{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/27497","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/27497/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/27497/comments","events_url":"https://api.github.com/repos/docker/docker/issues/27497/events","html_url":"https://github.com/docker/docker/issues/27497","id":183731152,"number":27497,"title":"shared X socket vs. X over tcp -> GPU acceleration doesn't work with X over tcp","user":{"login":"mviereck","id":14821372,"avatar_url":"https://avatars.githubusercontent.com/u/14821372?v=3","gravatar_id":"","url":"https://api.github.com/users/mviereck","html_url":"https://github.com/mviereck","followers_url":"https://api.github.com/users/mviereck/followers","following_url":"https://api.github.com/users/mviereck/following{/other_user}","gists_url":"https://api.github.com/users/mviereck/gists{/gist_id}","starred_url":"https://api.github.com/users/mviereck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mviereck/subscriptions","organizations_url":"https://api.github.com/users/mviereck/orgs","repos_url":"https://api.github.com/users/mviereck/repos","events_url":"https://api.github.com/users/mviereck/events{/privacy}","received_events_url":"https://api.github.com/users/mviereck/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/kind/question","name":"kind/question","color":"EBEFC9"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-10-18T16:03:26Z","updated_at":"2016-10-20T10:53:09Z","closed_at":null,"body":"I'm working on a project to provide secure sandboxing for dockered GUI applictions: \r\nhttps://github.com/mviereck/x11docker\r\nThe core idea is to run a second X server for use with docker. This avoids breaking container isolation like it is the case in widespread solutions with shared X socket from display :0.\r\n\r\nGUI clients in docker get access to the second X server over tcp instead of sharing X socket. I often see rendering issues if using shared X socket, that doesn't occure if connecting to X over tcp.\r\nThis is especially the case if I share a persistent home folder with docker images, but can occure without this, too. I'm curious about the reasons and prefer X over tcp to avoid this problem.\r\n\r\nNow I am working on providing hardware acceleration to docker applications. This works fine using shared X socket, but does not work with X over tcp. \r\nAt first I thought of a tcp protocol problem, but this seems not be the case, because host applications connecting to the second X server over tcp can use hardware acceleration.\r\n\r\nTo show you the differences, I created a second X server with a dockered terminal and a host terminal in it, checking the OpenGL renderer string in four cases:\r\n```\r\nroot@7c7cf556453d:/# # docker connected to X over tcp\r\nroot@7c7cf556453d:/# DISPLAY=172.17.42.1:1.0 glxinfo | grep \"OpenGL renderer\"\r\nOpenGL renderer string: Gallium 0.4 on llvmpipe (LLVM 3.8, 128 bits)\r\nroot@7c7cf556453d:/# \r\nroot@7c7cf556453d:/# # docker connected to X with shared X socket\r\nroot@7c7cf556453d:/# DISPLAY=:1.0 glxinfo | grep \"OpenGL renderer\"\r\nOpenGL renderer string: Gallium 0.4 on AMD MULLINS (DRM 2.39.0, LLVM 3.8.0)\r\nroot@7c7cf556453d:/# \r\n\r\n\r\nlauscher@localhost:~$ # host application on same X server as docker\r\nlauscher@localhost:~$ # host application connected to X over tcp\r\nlauscher@localhost:~$ DISPLAY=172.17.42.1:1.0 glxinfo | grep \"OpenGL renderer\"\r\nOpenGL renderer string: Gallium 0.4 on AMD MULLINS\r\nlauscher@localhost:~$ \r\nlauscher@localhost:~$ # host application connected to X using X socket\r\nlauscher@localhost:~$ DISPLAY=:1.0 glxinfo | grep \"OpenGL renderer\"\r\nOpenGL renderer string: Gallium 0.4 on AMD MULLINS\r\nlauscher@localhost:~$ \r\n```\r\nAs you can see, host applications can get hardware acceleration connected over tcp, dockered applications can not. Accessing X over X socket allows dockered and host applications to use hardware acceleration. \r\n\r\nFor testing purpuoses I can run docker --privileged and can set xhost + on the second X server to make sure it is not a permission issue, but it does not help.\r\n\r\nDo you have any clue  what may be missing? As hardware acceleration in docker is working with shared X socket, it cannot be due to missing drivers or device files. (I'm sharing all device files in /dev/dri with option --device).