Can someone please explain this weird behaviour to me:I have an unpriviliged LXC container with firefox inside. If firefox is running on the host outside of the container, /usr/bin/firefox inside the container launches a new firefox window outside on the host with the UID of the host user.If firefox is NOT running outside of the container, /usr/bin/firefox inside the container launches firefox with the (SUB)UID of the container user like it should be.The reverse is also true:If firefox is running inside the container (but not on the host), and firefox is started on the host, the firefox which is started has the UID of the container user.?!?! How is that ?!?!EDIT: Confirmed that the same issue emerges when using a default unprivileged Ubuntu container with default configuration file.EDIT: asked the same question in the arch forums https://bbs.archlinux.org/viewtopic.php?pid=1622174#p1622174config file:lxc.devttydir = lxc lxc.pts = 1024lxc.tty = 4 lxc.cap.drop = mac_admin mac_override sys_time sys_modulelxc.pivotdir = lxc_putoldlxc.hook.clone = /usr/share/lxc/hooks/clonehostnamelxc.cgroup.devices.deny = a lxc.cgroup.devices.allow = c *:* mlxc.cgroup.devices.allow = b *:* mlxc.cgroup.devices.allow = c 1:3 rwm lxc.cgroup.devices.allow = c 1:5 rwm lxc.cgroup.devices.allow = c 1:7 rwm lxc.cgroup.devices.allow = c 5:0 rwm lxc.cgroup.devices.allow = c 5:1 rwm lxc.cgroup.devices.allow = c 5:2 rwm lxc.cgroup.devices.allow = c 1:8 rwm lxc.cgroup.devices.allow = c 1:9 rwm lxc.cgroup.devices.allow = c 136:* rwm lxc.cgroup.devices.allow = c 10:229 rwm lxc.mount.auto = cgroup:mixed proc:mixed sys:mixedlxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections   none bind,optional 0 0 lxc.seccomp = /usr/share/lxc/config/common.seccomplxc.hook.mount = /usr/share/lxcfs/lxc.mount.hooklxc.hook.post-stop = /usr/share/lxcfs/lxc.reboot.hooklxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0 lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0 lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0 lxc.mount.entry = mqueue dev/mqueue mqueue rw,relatime,create=dir,optional 0 0 lxc.cgroup.devices.allow = c 254:0 rmlxc.cgroup.devices.allow = c 10:200 rwm lxc.cgroup.devices.allow = c 10:228 rwm lxc.cgroup.devices.allow = c 10:232 rwm lxc.cgroup.devices.deny =lxc.cgroup.devices.allow =lxc.devttydir =lxc.mount.entry = /dev/console dev/console none bind,create=file 0 0 lxc.mount.entry = /dev/full dev/full none bind,create=file 0 0 lxc.mount.entry = /dev/null dev/null none bind,create=file 0 0 lxc.mount.entry = /dev/random dev/random none bind,create=file 0 0 lxc.mount.entry = /dev/tty dev/tty none bind,create=file 0 0 lxc.mount.entry = /dev/urandom dev/urandom none bind,create=file 0 0 lxc.mount.entry = /dev/zero dev/zero none bind,create=file 0 0 lxc.mount.entry = /sys/firmware/efi/efivars sys/firmware/efi/efivars  none bind,optional 0 0 lxc.mount.entry = /proc/sys/fs/binfmt_misc proc/sys/fs/binfmt_misc none bind,optional 0 0 lxc.arch = x86_64lxc.cgroup.devices.allow = c 226:* rwm lxc.mount.entry = tmpfs tmp tmpfs defaultslxc.mount.entry = /dev/dri dev/dri none bind,optional,create=dirlxc.mount.entry = /tmp/.X11-unix tmp/.X11-unix none ro,bind,create=dir 0 0The container is started like this:lxc-start -n c1 -F -f /path/to/above/conf -s 'lxc.id_map = u 0 100000 65536' -s 'lxc.id_map = g 0 100000 65536' -s 'lxc.rootfs = /path/to/rootfs' -s 'lxc.init_cmd = /usr/bin/bash'EDIT: Distribution Arch Linux$ uname -r4.6.0-rc4-customGIT+# lxc-checkconfig--- Namespaces ---Namespaces: enabledUtsname namespace: enabledIpc namespace: enabledPid namespace: enabledUser namespace: enabledNetwork namespace: enabledMultiple /dev/pts instances: enabled--- Control groups ---Cgroup: enabledCgroup clone_children flag: enabledCgroup device: enabledCgroup sched: enabledCgroup cpu account: enabledCgroup memory controller: enabledCgroup cpuset: enabled--- Misc ---Veth pair device: enabledMacvlan: enabledVlan: enabledBridges: enabledAdvanced netfilter: enabledCONFIG_NF_NAT_IPV4: enabledCONFIG_NF_NAT_IPV6: enabledCONFIG_IP_NF_TARGET_MASQUERADE: enabledCONFIG_IP6_NF_TARGET_MASQUERADE: enabledCONFIG_NETFILTER_XT_TARGET_CHECKSUM: enabledFUSE (for use with lxcfs): enabled--- Checkpoint/Restore ---checkpoint restore: enabledCONFIG_FHANDLE: enabledCONFIG_EVENTFD: enabledCONFIG_EPOLL: enabledCONFIG_UNIX_DIAG: enabledCONFIG_INET_DIAG: enabledCONFIG_PACKET_DIAG: enabledCONFIG_NETLINK_DIAG: enabledFile capabilities: enabled
What makes firefox inside a container launch a new firefox window outside on the host with the UID of the host user? Isn't it weird for an LXC?
firefox;lxc;userns