0

Mostly a thought experiment; hopefully I'll learn something; perhaps an actually potentially useful idea. I'm mixing in a bit of docker-esk terminology - as I have in mind this might be one approach.

I'm wondering if there is a way to run C++ code / applications so that they have library isolation; but still host application level use of the host UI and GPU. 

How do applications running on Linux (in my case Ubuntu) write to the UI? When an application requests access to X11 unix socket; can the OS then control that access to only write to bits of the UI the given application owns?

Which bit of docker creates the "isolation" that prevents containers from doing this? Is it a  restriction that comes from a cgroups / namespace / chroot change? 

Is there a way to reduce the "isolation" level of a docker container so it could use the host UI without having to  take additional steps to give the container access to the X11 unix socket?

I would be OK if this reduces other isolation levels of the container; I assume to the equivalent of if the application was running directly on the host. The only goal is to have library isolation, I trust the code I'm running to not be malicious.

I'm not sure; but this might be along the lines of what I'm thinking of. https://chromium.googlesource.com/chromium/src/+/master/docs/linux/using_a_chroot.md#Running-X-apps - as I understand its an approach to resolving some library dependency issues. The script is https://chromium.googlesource.com/chromium/src/+/master/build/install-chroot.sh

brent
  • 1,095
  • 1
  • 11
  • 27
  • Either a chroot or just putting specific libraries into a directory on `$LD_LIBRARY_PATH` are what immediately comes to mind. Do you specifically want to avoid, say, the host's `libc.so`? What do and don't you want to be isolated? – David Maze Jul 06 '20 at 13:31
  • I'm thinking of "the same level of library isolation you would get in a docker container." Not sure if that is a useful answer; I'm trying to learn-by-asking :) So to get all the escape from "dependency hell" and all the good run-anywhere ness of containers; but reduce the security safety to make it easier to have UI & GPU functionality. IF that is a trade-off that is possible to achieve. – brent Jul 06 '20 at 13:50
  • Did you actually experience this _'dependency hell'_ or just heard about it? Anyways, `chroot` would be the simplest idea. – Lorinczy Zsigmond Jul 15 '20 at 12:12

0 Answers0