How to forward Docker for Mac to X11? - macos

Question

Using Docker for Mac 1.12 (stable) and OS X 10.11.5 (15F34), I'm attempting to make one of my containers forward to X11.
First, I install XQuartz from my bash shell:
$ brew cask install xquartz
==> Downloading https://dl.bintray.com/xquartz/downloads/XQuartz-2.7.9.dmg
######################################################################## 100.0%
==> Verifying checksum for Cask xquartz
==> Running installer for xquartz; your password may be necessary.
==> Package installers may write to any location; options such as --appdir are ignored.
Password:
==> installer: Package name is XQuartz 2.7.9
==> installer: Installing at base path /
==> installer: The install was successful.
🍺 xquartz staged at '/usr/local/Caskroom/xquartz/2.7.9' (73M)
Then I continue with setting up XQuartz...
open -a XQuartz
In the XQuartz Preferences -> Security tab, I enable "Allow connections from network clients".
Then I am supposed to run xhost + $MY_IP_ADDRESS in my bash shell, but all I get is this error:
xhost: unable to open display ""
In the end, all guides I'm reading says I should run my container like this:
docker run -e DISPLAY=$MY_IP_ADDRESS:0 -v /tmp/.X11-unix:/tmp/.X11-unix DOCKER_IMAGE
...but that doesn't work. In my particular container, I get this error:
... cannot connect to X server 10.0.0.131:0
What am I doing wrong?

Answer 1

Turns out there's a bug in XQuartz 2.7.9.
When using XQuartz 2.7.10_beta2, it works.

Answer 2

I have xQuartz 2.7.11 installed on Mac OS.
I was getting the following error
<program>: cannot connect to X server <ip>:0
when trying to run docker container. I tried downgrading XQuartz but it still didn't fix my issue.
A crucial piece to to the setup is to add your ip access control list for xhost.
xhost + $(ipconfig getifaddr en0)
After adding the ip to xhost, everything works. There is no need to downgrade Xquartz version.

Answer 3

Solution
After installing XQuartz you will need to restart your computer as horcle_buzz suggested; starting a new terminal session is not enough.
After a reboot you can grant access for whatever you need using the xhost command. Just be careful and understand the consequences of too permissive a rule. This other discussion has more info: Running Chromium inside Docker - Gtk: cannot open display: :0
Additional findings
Some extra things I discovered along the way:
XQuartz must be running first:
$ open -a XQuartz
You can expose 127.0.0.1 instead of looking up your local IP (caveat emptor: I'm not an expert on the implications of this setting):
$ xhost + 127.0.0.1
127.0.0.1 being added to access control list
You can use the special host.docker.internal identifier with docker run:
$ docker run -e DISPLAY=host.docker.internal:0 jess/firefox
# 🧙‍♀️ magic 🧙‍♂️
At least for me, ctrl + c does not shutdown the container; I need to close the X11 window manually.
If you quit XQuartz, you must re-auth with xhost after starting it again (the permission doesn't "stick").
Doing it this way I didn't need to mount /tmp/.X11-unix when calling docker run.
I tested this with XQuartz 2.7.11 and Docker Desktop 2.1.0.2 on macOS Mojave (10.14.6).