What is `/tmp/.X11-unix/`?

On my fairly up-to-date Arch laptop, /tmp/.X11-unix/ is a directory with one entry: X0, a Unix-domain socket.

The X11 server (usuall Xorg these days) communicates with clients like xterm, firefox, etc via some kind of reliable stream of bytes. A Unix domain socket is probably a bit more secure than a TCP socket open to the world, and probably a bit faster, as the kernel does it all, and does not have to rely on an ethernet or wireless card.

My X11 server shows up as:

bediger    294   293  0 Apr09 tty1     01:23:26 /usr/lib/xorg-server/Xorg -nolisten tcp :0 vt1 -auth /tmp/serverauth.aK3Lrv5hMV

The "-nolisten tcp" keeps it from opening TCP port 6000 for communications.

The command lsof -U can tell you what processes are using which Unix domain sockets. I see Xorg as connected to /tmp/.X11-unix/X0.

The X server has several ways of communicating with X clients (apps). The most common one to use, at least on the same machine, is a Unix-domain socket.

A Unix-domain socket is like the more familiar TCP ones, except that instead of connecting to an address and port, you connect to a path. You use an actual file (a socket file) to connect.

The X server puts its socket in /tmp/.X11-unix:

$ ls -l /tmp/.X11-unix/X0 
srwxrwxrwx 1 root root 0 Dec 18 18:03 /tmp/.X11-unix/X0

Note the s in front of the permissions, which means its a socket. If you have multiple X servers running, you'll have more than one file there.

At least with the Linux manpages, more details about sockets (in general) can be found in man 7 socket. Details about Unix-domain sockets are in man 7 unix. Note that these pages are programmer-focused.