Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #230091 > unrolled thread

graphical session in LXC automatically started at boot and reachable via VNC/RDP/X2GO

Back to article view | Back to linux.debian.user

Contents

  graphical session in LXC automatically started at boot and reachable  via VNC/RDP/X2GO Yvan Masson <yvan@masson-informatique.fr> - 2020-12-29 22:10 +0100
    Re: graphical session in LXC automatically started at boot and  reachable via VNC/RDP/X2GO Georgi Naplatanov <gosho@oles.biz> - 2020-12-29 22:30 +0100
    Re: graphical session in LXC automatically started at boot and          reachable via VNC/RDP/X2GO Linux-Fan <Ma_Sys.ma@web.de> - 2020-12-30 00:20 +0100
      Re: graphical session in LXC automatically started at boot and  reachable via VNC/RDP/X2GO Yvan Masson <yvan@masson-informatique.fr> - 2020-12-30 20:40 +0100
        Re: graphical session in LXC automatically started at boot and          reachable via VNC/RDP/X2GO Linux-Fan <Ma_Sys.ma@web.de> - 2020-12-30 23:50 +0100
          Re: graphical session in LXC automatically started at boot and  reachable via VNC/RDP/X2GO Yvan Masson <yvan@masson-informatique.fr> - 2020-12-31 09:30 +0100
            Re: graphical session in LXC automatically started at boot and          reachable via VNC/RDP/X2GO Linux-Fan <Ma_Sys.ma@web.de> - 2020-12-31 14:20 +0100

#230091 — graphical session in LXC automatically started at boot and reachable via VNC/RDP/X2GO

Hi list,

I need to run a graphical software called Noethys that also listens on 
some TCP port. It:
1. needs to be reachable from the network during work hours
2. needs to be accessible remotely a few times per day, mainly by a 
Windows workstation on the LAN

I will run this software on a server, preferably in a LXC system 
container or in last resort in a QEMU/KVM VM (because LXC is lighter on 
resources and easier to snapshot/backup. The server will automatically 
boot the morning and shutdown the evening.

Because of 1., the graphical session in the container and the software 
must start automatically. Then, because of 2., this session must be 
reachable by something like VNC/RDP/X2GO.

I am facing the following difficulties/questions:
- running a normal X11 server in a container does not work because it 
would need to access some special files in /dev/, so it needs extra 
setup in the container and this scares me a bit
- however, after installing xrdp and x2go servers in the container, I 
can successfully connect remotely with these respective protocols 
without any particular setup. I would really like to find a way to 
automatically start a X11 session at boot in same way xrdp or x2go do it 
(I would then stick with this protocol)

Has someone already done something similar? What would be your advice?

Regards,
Yvan

[toc] | [next] | [standalone]

#230092 — Re: graphical session in LXC automatically started at boot and reachable via VNC/RDP/X2GO

On 12/29/20 10:56 PM, Yvan Masson wrote:
> Hi list,
> 
> I need to run a graphical software called Noethys that also listens on
> some TCP port. It:
> 1. needs to be reachable from the network during work hours
> 2. needs to be accessible remotely a few times per day, mainly by a
> Windows workstation on the LAN
> 
> I will run this software on a server, preferably in a LXC system
> container or in last resort in a QEMU/KVM VM (because LXC is lighter on
> resources and easier to snapshot/backup. The server will automatically
> boot the morning and shutdown the evening.
> 
> Because of 1., the graphical session in the container and the software
> must start automatically. Then, because of 2., this session must be
> reachable by something like VNC/RDP/X2GO.
> 
> I am facing the following difficulties/questions:
> - running a normal X11 server in a container does not work because it
> would need to access some special files in /dev/, so it needs extra
> setup in the container and this scares me a bit
> - however, after installing xrdp and x2go servers in the container, I
> can successfully connect remotely with these respective protocols
> without any particular setup. I would really like to find a way to
> automatically start a X11 session at boot in same way xrdp or x2go do it
> (I would then stick with this protocol)
> 
> Has someone already done something similar? What would be your advice?
> 

Hi Yvan,

you can install whatever you want in the container and openssh-server in
addition.