\r\n\r\nTo reproduce the test shown above, you can do this:\r\n - get x11docker\r\n - run 'dpkg-reconfigure x11-common' and choose option 'anybody' to allow yourself to run a second X server\r\n - install openbox, or use another window manager with context menu (f.e. fluxbox)\r\n - use 'x11docker-gui -d' to see developer options, or directly use this command:\r\n\r\n`x11docker --X11 --sharenewxsocket --sharegpu --privileged --xhost --wm \"openbox\" --verbose --  x11docker/xfce  xfce4-terminal`\r\n - You get xfce4-terminal from within docker image. Use context menu of window manager to start a host terminal, too.\r\n\r\nTo see rendering issues using shared X socket, you can do the same, but additionally share a home folder in ~/.local/share/x11docker with command:\r\n`x11docker --X11  --sudouser --home --xsocket --sharegpu --desktop --verbose --  x11docker/xfce  startxfce4`\r\nThis command runs xfce desktop in docker. Start it more than one time to get rendering issues.\r\n\r\n\r\nI believe it may be a small missing link only to get hardware acceleration with X over tcp in docker working. Do you have an idea?\r\n\r\n\r\nOutput of docker version: \r\n```\r\nClient version: 1.6.2\r\nClient API version: 1.18\r\nGo version (client): go1.3.3\r\nGit commit (client): 7c8fca2\r\nOS/Arch (client): linux/amd64\r\nServer version: 1.6.2\r\nServer API version: 1.18\r\nGo version (server): go1.3.3\r\nGit commit (server): 7c8fca2\r\nOS/Arch (server): linux/amd64\r\n\r\n```\r\nOutput of docker info:\r\n```\r\nContainers: 43\r\nImages: 423\r\nStorage Driver: aufs\r\n Root Dir: /var/lib/docker/aufs\r\n Backing Filesystem: extfs\r\n Dirs: 509\r\n Dirperm1 Supported: true\r\nExecution Driver: native-0.2\r\nKernel Version: 3.16.0-4-amd64\r\nOperating System: Debian GNU/Linux 8 (jessie)\r\nCPUs: 4\r\nTotal Memory: 6.714 GiB\r\nName: localhost\r\nID: MBK6:T5AD:ON4F:SKRF:KKGQ:ODYM:WT4Y:DKH2:5WWG:C523:EZT4:DVLZ\r\nWARNING: No memory limit support\r\nWARNING: No swap limit support\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/255073840","html_url":"https://github.com/docker/docker/issues/27497#issuecomment-255073840","issue_url":"https://api.github.com/repos/docker/docker/issues/27497","id":255073840,"user":{"login":"mviereck","id":14821372,"avatar_url":"https://avatars.githubusercontent.com/u/14821372?v=3","gravatar_id":"","url":"https://api.github.com/users/mviereck","html_url":"https://github.com/mviereck","followers_url":"https://api.github.com/users/mviereck/followers","following_url":"https://api.github.com/users/mviereck/following{/other_user}","gists_url":"https://api.github.com/users/mviereck/gists{/gist_id}","starred_url":"https://api.github.com/users/mviereck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mviereck/subscriptions","organizations_url":"https://api.github.com/users/mviereck/orgs","repos_url":"https://api.github.com/users/mviereck/repos","events_url":"https://api.github.com/users/mviereck/events{/privacy}","received_events_url":"https://api.github.com/users/mviereck/received_events","type":"User","site_admin":false},"created_at":"2016-10-20T10:53:09Z","updated_at":"2016-10-20T10:53:09Z","body":"I've researched a bit more and found out:\r\n- GPU acceleration with X over tcp is possible with shared device files in /dev/dri and docker run option --net=host. It is not needed to share X sockets.\r\n- GPU acceleration with shared X sockets is possible with shared device files in /dev/dri and docker run option --ipc=host. Than there are no more rendering issues. I assume it has to do with MIT-SHM extension from X, maybe with memory sharing on GPU memory, too.\r\n\r\nIn case of shared X sockets, the problem lies within shared memory buffers, as @justincormack assumed for X over tcp. Using X over tcp seems to work in another way and may disable memory sharing, but needs more access to host network than is given from docker by default.\r\n\r\nBoth options, --net=host and --ipc=host, break container isolation. I have to localize the exact needs for GPU acceleration in both cases and to shrink down these widespread options to what is really needed.\r\n\r\nAt first place, this to find out is more related to X than to docker, but maybe you have some clues where to look for and which docker options I could check out. Any help and hints are very apprecriated!"}}
{"actor":{"display_login":"mviereck"}}