mviereck/x11docker

Features

• OCI GUI Orchestrators - Acts as an orchestrator to execute graphical applications and desktop environments inside Docker or Podman.
• Containerized Desktop Sessions - Launches full desktop environments with window managers and GPU acceleration inside isolated containers.
• Audio Socket Routing - Shares PulseAudio or PipeWire sockets to connect containerized audio streams to the host sound server.
• Container User Identity Mapping - Maps container user and group IDs to those of the host to ensure correct file permissions and security.
• GUI-Aware Process Management - Connects containerized processes to host X11/Wayland display servers and audio systems.
• GPU Hardware Acceleration - Enables high-performance rendering and compute by interfacing containers with host GPUs.
• X11 Display Forwarders - Maps host X11 or Wayland sockets into the container to render graphical interfaces on the host screen.
• Audio Server Integration - Shares PulseAudio or ALSA sockets with the container to enable sound playback and recording.
• Containerized Launchers - Starts full desktop environments with window managers and GPU acceleration inside a container.
• Socket Sharing - Shares the host Wayland socket to execute native Wayland applications inside containers.
• Hardware Bridges - Provides the core bridging mechanism that allows containerized applications to access host GPUs, clipboards, and hardware peripherals.
• Hardware Device Sharing - Grants containers shared access to physical host peripherals like webcams and printers.
• Linux Sandboxes - Functions as a security-focused sandbox for running untrusted graphical software in isolated containers.
• Physical Device Pass-through - Maps host hardware device nodes and drivers into containers for direct peripheral and GPU access.
• Hardware Passthrough - Maps physical host hardware devices like webcams and printers directly into containerized environments.
• X11 Display Server Management - Manages X servers and Wayland compositors to coordinate graphical output for containerized apps.
• Privilege Dropping - Creates a non-root user matching the host user and drops unnecessary kernel capabilities to minimize the attack surface.
• X Server Access Controls - Configures X authority cookies and xhost policies to secure the graphical connection between the host and the container.
• GUI Application Bridges - Provides a bridge to launch and display graphical applications from containers on the host desktop.
• Persistent Storage Volumes - Maps host directories or volumes to the container to preserve user data across sessions.
• Clipboard Synchronization - Synchronizes text and data between the host and container using unidirectional or bidirectional transfer modes.
• Container-to-Host Application Export - Creates native desktop shortcuts for containerized graphical apps to enable quick execution from the host.
• Session Detachment and Reattachment - Integrates with xpra to allow detaching from and reattaching to remote GUI sessions without closing applications.
• Multi-Architecture Container Runtimes - Runs container images built for different CPU architectures using emulation for cross-hardware compatibility.
• User Session Daemons - Starts a DBus user session daemon to support application communication regardless of the chosen init system.
• OCI Runtime Switching - Supports the use of different OCI-compliant runtimes such as Docker, Podman, or direct host execution.
• Runtime Abstraction Layers - Provides a common interface to execute containers across different backends like Docker and Podman.
• Remote GUI Access - Provides remote access to containerized desktops via VNC, SSH forwarding, and HTML5 rendering.
• DBus Session Bridging - Enables inter-process communication by bridging the container to the host DBus system or starting a private session.
• Nested X Servers - Starts nested servers and virtual frames to display containerized applications on the host.
• Cross-Architecture Virtualization - Supports running container images built for different CPU architectures via emulation.
• NVIDIA GPU Passthroughs - Automates the mapping of NVIDIA GPUs and driver versions from the host into containers.
• X11 Authorization Tokens - Passes security tokens between the host and container to authorize X11 server connections.
• X Client Namespace Isolation - Creates dedicated, isolated X server namespaces to prevent security leaks from containerized applications.
• SSH Server Hosting - Runs an SSH daemon inside the container to enable remote shell access and graphical application execution.
• X11 Display Security - Implements security mechanisms to isolate X11 display servers from untrusted containerized applications.
• User Namespace Mappings - Synchronizes container user and group IDs with the host to ensure correct file permissions.
• D-Bus Desktop Services - Provides bridging to the host system bus or initiates a private session for containerized desktop applications.
• Container Init Process - Launches a service manager as PID 1 to handle system daemons and prevent zombie processes.
• Browser-Based Remote Desktop Clients - Renders desktop applications as HTML5 web pages via Xpra or GTK3 Broadway for browser-based remote access.
• VNC Server Hosting - Starts a VNC server within a container to provide remote graphical access to the containerized session.

Istoric stele