Running Ubuntu MATE inside Docker container by x11docker with GUI

Norbert_X · 2 January 2021 09:07

Introduction

An alternative for virtual machine is a Docker container.
Containers are usually running without GUI.
To get GUI one can utilize the famous and well-designed x11docker project.
It already has pre-configured container with MATE desktop, which is based on Debian Buster. And what is interesting - such image has 10K+ downloads and is most popular variant.

Below is the method of using x11docker to run Ubuntu MATE.

Quick start

To run Ubuntu MATE with x11docker one should follow the following steps:

Install Docker

# to remove previously installed Docker, uncomment next line
# sudo apt-get remove docker docker-engine docker.io containerd runc

sudo apt-get update
sudo apt-get install apt-transport-https ca-certificates curl gnupg lsb-release
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu \
$(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
sudo apt-get install docker-ce docker-ce-cli containerd.io

Install dependencies

sudo apt-get install git xserver-xephyr

Add current user to the docker group
```
sudo usermod -a -G docker $USER
```
then reboot machine.

Prepare folder for Docker repository

mkdir ~/Docker
cd ~/Docker
git clone https://github.com/N0rbert/dockerfile-x11docker-ubuntu-mate.git
cd dockerfile-x11docker-ubuntu-mate

wget https://raw.githubusercontent.com/mviereck/x11docker/master/x11docker
chmod +x x11docker
sudo mv x11docker /usr/local/bin/x11docker

Build default Ubuntu MATE 20.04 LTS image locally

docker build ~/Docker/dockerfile-x11docker-ubuntu-mate -t ubuntu-mate:focal

Run Docker container with Ubuntu MATE
- minimal, using default settings
```
x11docker --desktop ubuntu-mate:focal
```
- more functional, using extra options
```
x11docker --desktop ubuntu-mate:focal --sudouser --dbus --home --share ~/Public --clipboard --pulseaudio  --xtest --init=systemd
```
  where options are the following:
  - --sudouser – allows running commands with sudo and password is x11docker;
  - --dbus – DBUS session bus for desktop and other applications;
  - --home – creates a host directory in ~/.local/share/x11docker/IMAGENAME that is shared with the container and mounted as its HOME directory;
  - --share ~/Public – share folder between host system and container;
  - --clipboard – share clipboard;
  - --pulseaudio – share audio;
  - --xtest – use XTest X11 extension (needed for Onboard);
  - --init=systemd – use systemd as init system inside container.
    
    Other options are available in x11docker --help output.
    The result will look like shown below:
    
    um2004-docker1266×701 168 KB
One can run almost any preinstalled application in the opened graphical MATE session or install any other by using APT.

Advanced usage

Advanced usage allows one to build and run any supported Ubuntu MATE version inside Docker container with X11.

To build the container use:

Ubuntu 18.04 LTS (bionic)

export VER=bionic; docker build --build-arg "VER=$VER" ~/Docker/dockerfile-x11docker-ubuntu-mate -t ubuntu-mate:$VER

Ubuntu 20.04 LTS (focal, default)

export VER=focal; docker build --build-arg "VER=$VER" ~/Docker/dockerfile-x11docker-ubuntu-mate -t ubuntu-mate:$VER

Ubuntu 20.10 (groovy)

export VER=groovy; docker build --build-arg "VER=$VER" ~/Docker/dockerfile-x11docker-ubuntu-mate -t ubuntu-mate:$VER

Ubuntu 21.04 (hirsute)

export VER=hirsute; docker build --build-arg "VER=$VER" ~/Docker/dockerfile-x11docker-ubuntu-mate -t ubuntu-mate:$VER

Ubuntu 21.10 (impish)

export VER=impish; docker build --build-arg "VER=$VER" ~/Docker/dockerfile-x11docker-ubuntu-mate -t ubuntu-mate:$VER

upcoming Ubuntu 22.04 LTS (jammy)

export VER=jammy; docker build --build-arg "VER=$VER" ~/Docker/dockerfile-x11docker-ubuntu-mate -t ubuntu-mate:$VER

Note: if you have a Squid Deb Proxy in your local network, then you can use it by adding additional argument --build-arg http_proxy=http://192.168.3.222:8000 (change proxy server IP and port to yours).

To run the container from the same terminal use:

x11docker --desktop ubuntu-mate:$VER --sudouser --dbus --home --share ~/Public --clipboard --pulseaudio  --xtest --init=systemd

or explicitly specify needed version by replacing $VER variable with actual version as shown below:

x11docker --desktop ubuntu-mate:hirsute --sudouser --dbus --home --share ~/Public --clipboard --pulseaudio  --xtest --init=systemd

Notes about legacy versions

For some purposes one may need to run Ubuntu MATE versions like 12.04 LTS, 14.04 LTS and 16.04 LTS inside Docker container without systemd.

