Erratic behavior on non-root setups

[matebuteler]

Describe the bug
The container does not support running as a non-root user when using X11 Forwarding to XWayland. This implies both running in Rootless mode and running with USER != 0 fail.

To Reproduce
Steps to reproduce the behavior:

1. Download Docker in Rootless mode
2. Run ./start_x.sh
   The container will start and then exit immediately, with "Cannot connect to DISPLAY :0" on Docker logs.

OR

1. Download Docker in regular mode
2. Start the container as USER. This fails as a user can't start a Docker container

OR

1. Download Docker in regular mode
2. Start the container as root. The container will fall back to X11 mode as it will not find the Wayland socket; I think XDG_RUNTIME_DIR might not be set.
3. X11 mode will work but the container will be run as root with UID 0 and eda/designs folder owned by root.

Expected behavior
An xfce4-terminal pops up.

Environment:

• OS: Linux
• Operating mode: X11
• Version tag: Tried with multiple versions, currently running from source

Additional context

** I found a simple workaround to make things work. On a non-rootless Docker install, adding sudo to the docker run command enables all variables and PARAMS to be solved as $USER, therefore starting the container with the relevant and correct environment vars (such as $XDG_RUNTIME_DIR -> /run/user/1000), while starting the container with USER=1000 (example) in a non-privileged fashion. **

I should try to run the container from a user inside the docker group, but my system doesn't include this feature for security reasons.

[MrHighVoltage]

Rootless mode (seemingly in both Docker and Podman) has problems with access to the X11 and Wayland sockets, due to missmatching UIDs and GIDs on the host. Running rootless using sudo, I don't know to which UID on the host your actual processes are mapped. Could you maybe check this @matebuteler ? Check your hosts processes with ps aux, and find a process that is definitely running in the container, like the xfce4-terminal.

As a workaround, for podman, you can select the user-namespace mode as "keep-id", where the user inside the container uses the same UID and GID as on the host, the username and groupname are copied. This also has the advantage, that there will be no missmatches between users in the shared directories. Additionally, any root process inside the container is mapped to an unprivileged UID outside the container.

[matebuteler]

Hey @MrHighVoltage ! I belive I didn't quite grasp your answer. Do you mean installing rootless Docker and then launching it using sudo? That shouldn't be possible as the docker socket is in the user's runtime.e

[MrHighVoltage]

Sorry I meant in your workaround, can you check on which actual host UID the processes are running?

Currently, we are not supporting rootless mode. But I am currently investigating it a bit, since it would also enable allowing root access/sudo inside the container, giving it much more flexibility.

[matebuteler]

Oh, right. They're running as UID 1000 (me).

[MrHighVoltage]

Sorry for the late answer. Is this still an issue? I did some work on rootless mode and tested it quite extensively, but mostly using Podman, since Docker rootless mode has exactly this issue and there is no easy fix (it would require changing the permissions on the sockets to access Wayland/X11 and I'd rather skip this).

So if this is still an issue, I'd recommend you to switch to Podman for rootless containers.

[matebuteler]

Hey, yes, it's still an issue. Seems like the only way to get X11 and /eda/designs to work simultaneously is to have your user added to the 'docker' group which is quite insecure. Currently I run the container with sudo docker run --user 1000:1000 -v "/home/mateo/eda/designs":"/foss/designs":z -v ~/.ssh:/headless/.ssh:ro,z hpretl/iic-osic-tools:latest and connect via VNC.