Headless X11 environment backing Hermes's browser automation and any GUI tooling.
Location
Host: this container (ct460, hermes), no separate VM/LXC — headless stack runs directly alongside the agent.
Display:Xvfb :99, resolution 1600x1200x24, started with -ac -nolisten tcp
Current configuration (verified via ps aux, 2026-07-22)
Process
Detail
Xvfb
:99 -screen 0 1600x1200x24 -ac -nolisten tcp
fluxbox
window manager on :99
x11vnc
-display :99 -forever -shared -rfbport 5901 -rfbportv6 5901 -noxdamage -quiet -nopw — no VNC password set
websockify×2
127.0.0.1:6080 → 127.0.0.1:5900 and 127.0.0.1:6081 → 127.0.0.1:5901, serving noVNC (/usr/share/novnc)
Two VNC/websockify pairs exist (5900/6080 and 5901/6081) — the second (:99→5901→6081) is the one confirmed above; the first (5900→6080) predates it and wasn't independently re-verified this pass — unresolved whether it's a second live display or a leftover process.
x11vnc -nopw: VNC is unauthenticated. It's bound to all interfaces (0.0.0.0:5901 and [::]:5901), not just loopback — reachable from the LAN and, if any tunnel/firewall rule forwards it, potentially beyond. Worth restricting to loopback or adding -passwd/-rfbauth if this hasn't been a deliberate choice.
