--- title: Sharing an X Server Across Hosts with FamilyWild ·... description: When running X11 applications inside containers, chroots, or over SSH with a bind-mounted .Xauthority file, connections fail because X cookies are keyed to a... canonical: https://daily.dev/posts/sharing-an-x-server-across-hosts-with-familywild-dobrowolski-dev-k7gdcbude twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Sharing an X Server Across Hosts with FamilyWild · dobrowolski.dev | daily.dev og:description: When running X11 applications inside containers, chroots, or over SSH with a bind-mounted .Xauthority file, connections fail because X cookies are keyed to a... og:url: https://daily.dev/posts/sharing-an-x-server-across-hosts-with-familywild-dobrowolski-dev-k7gdcbude og:image: https://api.daily.dev/og/posts/k7gDCbUDE.png og:image:alt: Sharing an X Server Across Hosts with FamilyWild · dobrowolski.dev og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Sharing an X Server Across Hosts with FamilyWild · dobrowolski.dev **[Hacker News](https://daily.dev/sources/hn)** · 4 min read · 0 upvotes · 0 comments ## Summary When running X11 applications inside containers, chroots, or over SSH with a bind-mounted .Xauthority file, connections fail because X cookies are keyed to a specific hostname. The fix is to rewrite the cookie's family field to FamilyWild (0xffff) using a single sed command on the output of `xauth nlist`, producing a portable .Xauthority file that matches any hostname while still requiring the secret cookie. This is safer than `xhost +`, which disables access control entirely and exposes the display to any client without authentication. The caveat is that anyone who can reach the X socket and read the FamilyWild file can connect, so the file should be kept at 0600 and shared only with environments that need it. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community take How the wider developer community reacted, aggregated from 1 discussion and 26 comments across hackernews (as of 2026-08-03). **TL;DR:** The discussion is a technical deep-dive into X11 networking, security trade-offs of xhost, and performance differences between X11 over TCP vs. SSH forwarding, with commenters sharing practical experiences and nuanced corrections to the article's claims. **Sentiment:** 30% positive · 50% mixed · 20% skeptical **The case for** - X11 over TCP (especially via Wireguard) can be indistinguishable from local in a LAN and is significantly faster than SSH X11 forwarding. - xhost +si:localuser:jack offers a more granular access control option that the article apparently overlooked. - Running X11 open on a network can be a fun and useful 'shared display' setup for control-room-style use cases. **The pushback** - The article's security warnings about TCP may be overstated since modern Xorg doesn't enable TCP by default and the socket can be permission-restricted. - The article omits the more targeted xhost +si:localuser: syntax, making its security discussion incomplete. - X11 over the open internet has poor UX due to latency, and NX/X2Go tooling for compression tunneling is poorly documented for the single-app remote client use case. **By community** - hackernews (mixed): Commenters engage technically and critically, correcting omissions in the article's security advice and debating X11 TCP performance vs. SSH forwarding, with mostly constructive but skeptical tones. **Hottest debate:** Whether xhost + is ever practically acceptable given that modern Xorg doesn't expose TCP by default and socket permissions can restrict local access. **Open questions** - Can you simply chmod o-rwx the X11 socket as a simpler alternative to xauth/xhost configurations? - Is nxproxy alone sufficient for compressed remote X11 client tunneling, or does it require the full X2Go/FreeNX stack? - Does OpenSSH's keystroke timing obfuscation actually impact X11 forwarding performance, or only interactive TTY sessions? **Highlights** > > xhost + hands that capability to every local user and, if your server listens on TCP, to the network. Even the narrower xhost +local: still trusts every UID on the box. I'm not defending xhost or advocating to use it but... If you mention narrower version of xhost, then why stop at: xhost +local: and not mention that you can do: xhost +si:localuser:jack As an intriguing unrelated sidenote you can do: xhost +si:localuser:jack open an app, then do: xhost -si:localuser:jack and then user jack cannot, except through the app already launched, display on the X server. > — [TacticalCoder on