>From remote Linux machine you can log in into the container and start
the application and it will appear on the remote machine.

You have to log in from the remote machine with something like this:

$ ssh -X youruser@the_ip_on_the_machine_with_the_container&

In this way you'll be able to work with the application from remote
machine and application's data will stay on the machine with the container.

I'm not sure that this is exactly what you want but it's some kind of idea.

Kind regards
Georgi

[toc] | [prev] | [next] | [standalone]

#230099 — Re: graphical session in LXC automatically started at boot and reachable via VNC/RDP/X2GO

[Multipart message — attachments visible in raw view] — view raw

Yvan Masson writes:

> Hi list,
>
> I need to run a graphical software called Noethys that also listens on some  
> TCP port. It:
> 1. needs to be reachable from the network during work hours
> 2. needs to be accessible remotely a few times per day, mainly by a Windows  
> workstation on the LAN

[...]

> I am facing the following difficulties/questions:
> - running a normal X11 server in a container does not work because it would  
> need to access some special files in /dev/, so it needs extra setup in the  
> container and this scares me a bit

I tried that unsuccessfully a few times, too. My take: Containers are not  
for virtualizing graphics. I use VMs or even more lightweight things like  
`firejail` or `chroot` for "normal X11 server" purposes.

> - however, after installing xrdp and x2go servers in the container, I can  
> successfully connect remotely with these respective protocols without any  
> particular setup. I would really like to find a way to automatically start a  
> X11 session at boot in same way xrdp or x2go do it (I would then stick with  
> this protocol)

VNC in containers works for me :) It does pretty much work as you described,  
i.e. starting the things automatically. I currently use a script [1], but  
had I known before that systemd supports containers, I would have possibly  
chosen to run it inside the container for service management (avoids writing  
one's own logic to detect stopped services etc.).

> Has someone already done something similar? What would be your advice?

Yes, see [1]. I did it in Docker (i.e. not LXC) and it seems to work just  
fine. Some ideas:

 * Make sure to consider software upgrades for the containers. I do some sort
   of peridoic unattended-upgrades _inside_ the container [2], but "best practice"
   would suggest to re-create the containers all of the time (to have them
   mostly stateless, that is).

 * Consider encrypting your VNC/X11 traffic. SSH was already suggested in the
   thread and is newly officially available for Windows clients, too!

[1] https://github.com/m7a/lo-megasync/blob/master/megasync_ctrl.sh

[2] https://masysma.lima-city.de/32/trivial_automatic_update.xhtml

[...]

HTH
Linux-Fan

öö

[toc] | [prev] | [next] | [standalone]

#230143 — Re: graphical session in LXC automatically started at boot and reachable via VNC/RDP/X2GO

