GoKawiil2026-08-02
Sharing an X Server Across Hosts with FamilyWild
Ever tried running an X11 application from inside a container, a chroot, or over ssh with a bind-mounted .Xauthority — only to be greeted by the ever-helpful Authorization required, but no authorization protocol specified ?
The file is right there, mounted read-only where the client expects it, and yet X refuses the connection. The reason is subtle, and the fix is a single line of sed .
Why the cookie is rejected
An .Xauthority file is a list of cookies, and every entry is keyed by a family and a hostname. When a client connects, it doesn't just grab the first cookie it finds — it looks for the entry whose hostname matches the machine the client believes it's running on.
That's exactly what breaks the moment the client runs somewhere other than where the cookie was minted. Inside a container the hostname is different; over an un-forwarded socket the client resolves a different name entirely. The cookie is present and valid, but its hostname doesn't match, so the client never offers it and X falls back to "no authorization protocol."
You can see the family/hostname keying for yourself:
$ xauth list myhost/unix:0 MIT-MAGIC-COOKIE-1 a1b2c3d4e5f6...
That leading myhost/unix:0 is the problem — it pins the cookie to myhost .
... continue reading