Building and run commands are below:

Ubuntu 12.04 LTS (precise)

export VER=precise; docker build --build-arg "VER=$VER" ~/Docker/dockerfile-x11docker-ubuntu-mate -t ubuntu-mate:$VER
x11docker --desktop ubuntu-mate:precise --sudouser --dbus --home --share ~/Public --clipboard --pulseaudio --xtest --runasroot 'chmod 0440 /etc/sudoers'

Ubuntu 14.04 LTS (trusty)

export VER=trusty; docker build --build-arg "VER=$VER" ~/Docker/dockerfile-x11docker-ubuntu-mate -t ubuntu-mate:$VER
x11docker --desktop ubuntu-mate:trusty --sudouser --dbus --home --share ~/Public --clipboard --pulseaudio --xtest

Ubuntu 16.04 LTS (xenial)

export VER=xenial; docker build --build-arg "VER=$VER" ~/Docker/dockerfile-x11docker-ubuntu-mate -t ubuntu-mate:$VER
x11docker --desktop ubuntu-mate:xenial --sudouser --dbus --home --share ~/Public --clipboard --pulseaudio --xtest

Above will give one opportunity to learn the history of Ubuntu MATE.

Conclusion

This gives almost unlimited possibilities for experiments.
But remember, that container is reseted on every launch, only data in shared folder stays saved.

Notes and limitations:

MATE Screensaver is removed from all images.
Both Snap and FlatPak currently do not work in the containers.
Ubuntu MATE 12.04 LTS, 14.04 LTS and 16.04 LTS do not use systemd in the container.
Ubuntu MATE 18.04 LTS and 20.04 LTS do not have any workaround applied in the Dockerfile.
Ubuntu MATE 20.10 have the following workarounds: to avoid systemd lock-up acpid, acpi-support and sssd-common packages are removed;
Ubuntu MATE 21.04 have the following workarounds: to avoid systemd lock-up acpid and acpi-support packages are removed, the redshift-gtk package is removed as not functional;
Ubuntu MATE 21.10 and upcoming Ubuntu MATE 22.04 LTS have the following workarounds: to avoid systemd lock-up acpid and acpi-support packages are removed, the redshift-gtk package is removed as not functional, the container should be run with x11docker --desktop --home --share ~/Public --sudouser --dbus --clipboard --pulseaudio --xtest --init=systemd -- --security-opt seccomp=unconfined -- ubuntu-mate:impish;
Adding and removing PPAs, installing software from them is normally possible;
WINE applications run well;
Graphical applications with root (pkexec-, sudo/gksu/gksudo/kdesu/kdesudo-based) rights will not run because of isolation;
There is something wrong with docker.io package from official Ubuntu repositories - it does not allow one to build image of Ubuntu 21.04, see bug 1918021 for details;
New versions of x11docker require --home to be declared when --share includes location from host home folder.

v5Q · 14 May 2021 00:34

Please help,
Unable to find image 'x11docker:latest' locally
docker: Error response from daemon: pull access denied for x11docker, repository does not exist or may require 'docker login': denied: requested access to the resource is denied.
See 'docker run --help'.
Thank you in advance

Norbert_X · 14 May 2021 11:29

Welcome to the Ubuntu MATE community, v5Q!

It seems that you are following above guide partially. Please run steps 1 - 5 (especially 5!) again.

Lorenzo_Mueller · 23 January 2022 18:19

Thx for the detailed instruction.
Ubuntu MATE 20.04 works perfect.
But when I try this with Impish (21.10) I have no success.
I see no desktop, no panes - Only the mouse-cursor

This is the output of the console:

mate-session-check-accelerated: GL Helper exited with code 512
mate-session-check-accelerated: GLES Helper exited with code 512
Failed to spawn gnome-keyring-daemon: Failed to execute child process “gnome-keyring-daemon” (Operation not permitted)
mate-session[123]: WARNING: Could not connect to ConsoleKit: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory
mate-session[123]: WARNING: Could not connect to ConsoleKit: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory
mate-session[123]: EggSMClient-WARNING: Invalid Version string '0.9.4' in /etc/xdg/autostart/x11docker-xrandr.desktop
mate-session[123]: WARNING: Unable to find provider '' of required component 'dock'

** (mate-settings-daemon:176): WARNING **: 19:02:51.963: There was a problem when setting QT_FONT_DPI=96: Timeout was reached

** (mate-settings-daemon:176): WARNING **: 19:03:16.988: There was a problem when setting QT_SCALE_FACTOR=1: Timeout was reached

** (mate-settings-daemon:176): WARNING **: 19:03:42.437: failed to register client '10e4b91813ef3d6b33164296094687235800000001230024': Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.

** (mate-settings-daemon:176): WARNING **: 19:03:44.799: system bus not available: Could not connect: No such file or directory

** (mate-settings-daemon:176): WARNING **: 19:03:44.801: Failed to acquire NetworkManager proxy: Could not connect: No such file or directory

** (mate-settings-daemon:176): WARNING **: 19:03:44.801: Failed to acquire ModemManager proxy: Could not connect: No such file or directory

Thx

Norbert_X · 23 January 2022 20:53

Welcome to Ubuntu MATE community!

On my system I start Ubuntu MATE 21.10 x11docker by

x11docker --desktop --sudouser --dbus --clipboard --pulseaudio --xtest --init=systemd -- --security-opt seccomp=unconfined -- ubuntu-mate:impish

Lorenzo_Mueller · 28 January 2022 08:32

Thx - Works now

--security-opt seccomp=unconfined did the trick
Cheers