Le 30/12/2020 à 00:11, Linux-Fan a écrit :
> Yvan Masson writes:
> 
>> Hi list,
>>
>> I need to run a graphical software called Noethys that also listens on 
>> some TCP port. It:
>> 1. needs to be reachable from the network during work hours
>> 2. needs to be accessible remotely a few times per day, mainly by a 
>> Windows workstation on the LAN
> 
> [...]
> 
>> I am facing the following difficulties/questions:
>> - running a normal X11 server in a container does not work because it 
>> would need to access some special files in /dev/, so it needs extra 
>> setup in the container and this scares me a bit
> 
> I tried that unsuccessfully a few times, too. My take: Containers are 
> not for virtualizing graphics. I use VMs or even more lightweight things 
> like `firejail` or `chroot` for "normal X11 server" purposes.
> 
>> - however, after installing xrdp and x2go servers in the container, I 
>> can successfully connect remotely with these respective protocols 
>> without any particular setup. I would really like to find a way to 
>> automatically start a X11 session at boot in same way xrdp or x2go do 
>> it (I would then stick with this protocol)
> 
> VNC in containers works for me :) It does pretty much work as you 
> described, i.e. starting the things automatically. I currently use a 
> script [1], but had I known before that systemd supports containers, I 
> would have possibly chosen to run it inside the container for service 
> management (avoids writing one's own logic to detect stopped services 
> etc.).
> 
>> Has someone already done something similar? What would be your advice?
> 
> Yes, see [1]. I did it in Docker (i.e. not LXC) and it seems to work 
> just fine. Some ideas:
> 
> * Make sure to consider software upgrades for the containers. I do some 
> sort
>    of peridoic unattended-upgrades _inside_ the container [2], but "best 
> practice"
>    would suggest to re-create the containers all of the time (to have them
>    mostly stateless, that is).
> 
> * Consider encrypting your VNC/X11 traffic. SSH was already suggested in 
> the
>    thread and is newly officially available for Windows clients, too!
> 
> [1] https://github.com/m7a/lo-megasync/blob/master/megasync_ctrl.sh
> 
> [2] https://masysma.lima-city.de/32/trivial_automatic_update.xhtml
> 
> [...]
> 
> HTH
> Linux-Fan
> 
> öö

Thanks for your answers!

I did a few tests, it is indeed not straightforward to run X11 in a LXC 
container… Indeed, applying security updates in the container is mandatory.

What I did not understand from your answers (sorry maybe I missed 
something) is how to start the graphical session automatically when the 
container starts, so that the software can be started and listening on 
the network, and then later someone can attach to this session with 
VNC/RDP/X2GO. It seems your script Linux-Fan starts a VNC server, but 
does it start a session in it?

[toc] | [prev] | [next] | [standalone]

#230150 — Re: graphical session in LXC automatically started at boot and reachable via VNC/RDP/X2GO

[Multipart message — attachments visible in raw view] — view raw

Yvan Masson writes:

[...]

> What I did not understand from your answers (sorry maybe I missed something)  
> is how to start the graphical session automatically when the container  
> starts, so that the software can be started and listening on the network,  
> and then later someone can attach to this session with VNC/RDP/X2GO. It  
> seems your script Linux-Fan starts a VNC server, but does it start a session  
> in it?

I did not mention it explicitly, because with the VNC server I am using  
(`tightvncserver`) does this automatically.

The trick most important steps are as follows:

 * Prepare a configuration for the session of interest to start, I have these
   lines in my "Dockerfile" (i.e. image preparation stage):

	echo \$vncStartup = \"exec /usr/bin/icewm\" > $HOME/.vncrc; \
	[...]
	printf "%s\n\n%s\n" "#!/bin/sh -e" "/usr/bin/megasync &" \
						> /etc/X11/icewm/startup; \

   This way, it configures `icewm` to be the window manager to use and
   uses IceWM's autorun facility to start my program of interest (`megasync`).

 * In the container's startup script, run the VNC server.

	/usr/bin/vncserver -geometry 1024x768 :0

   This will start `icewm` (as configured in `.vncrc`) which (by configuration
   in `/etc/X11/icewm/startup`) runs `megasync`.

   See also: vncserver(1) --
   https://manpages.debian.org/buster/tightvncserver/tightvncserver.1.en.html

 * To automatically start the container upon OS boot, I use Docker's
   `--restart=unless-stopped`. This will be different for LXC of course!

 * For the gory details of setting passwords, making the right files
   executable or resuming from "crashed" sesions (i.e. delete temp files)
   check the respective source codes:

   https://github.com/m7a/lo-megasync/blob/master/megasync_ctrl.sh
   https://github.com/m7a/lo-megasync/blob/master/Dockerfile

HTH
Linux-Fan

öö

[toc] | [prev] | [next] | [standalone]

#230153 — Re: graphical session in LXC automatically started at boot and reachable via VNC/RDP/X2GO

