Chromium doesn't start under docker without `xhost +local:`

$ xhost
access control enabled, only authorized clients can connect

xterm works:

$ docker run --rm -it --network host \
  --volume ~/.Xauthority:/root/.Xauthority:ro \
  --env DISPLAY \
  alpine:3.19 sh -euxc 'apk add xterm; exec xterm'

chromium opens a window and seems to receive keystokes, but the window is empty (output ):

$ docker run --rm -it --network host \
  --volume ~/.Xauthority:/root/.Xauthority:ro \
  --env DISPLAY \
  alpine:3.19 sh -euxc 'apk add chromium; exec chromium --no-sandbox'

If I allow local connections with xhost it works:

$ xhost +local:

$ xhost
access control enabled, only authorized clients can connect
LOCAL:

$ docker run --rm -it --network host \
  --volume ~/.Xauthority:/root/.Xauthority:ro \
  --env DISPLAY \
  alpine:3.19 sh -euxc 'apk add chromium; exec chromium --no-sandbox'

$ xhost -local:

One could speculate here that it starts non-root processes which don't have access to /root/.Xauthority, and that's why it fails. Then under which user? So that I could provide .Xauthority to all interested parties. How do I debug this? How do I make it work?