ишь
0
One solution to the risks of X forwarding over ssh discussed in the other answers would be to use what might be called a masquerade X server, which is not really an X server but presents an pseudo X interface and a pseudo X screen to the client software on the container, while passing some X work off to the real X server behind it. The pseudo X screen is displayed as a single X window on the host actual X desktop.
Even though it wasn't intended as a security tool, Xephyr does fit that description.
For that reason I wrote a javascript program to create an lxd/lxc container from a vanilla ubuntu image, and populate it with firefox, openvpn, Xephyr, and pusleaudio.
https://github.com/craigphicks/browser-on-lxc-vpn-xephyrhttps://www.npmjs.com/package/browser-on-lxc-vpn-xephyrI wouldn't make any strong security claims about - it was a proof of concept exercise.