How to run GUI applications directly in containers (opens in new tab)

To me flatpack looks like a way achieve application compatibility not security

I personally think that flatpak is not the end of history and we should continue to experiment with different approaches.

I think it may add a bit of security, but containers are better thought of as mechanism to deploy and manage applications/services.

They can be useful as part of a security posture, but you kinda have to wrap everything up in SELinux or as part of some other system. Which is a lot easier to do with containers then it is to do with normal applications.

Also for most purposes:

If you want to integrate container applications into your desktop you'd be better off with something like Flatpak or distrobox/toolbx.

there are lots of things that these applications do to setup the environment and integrate into your home directory that isn't going to be done with simple scripts like this.

That doesn't mean that these scripts are useless, of course. I you want to run a application with more isolation and less integration then it is a lot easier to do it this way then with something like distrobox.

Like if you don't want to give a application access to your home directory. Or want to emulate a container environment for the cloud locally so you can hack on it.

Only benefit I can see here is the separation of the filesystems, but there are easier and simpler ways than docker to do that.

But the core technologies underlying containers: Namespaces, cgroups, POSIX Capabilties, and SELinux. "Should" provide a level of isolation equivalent to a virtual machine[1].

If you're using a decent container platform like Podman, you should feel relatively good about the application's security and isolation.

[1] https://www.redhat.com/en/blog/how-selinux-separates-contain...

> When you start a container instance, all you need to do is map the host's Wayland socket and PipeWire socket files into the container, and then set the appropriate environment variables within the container to enable running GUI applications.

Haven’t stuck around so I don’t know if VNC is still common to use locally on Android when you want to run other Linux distros with graphical environments on your device.

It worked but having to rely on VNC for something that is local on the same machine never felt great to me. Same when I VNC into a VM on the same host. It just feels a bit wrong to me to have to use VNC. It works and I do it sometimes for VMs on my computer, but I don’t like it.

The cool people do things like PCI passthrough. But I don’t have an extra graphics card and I haven’t looked much at the details of PCI passthrough anyways. Seems like a lot of effort also.

I do like X11 forwarding. I don’t know what to do for Wayland when it’s a VM.