I am using GitLab CI to run automated tests on an Ubuntu 14.04 setup. The GitLab CI runner created a new user, gitlab-runner, which executes all the tests. Now these tests include GUI components, so I need an X display - which I force on even without a physical display via the ConnectedMonitor and CustomEDID options in the xorg.conf.

The problem is that when a test is started by the user gitlab-runner via DISPLAY=:0.0 ./runTestApp, I get a "Could not connect to display :0.0" error. I can fix it by logging in as a regular user on the workstation and run sudo DISPLAY=:0.0 xhost +.


  1. I haven't found a way to successfully automatically run xhost + on startup (tried putting it in /etc/rc.local)
  2. The man page says that xhost + is actually very insecure, but I haven't found out what to do instead. It feels like it might have to do with an .Xauthority file (which my regular user has, but gitlab-runner doesn't)

What's the best way to give gitlab-runner permanent access to the X display?

  • you may also be interested by not using the server on the physical display at all. see my edited answer.
    – meuh
    Jul 31, 2015 at 12:12

2 Answers 2


First, to give access only to the Gitlab CI runner, you need to use a more restricted command:

xhost +SI:localuser:gitlab-runner

Second, /etc/rc.local runs way too early for this command to have effect, and further, you need to set $DISPLAY for it to work.

It depends on how your X server is being started. If you're using LightDM, I think you can make it work by adding the following line to /etc/lightdm/lightdm.conf:

greeter-setup-script=xhost +SI:localuser:gitlab-runner
  • 2
    Your suggestion basically worked, but greeter-setup-script didn't do it, I ended up using session-setup-script=/var/opt/xhost-access.sh, where the content of that file is DISPLAY=:0.0 xhost +SI:localuser:gitlab-runner.
    – pholz
    Jul 31, 2015 at 11:46

If you do a ps alxww|grep X you should see that your X server is running with the option -auth followed by some filename. This file holds a random number called the MIT-MAGIC-COOKIE-1. Only X11 clients that can present this number to the X11 server in the protocol startup are allowed to connect. Apps run by the same user who started the server will find the cookie value in the ~/.Xauthority file, which is normally not readable by others.

You can either remove the -auth option from the launch of the server, by looking in the config of whatever xdm, gdm etc startup mechanism you use, or you can copy the cookie from the login user to your other user, or you can give them read access to the .Xauthority file.

Eg to copy the cookie, as user pholz:

xauth list :0 >/tmp/toadd
chmod a+r /tmp/toadd

and as user gitlab-runner:

xauth add $(</tmp/toadd)

Or to allow read access:

chmod a+r /home/pholz/.Xauthority
chmod a+rx /home/pholz/

and then in the gitlab-runner environment set:

export XAUTHORITY=/home/pholz/.Xauthority

Of course, if you dont really need a display, you can launch a separate X11 server which displays into memory, and is completely independent of any user login and screen. You need only do:

sudo apt-get install xvfb
Xvfb :1 -noreset &
export DISPLAY=:1

Then all your apps will display into this virtual framebuffer. If you want to check what's on the screen you can use screen dumps, remote desktops, or Xnest.

  • Excellent answer. This is what you'd do without xhost though, that tool does the job best.
    – phil294
    May 13, 2018 at 4:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.