Setup:
Samsung Galaxy Tab S5e SM-T720
Android Pie on Linux 4.9.112 (not rooted)
Termux
golang 1.12
This will install the docker client to your ~/go/bin/ directory.
go get github.com/docker/cli/cmd/docker
The client is working, you can export DOCKER_HOST value to work with the dockerd, for example:
# export DOCKER_HOST=unix://$HOME/docker.sock
export DOCKER_HOST=tcp://192.168.X.Y:2376
docker run hello-world
go get -u -d github.com/docker/docker/cmd/dockerd
rm -vf ~/go/src/github.com/docker/docker/daemon/graphdriver/register/register_btrfs.go
rm -vf ~/go/src/github.com/docker/docker/daemon/graphdriver/register/register_devicemapper.go
cd ~/go/src/github.com/docker/docker/cmd/dockerd
go install
containerd is the container runtime used by dockerd.
go get -u -d github.com/containerd/containerd/cmd/containerd
rm -vf ~/go/src/github.com/containerd/containerd/cmd/containerd/builtins_btrfs_linux.go
cd ~/go/src/github.com/containerd/containerd/cmd/containerd
go install
- Install rootlesskit
source ~/go/src/github.com/docker/docker/hack/dockerfile/install/rootlesskit.installer
REFIX=$GOPATH/bin _install_rootlesskit
- Install slirp4netns
git clone -b v0.3.0 https://github.com/rootless-containers/slirp4netns.git
cd slirp4netns
./autogen.sh
./configure --prefix=$PREFIX
make
make install
- Run rootless dockerd
~/go/src/github.com/docker/docker/contrib/dockerd-rootless.sh --experimental
Issue:
Apparently non-rooted Android is not permitting using the namespaces, probably due to SELinux rules or any other means such as unprivileged_userns_clone set to 0.. please try this if you have rooted Android.
+ exec rootlesskit --net=slirp4netns --mtu=65520 --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run /data/data/com.termux/files/home/go/src/github.com/docker/docker/contrib/dockerd-rootless.sh --experimental
WARN[0000] "builtin" port driver is experimental
[rootlesskit:parent] error: failed to start the child: fork/exec /proc/self/exe: operation not permitted
$ strace rootlesskit --net=slirp4netns --mtu=65520 --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run bash |& grep CLONE_NEWUSER
clone(child_stack=NULL, flags=CLONE_NEWUSER|SIGCHLD) = -1 EPERM (Operation not permitted)
$ strace unshare -U id |& grep PERM
unshare(CLONE_NEWUSER) = -1 EPERM (Operation not permitted)
- https://forums.docker.com/t/is-it-possible-to-runn-docker-engine-on-android-devices/16135
- #37375 Proposal: allow running
dockerdas an unprivileged user (aka rootless mode) - https://github.com/rootless-containers/rootlesskit.git
- slirp4netns
- https://github.com/docker/cli/tree/master/cmd
- moby/moby#37375
The defaults I have on my config:
$ go env
GOARCH="arm64"
GOBIN=""
GOCACHE="/data/data/com.termux/files/home/.cache/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="arm64"
GOHOSTOS="android"
GOOS="android"
GOPATH="/data/data/com.termux/files/home/go"
GOPROXY=""
GORACE=""
GOROOT="/data/data/com.termux/files/usr/lib/go"
GOTMPDIR=""
GOTOOLDIR="/data/data/com.termux/files/usr/lib/go/pkg/tool/android_arm64"
GCCGO="gccgo"
CC="aarch64-linux-android-clang"
CXX="aarch64-linux-android-clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/data/data/com.termux/files/usr/tmp/go-build067260183=/tmp/go-build -gno-record-gcc-switches"
@nobhobbor Docker can't help with privacy and there's no point on installing it for this purpose. Here's why:
Docker can only run containers that were created specifically for it, which means you can't run an Android apk inside docker. This defeats the idea of using docker for app isolation.
Android apps are already isolated. Each app you install creates a new user and that user has only permissions within the folder the app was installed and permissions you explicitly give it. So, rule of thumb, don't give apps unnecessary permissions.
Some permissions, like access to your phone's info (model, OS version, language, etc) and internet connection, are automatically granted and you can't change it. The best you can do is to use a firewall to completely block internet access for apps that actually don't need it. AFWall+ is a great one based on iptables, but requires a rooted device.
If you still have to run a non trusted app which requires internet access and your phone's storage access to properly work (i.e. WhatsApp), you can further isolate it by using a work profile with apps like Island (actively maintaines, but not available in F-droid because it uses Google Firebase) or Shell (not actively maintained, but present in F-Droid).
Besides Rob's channel there's also The Hated One and others videos that contains good info about Android privacy.
If privacy is really a concern, what I recommend is to forget about docker, get rid of your phone's default OS and replace it with a trusted alternative (i.e. LineageOS) without gapps. Use open source apps alternatives to your old apps, like NewPipe instead of YouTube, OpenStreetMaps instead of Goggle Maps, etc. Follow the tips I gave above about permissions, firewall and work profile isolation. Use orbot 100% of time with VPN mode enabled to route every internet request through tor network. And mostly important, discipline yourself.
@hessam94 Yes, naturally dockerd, containerd and runc are successfully running too, otherwise the docker-cli wouldn't had correctly ran as showed. To run dockerd and the others daemons you have to compile your kernel with cgroups, namespaces and others features enabled. As I said, use https://github.com/moby/moby/blob/master/contrib/check-config.sh to check what still needs to be enabled in your kernel. When compiling it, run the menuconfig and type
/to open a search window and enter the feature name without theCONFIG_. It will show you where the feature is located and its dependences.After having an appropriated kernel you need to mount the cgroups hierarchy manually, see https://github.com/termux/termux-root-packages/blob/master/packages/lxc/lxc-setup-cgroups.sh as reference.