'm not sure if changing ttys will work correctly because you might need access to more than just the GPU to handle the handoff with the kernel correctly.
- remram 5y agoThe parent's setup makes the host's X server socket available to the container, so there's only one X server in that case. In the article, they run a separate X server, which offers some isolation as you note.