Ctrlk
VitePress 镜像站QQ 群 787969044视频教程Ⅰ视频教程Ⅱ
discord
For the complete documentation index, see llms.txt. This page is also available as Markdown.

33.6 GUI in Linux Jails

GUI in Jails

The example environment in this section is a Windows 10 physical machine with a FreeBSD 13.1 virtual machine installed in VirtualBox.

Four Jails have been deployed in the FreeBSD virtual machine. One of them is a FreeBSD Jail, referred to as freebsd-jail to distinguish it from the FreeBSD virtual machine in VirtualBox:

Windows 10 physical machine → FreeBSD 13.1 virtual machine → FreeBSD Jail (freebsd-jail) + debian Jail + Ubuntu Jail + Alpine Jail.

# jls
   JID  IP Address      Hostname                      Path
     1  192.168.5.1     debian                      /usr/jails/debian
     2  192.168.5.2     ubuntu                    /usr/jails/ubuntu
     3  192.168.5.4     alpine                        /usr/jails/alpine
     4  192.168.5.5     freebsd-jail                  /usr/jails/freebsd-jail

Directory structure:

/usr/jails/
├── debian/          # JID 1, IP 192.168.5.1
├── ubuntu/          # JID 2, IP 192.168.5.2
├── alpine/          # JID 3, IP 192.168.5.4
└── freebsd-jail/    # JID 4, IP 192.168.5.5

xclock, Firefox, Chrome, and jwm are installed in the four Jails respectively, with jwm used for interface management. In Alpine, the VNC method could not be debugged successfully, and Firefox and Chrome also failed to run, but xclock, xterm, and similar programs work normally.

Tip

There is no need to install xorg.

In Ubuntu 22.04, Firefox is distributed as a snap package by default. Since snap depends on systemd, it cannot be used in a Jail, so Firefox must be installed using the deb package. Chrome is only available as a deb package in Ubuntu and does not depend on snap, so it can be installed directly. The method is as follows:

Terminal with X Server

Use MobaXterm. MobaXterm works with its default configuration and requires no additional setup.

Configure MobaXterm

Make sure the X server is enabled, and note the DISPLAY value. The format is hostname:displaynumber.screennumber, which here is 192.168.56.1:0.0.

Log into the Jail (any login method and any user):

Run xclock

Four independent xclock instances are displayed on the Windows 10 desktop, all running normally.

Nested X Server

Xnest/Xephyr is a nested X Server technology. To X11 applications, it acts as an X Server; to the host X Server, it acts as an X Client. This nested structure allows running a complete X session within an X window.

Install Xnest or Xephyr in the FreeBSD virtual machine. Choose either one:

Or:

Enable it in FreeBSD:

Parameter description:

  • :1 is the displaynumber in the DISPLAY value. The FreeBSD system IP is 10.0.2.15, so the complete DISPLAY value is 10.0.2.15:1.0. Since the FreeBSD system's X Server uses displaynumber 0, start from 1.

  • -listen tcp listens on the TCP port.

In the Jail, use the same method as described earlier:

All four Jails can open xclock simultaneously in a single Xnest/Xephyr window started on FreeBSD. However, without a window manager, xclock lacks window decorations and basic interaction features. You can run jwm before executing xclock, as follows:

jwm only needs to be run once; there is no need to run it in each Jail separately. jwm is used here because it is lightweight. Desktop environments such as Xfce can also be used, depending on your needs.

Shared Host Socket Method

First, run the following on the FreeBSD system:

Warning

xhost + disables access control, which poses a security risk. A more secure approach is to specify the IP addresses allowed to access.

Then add the following to the Jail's fstab file. Using the ubuntu Jail's fstab as an example; modify other Jails accordingly:

If necessary, first run mkdir -p /usr/jails/ubuntu/tmp/.X11-unix to ensure the mount point exists.

After restarting the Jail, run the following inside the Jail:

As mentioned earlier, the fstab file contains the following line:

This configuration exposes the FreeBSD /tmp directory to the Jail with read-write access, breaking isolation, so it is commented out. Mounting only /tmp/.X11-unix significantly improves security.

X Server TCP Listening with xhost Connection Management

This section uses the SDDM display manager. If using another display manager, refer to the corresponding documentation; the principle is the same.

On FreeBSD, edit or create the /usr/local/etc/sddm.conf file and modify ServerArguments as follows:

After restarting, add the Jail IP on FreeBSD to allow access:

This method is more secure than xhost +, as it only allows access from the specified IP.

Then, inside the Jail, run:

Setting DISPLAY to :0.0, 127.0.0.1:0.0, or 10.0.2.15:0.0 all work. You can try any of the above methods.

VNC

Install a VNC server in the Debian Jail; tightvncserver can be used. Using the Debian Jail as an example, run the following inside the Jail:

The vncserver port number is 5900 plus the number after the colon. Here it is 5900; :1 corresponds to port 5901, and so on.

Log into the Jail using a VNC client:

VNC Login
VNC Login
VNC Login

Appendix and Addenda

One reason TCP listening is disabled by default is that the host X Server's TCP listening combined with xhost connection management has poor security.

When using the shared host socket method, note that only /tmp/.X11-unix should be mounted rather than the entire /tmp, and xhost +<specified IP> should be used instead of xhost +; meeting these two points ensures security.

The three methods — terminal with X Server, shared host socket, and VNC — are recommended. Regardless of the method used, Linux Jails have certain compatibility limitations, and not all X applications can run; in comparison, FreeBSD Jails have better compatibility.

Except for the shared host socket method, the other methods can also be used in non-Jail environments.

References

Previous33.5 Alpine JailNext34.1 Installing Windows 11 with bhyve and vm-bhyve

Last updated