After some research, there are some methods to enable X11 display inside the container.

Local display

• simple guide
  somatorio.org:Running GUI apps with Docker
• detailed guide with many methods
  ROS Wiki:Docker GUI

Simple (insecure) method did not work in my (remote) environment (SSH + X11 forwarding). If yours are similar to my ones, then please try below.

Remote display with SSH forwarding (my situation)

StackOverflow by Ruben

• assuming docker host's virtual NIC has IP as 172.17.0.1. If not, change the DISPLAY variable regarding your situation.

• Let SSH daemon allow remote X11 connection (TODO insecure)
  /etc/ssh/sshd_config: X11UseLocalhost no

• Make another Xauthority file

touch /tmp/.docker.xauth
XAUTH=/tmp/.docker.xauth
xauth nlist $DISPLAY | sed -e 's/^..../ffff/' | sudo xauth -f $XAUTH nmerge -
sudo chmod 777 $XAUTH

• (I skipped configuring firewall (ufw)...)

• Run the docker container with dedicated Xauthority file, modified DISPLAY variable

sudo docker run --rm -it \
        -e LM_LICENSE_FILE="<port>@<host>" \
        -e DISPLAY=$(echo $DISPLAY | sed 's/^[^:]*\(.*\)/172.17.0.1\1/') \
        -v $XAUTH:$XAUTH -e XAUTHORITY=$XAUTH \
        synopsys_dc:N-2017.09 dc_shell -gui

hmm... is there an unified and somewhat official way?

Doc: prune

Just make as many as containers, then use cron job to cleanup remaining containers daily (or every 6 hrs.).

docker container prune --force --filter "until=$(date -d '24 hours ago' +%s)"

Recent version (N-2017.12) was okay, but I cannot run J-2014.09 version in Docker/Singularity.

• In Ubuntu 16.04 base image w/ Singularity
  • HOSTID is empty and invalid memory reference error is raised.

Using: /usr/synopsys/hspice/J-2014.09-SP2-3/hspice/amd64/hspice  -I
 lic:  
 lic: FLEXlm: v10.9.8 
 lic: USER:   *****               HOSTNAME: ***** 
 lic: HOSTID:                      PID:      19072 
 **error** invalid memory reference

 **error** invalid memory reference

1
 ******  
 

 ****** job statistics summary tnom=   0.000 temp=   0.000 ******
/usr/synopsys/hspice/J-2014.09-SP2-3/hspice/bin/hspice: line 409: 19072 Segmentation fault      (core dumped) /usr/synopsys/hspice/J-2014.09-SP2-3/hspice/amd64/hspice -I

• In Debian 8 base image w/ Docker
  • HOSTID is not empty but invalid memory reference error is still raised as before.

Using: /usr/synopsys/hspice/J-2014.09-SP2-3/hspice/amd64/hspice  -I
 lic:  
 lic: FLEXlm: v10.9.8 
 lic: USER:   root                 HOSTNAME: ***** 
 lic: HOSTID: **9**5*e*9**e         PID:      20 
 **error** invalid memory reference

 **error** invalid memory reference

1
 ******  
 

 ****** job statistics summary tnom=   0.000 temp=   0.000 ******
/usr/synopsys/hspice/J-2014.09-SP2-3/hspice/bin/hspice: line 409:    20 Segmentation fault      (core dumped) /usr/synopsys/hspice/J-2014.09-SP2-3/hspice/amd64/hspice -I

From Google search result, invalid memory reference error is normally a license issue.

Hmm.......

Singularity

• Official Website

• Application container for scientific experiments -- just for us!?

• Its internal seems similar to Docker

• Supports X11 forwarding out-of-the-box(, and GPU acceleration?)

• Can make a container image from a docker image

• Faster to initiate container than Docker

Issues?

• Each container is contained in a single file, which brings unnecessary duplicated common system files.
  • Singularity does not utilize layered container structure like Docker.
  • A storage waste from not sharing common packages installed is expected.
• Because there is no root ptiviledge in the container out-of-the-box. we cannot use apt-get (yum for Redhat) to install missing packages after building app image.

Solved issues

• Cannot convert from a docker image
  • it seems that bug was fixed in recent source code @2018.11.
  • Can load from local docker registry (w/o HTTPS) from v3.0.2 again Related issue
• It seems it still also requires root priviledges or docker priviledges, that could be a security threat...
  • It seems not right...! Singularity containers can be run without root or in docker group

Because each tool is isolated from others, integration among tools cannot be happened. :(

e.g.

• Synopsys DC/ICC + Library Compiler
• Cadence Virtuoso + Mentor Calibre

The problem is, containers can communicate each other only with port..
(Sharing tool files through (mounted) user directory seems weird...)

Is there any way to integrate among different tools regarding isolated containers? No way...

Subuser is somewhat a frontend of Docker to simplify desktop linux app packaging.

It can also handle X11 forwarding, so it is utterly desirable solution for my usecase.

Edit: it still requires root permission or docker permission (almost same as root)

# dc_shell

                           Design Compiler Graphical 
                                 DC Ultra (TM)
                                  DFTMAX (TM)
                              Power Compiler (TM)
                                 DesignWare (R)
                                 DC Expert (TM)
                               Design Vision (TM)
                               HDL Compiler (TM)
                               VHDL Compiler (TM)
                                  DFT Compiler
                               Design Compiler(R)

               Version N-2017.09-SP2 for linux64 - Nov 27, 2017 

                    Copyright (c) 1988 - 2017 Synopsys, Inc.
   This software and the associated documentation are proprietary to Synopsys,
 Inc. This software may only be used in accordance with the terms and conditions
 of a written license agreement with Synopsys, Inc. All other use, reproduction,
            or distribution of this software is strictly prohibited.
Initializing...
Warning: Cannot use command line editor for terminal type 'xterm'.  (UI-74)
4.1
dc_shell>

The warning message below is shown and keyboard inputs are not handled correctly.
Warning: Cannot use command line editor for terminal type 'xterm'. (UI-74)