Run X application in a Docker container reliably on a server connected via SSH without “--net host”

Question

Without a Docker container, it is straightforward to run an X11 program on a remote server using the SSH X11 forwarding (ssh -X). I have tried to get the sa

Answer 1

In my case, I sit at "remote" and connect to a "docker_container" on "docker_host":

remote --> docker_host --> docker_container

To make debugging scripts easier with VScode, I installed SSHD into the "docker_container", reporting on port 22, mapped to another port (say 1234) on the "docker_host".

So I can connect directly with the running container via ssh (from "remote"):

ssh -Y -p 1234 appuser@docker_host.local

(where appuser is the username within the "docker_container". I am working on my local subnet now, so I can reference my server via the .local mapping. For external IPs, just make sure your router is mapped to this port to this machine.)

This creates a connection directly from my "remote" to "docker_container" via ssh.

remote --> (ssh) --> docker_container

Inside the "docker_container", I installed sshd with sudo apt-get install openssh-server (you can add this to your Dockerfile to install at build time).

To allow X11 forwarding to work, edit the /etc/ssh/sshd_config file as such:

X11Forwarding yes
X11UseLocalhost no

Then restart the ssh within the container. You should do this from shell executed into the container, from the "docker_host", not when you are connected to the "docker_container" via ssh: (docker exec -ti docker_container bash)

Restart sshd: sudo service ssh restart

When you connect via ssh to the "docker_container", check the $DISPLAY environment variable. It should say something like

appuser@3f75a98d67e6:~/data$ echo $DISPLAY
3f75a98d67e6:10.0

Test by executing your favorite X11 graphics program from within "docker_container" via ssh (like cv2.imshow())