Le 30/12/2020 à 23:46, Linux-Fan a écrit :
> Yvan Masson writes:
> 
> [...]
> 
>> What I did not understand from your answers (sorry maybe I missed 
>> something) is how to start the graphical session automatically when 
>> the container starts, so that the software can be started and 
>> listening on the network, and then later someone can attach to this 
>> session with VNC/RDP/X2GO. It seems your script Linux-Fan starts a VNC 
>> server, but does it start a session in it?
> 
> I did not mention it explicitly, because with the VNC server I am using 
> (`tightvncserver`) does this automatically.
> 
> The trick most important steps are as follows:
> 
> * Prepare a configuration for the session of interest to start, I have 
> these
>    lines in my "Dockerfile" (i.e. image preparation stage):
> 
>      echo \$vncStartup = \"exec /usr/bin/icewm\" > $HOME/.vncrc; \
>      [...]
>      printf "%s\n\n%s\n" "#!/bin/sh -e" "/usr/bin/megasync &" \
>                          > /etc/X11/icewm/startup; \
> 
>    This way, it configures `icewm` to be the window manager to use and
>    uses IceWM's autorun facility to start my program of interest 
> (`megasync`).
> 
> * In the container's startup script, run the VNC server.
> 
>      /usr/bin/vncserver -geometry 1024x768 :0
> 
>    This will start `icewm` (as configured in `.vncrc`) which (by 
> configuration
>    in `/etc/X11/icewm/startup`) runs `megasync`.
> 
>    See also: vncserver(1) --
>    
> https://manpages.debian.org/buster/tightvncserver/tightvncserver.1.en.html
> 
> * To automatically start the container upon OS boot, I use Docker's
>    `--restart=unless-stopped`. This will be different for LXC of course!
> 
> * For the gory details of setting passwords, making the right files
>    executable or resuming from "crashed" sesions (i.e. delete temp files)
>    check the respective source codes:
> 
>    https://github.com/m7a/lo-megasync/blob/master/megasync_ctrl.sh
>    https://github.com/m7a/lo-megasync/blob/master/Dockerfile
> 
Thanks for the detailed explanations, this looks perfect! The command 
`vncserver` was exactly what I could not find with xrdp and x2go. 
Unfortunately I do not have time to test this solution today.

I glanced over /etc/vnc.conf and it seems communication can be easily 
secured with self-signed X509 certificate: this might be simpler to 
setup than SSH tunneling, especially with a Windows client. Has someone 
already tried that? Anyway, I will let you know.

Regards,
Yvan

[toc] | [prev] | [next] | [standalone]

#230159 — Re: graphical session in LXC automatically started at boot and reachable via VNC/RDP/X2GO

[Multipart message — attachments visible in raw view] — view raw

Yvan Masson writes:

[...]

> I glanced over /etc/vnc.conf and it seems communication can be easily  
> secured with self-signed X509 certificate: this might be simpler to setup  
> than SSH tunneling, especially with a Windows client. Has someone already  
> tried that? Anyway, I will let you know.

I do not have any personal experience with the X509 certificates in the case  
of VNC. From my experience, TLS is more difficult to configure than SSH,  
mostly because of (1) the necessity for a PKI and (2) time-based certificate  
expiration by default. The other point is the more difficult process of  
generating all the necessary files (host certificate). The manpage for  
`vnc.conf` seems to indicate that this is automated for the VNC usage to  
some extent -- possibly worth trying :)

My cheatsheet for openssl commands to prepare all the necessary TLS keys  
(for stunnel, but VNC may be similar) is here:
https://masysma.lima-city.de/37/dashboards_with_docker.xhtml

At a glance, the `vnc.conf` manpage does not hint towards private-key-based  
client authentication, whereas SSH private key files serve this purpose.

The new SSH client on Windows is straight-forward to configure:  
Just store the id_rsa file and configure the Windows equivalent of "chmod  
600" for it. Afterwards, use command `ssh` (or optionally
%USERPROFILE%/.ssh/config) as you would on Linux.

HTH and YMMV
Linux-Fan

öö

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web