skip to Main Content

I’m trying to create a docker container that will let me run firefox, so I can eventually use a jupyter notebook. Right now, although I have successfully installed firefox, I cannot get a window to open.

Following instructions from running-gui-apps-within-docker, I created an image (i.e. "sample") with Firefox and then tried to run it using

$ docker run -it --rm -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix --net=host sample

When I did so, I got the following error:

root@machine:~# firefox
No protocol specified
Unable to init server: Could not connect: Connection refused
Error: cannot open display: :1

Using man docker run to understand the flags, I was not able to find the --net flag, though I did see a --network flag. However, replacing --net with --network didn’t change anything. How do I specify a protocol, that will let me create an image from whose containers I will be able to run firefox?

PS – For what it’s worth, when I check the value of DISPLAY, I get the predictable:

~# echo $DISPLAY
:1

2

Answers


  1. Try run xhost + in your docker host to allow conections with X server.

    Login or Signup to reply.
  2. I have been running firefox inside docker for quite some time so this is possible. With regards to the security aspects I think the following is the relevant parts:

    Building

    The build needs to match up uid/gid values with the user that is running the container. I do this with UID and GID build args:

    Dockerfile

    ...
    FROM fedora:35 as runtime
    
    ENV DISPLAY=:0
    
    # uid and gid in container needs to match host owner of
    # /tmp/.docker.xauth, so they must be passed as build arguments.
    ARG UID
    ARG GID
    
    RUN 
           groupadd -g ${GID} firefox && 
           useradd --create-home --uid ${UID} --gid ${GID} --comment="Firefox User" firefox && 
           true
    ...
    
    ENTRYPOINT [ "/entrypoint.sh" ]
    

    Makefile

    build:
            docker pull $$(awk '/^FROM/{print $$2}' Dockerfile | sort -u)
            docker build 
                    -t $(USER)/firefox:latest 
                    -t $(USER)/firefox:`date +%Y-%m-%d_%H-%M` 
                    --build-arg UID=`id -u` 
                    --build-arg GID=`id -g` 
                    .
    
    

    entrypoint.sh

    #!/bin/sh
    
    # Assumes you have run
    #      pactl load-module module-native-protocol-tcp auth-ip-acl=127.0.0.1 auth-anonymous=1
    # on the host system.
    PULSE_SERVER=tcp:127.0.0.1:4713
    export PULSE_SERVER
    
    if [ "$1" = /bin/bash ]
    then
            exec "$@"
    fi
    
    exec /usr/local/bin/su-exec firefox:firefox 
            /usr/bin/xterm 
                    -geometry 160x15 
                    /usr/bin/firefox --no-remote "$@"
    
    

    So I am running firefox as a dedicated non-root user, and I wrap it via xterm so that the container does not die if firefox accidentally exit or if you want to restart. It is a bit annoying having all these extra xterm windows, but I have not found any other way in preventing accidental loss of the .mozilla directory content (mapping out to a volume would prevent running multiple independent docker instances which I definitely want, and also from a privacy point of view not dragging along a long history is something I want. Whenever I do want to save something I make a copy of the .mozilla directory and save it on the host computer (and restore later in a new container)).

    Running

    run.sh

    #!/bin/bash
    
    export XSOCK=/tmp/.X11-unix
    export XAUTH=/tmp/.docker.xauth
    
    touch ${XAUTH}
    xauth nlist ${DISPLAY} | sed -e 's/^..../ffff/' | uniq | xauth -f ${XAUTH} nmerge -
    
    DISPLAY2=$(echo $DISPLAY | sed s/localhost//)
    if [ $DISPLAY2 != $DISPLAY ]
    then
            export DISPLAY=$DISPLAY2
            xauth nlist ${DISPLAY} | sed -e 's/^..../ffff/' | uniq | xauth -f ${XAUTH} nmerge -
    fi
    
    ARGS=$(echo $@ | sed 's/[^a-zA-Z0-9_.-]//g')
    
    docker run -ti --rm 
            --user root 
            --name firefox-"$ARGS" 
            --network=host 
            --memory "16g" --shm-size "1g" 
            --mount "type=bind,target=/home/firefox/Downloads,src=$HOME/firefox_downloads" 
            -v ${XSOCK}:${XSOCK} 
            -v ${XAUTH}:${XAUTH} 
            -e XAUTHORITY=${XAUTH} 
            -e DISPLAY=${DISPLAY} 
            ${USER}/firefox "$@"
    
    

    With this you can for instance run ./run.sh https://stackoverflow.com/ and get a container named firefox-httpsstackoverflow.com. If you then want to log into your bank completely isolated from all other firefox instances (protected by operating system process boundaries, not just some internal browser separation) you run ./run.sh https://yourbank.example.com/.

    Login or Signup to reply.
Please signup or login to give your own answer.
Back To Top
Search