title: Run X application in a Docker container reliably on a server connected via SSH without "--net host"
body: <p>Without a Docker container, it is straightforward to run an X11 program on a remote server using the SSH X11 forwarding (<strong>ssh -X</strong>). I have tried to get the same thing working when the application runs inside a Docker container on a server. When SSH-ing into a server with the -X option, an X11 tunnel is set up and the environment variable "$DISPLAY" is automatically set to typically "localhost:10.0" or similar. If I simply try to run an X application in a Docker, I get this error:</p>
  
  <pre><code>Error: GDK_BACKEND does not match available displays
  </code></pre>
  
  <p>My first idea was to actually pass the $DISPLAY into the container with the "-e" option like this:</p>
  
  <pre><code>docker run -ti -e DISPLAY=$DISPLAY name_of_docker_image
  </code></pre>
  
  <p>This helps, but it does not solve the issue. The error message changes to:</p>
  
  <pre><code>Unable to init server: Broadway display type not supported: localhost:10.0
  Error: cannot open display: localhost:10.0
  </code></pre>
  
  <p>After searching the web, I figured out that I could do some <strong>xauth</strong> magic to fix the authentication.  I added the following:</p>
  
  <pre><code>SOCK=/tmp/.X11-unix
  XAUTH=/tmp/.docker.xauth
  xauth nlist $DISPLAY | sed -e 's/^..../ffff/' | xauth -f $XAUTH nmerge -
  chmod 777 $XAUTH
  docker run -ti -e DISPLAY=$DISPLAY -v $XSOCK:$XSOCK -v $XAUTH:$XAUTH \ 
    -e XAUTHORITY=$XAUTH name_of_docker_image
  </code></pre>
  
  <p>However, this only works if also add "<strong>--net host</strong>" to the docker command:</p>
  
  <pre><code>docker run -ti -e DISPLAY=$DISPLAY -v $XSOCK:$XSOCK -v $XAUTH:$XAUTH \ 
    -e XAUTHORITY=$XAUTH --net host name_of_docker_image
  </code></pre>
  
  <p>This is not desirable since it makes the whole host network visible for the container.</p>
  
  <p>What is now missing in order to get it fully to run on a remote server in a docker without "--net host"?</p>