hackernews](https://news.ycombinator.com/item?id=49148649) > If I understand the code correctly, OpenSSH only injects delays and chaff when you're actively typing data through an interactive session directly to the ssh client itself (i.e. it's reading your key strokes from the TTY, as opposed to keystrokes being sent as opaque data over the X11 channel). There would be no disruption to X11 forwarding while you're not actively typing, and even then there's no delay if it can bundle key presses with non-interactive data. See https://github.com/openssh/openssh-portable/blob/088ca00/cli... For a full desktop session, X11 over TCP should be much faster just because each X11 client app has it's own TCP connection, whereas for SSH X11 forwarding every app is tunneled over a single TCP connection. > — [wahern on hackernews · 1 comments](https://news.ycombinator.com/item?id=49149918) > > You'll often see xhost + suggested as the "just make it work" answer, and it does — by turning host-based access control off entirely. Every client from every host can then connect to your display without any cookie at all. > On a single-user machine that sounds harmless, but X has no isolation between clients: anyone who can reach the server can read your keystrokes, grab the contents of any window, and inject synthetic input. xhost + hands that capability to every local user and, if your server listens on TCP, to the network. Even the narrower xhost +local: still trusts every UID on the box. Does modern Xorg even support TCP? I know it doesn't default to allowing it, and the last time I actually wanted to run X11 over the network I ended up using socat against the socket file. Controlling access by user could have some value, but only under very specific threat models, especially since containers won't be able to reach the socket unless you give it to them on purpose. (Actually, can you just chmod o-rwx the socket?) So I'm really skeptical of ever practically needing a more complicated fix when you can just xhost + > — [yjftsjthsd-h on hackernews · 4 comments](https://news.ycombinator.com/item?id=49148711) > > Does modern Xorg even support TCP? Yes. It works well. X11 over Wireguard works so much better than ssh -X. Haven't tried over the internet, but in a LAN you can't tell the difference between local and remote windows, at least with Emacs. > — [jolmg on hackernews · 1 comments](https://news.ycombinator.com/item?id=49149365) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49147978) · 35 points · 26 comments ## Similar posts on daily.dev - [Docker Desktop Linux X11 Forwarding from Container to Host](https://daily.dev/posts/docker-desktop-linux-x11-forwarding-from-container-to-host-deokwlytb) · No Dogma Blog \(Bryan Hogan\) · 0 upvotes · 0 comments - [I gave my home lab hostnames and domain names, and now I never think about IP addresses again](https://daily.dev/posts/i-gave-my-home-lab-hostnames-and-domain-names-and-now-i-never-think-about-ip-addresses-again-dri9pdqbi) · XDA Developers · 0 upvotes · 0 comments - [Playwright \+ Proxies: Sticky Sessions, Rotation, and the SOCKS5 Trap](https://daily.dev/posts/playwright-proxies-sticky-sessions-rotation-and-the-socks5-trap-6zfiw0auw) · Medium · 0 upvotes · 0 comments - [Holiday Hack 2025: Neighborhood Watch Bypass](https://daily.dev/posts/holiday-hack-2025-neighborhood-watch-bypass-r0nixdqgw) · 0xdf hacks stuff · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#containers](https://daily.dev/tags/containers) [View this post on daily.dev](https://daily.dev/posts/sharing-an-x-server-across-hosts-with-familywild-dobrowolski-dev-k7gdcbude) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Sharing an X Server Across Hosts with FamilyWild · dobrowolski.dev","url":"https://daily.dev/posts/sharing-an-x-server-across-hosts-with-familywild-dobrowolski-dev-k7gdcbude","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/sharing-an-x-server-across-hosts-with-familywild-dobrowolski-dev-k7gdcbude"},"datePublished":"2026-08-03T01:26:06.778Z","dateModified":"2026-08-03T15:31:20.003Z","description":"When running X11 applications inside containers, chroots, or over SSH with a bind-mounted .Xauthority file, connections fail because X cookies are keyed to a...","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/sharing-an-x-server-across-hosts-with-familywild-dobrowolski-dev-k7gdcbude","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux,containers","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Sharing an X Server Across Hosts with FamilyWild · dobrowolski.dev"}]} ```