Docker on Android

docker-on-android.md

WORK IN PROGRESS

Docker on Android

Setup:

Samsung Galaxy Tab S5e SM-T720
Android Pie on Linux 4.9.112 (not rooted)
Termux
golang 1.12

Client

This will install the docker client to your ~/go/bin/ directory.

go get github.com/docker/cli/cmd/docker

The client is working, you can export DOCKER_HOST value to work with the dockerd, for example:

# export DOCKER_HOST=unix://$HOME/docker.sock
export DOCKER_HOST=tcp://192.168.X.Y:2376
docker run hello-world

Server

go get -u -d github.com/docker/docker/cmd/dockerd

rm -vf ~/go/src/github.com/docker/docker/daemon/graphdriver/register/register_btrfs.go
rm -vf ~/go/src/github.com/docker/docker/daemon/graphdriver/register/register_devicemapper.go

cd ~/go/src/github.com/docker/docker/cmd/dockerd
go install

containerd

containerd is the container runtime used by dockerd.

go get -u -d github.com/containerd/containerd/cmd/containerd
rm -vf ~/go/src/github.com/containerd/containerd/cmd/containerd/builtins_btrfs_linux.go
cd ~/go/src/github.com/containerd/containerd/cmd/containerd
go install

rootless docker

1. Install rootlesskit

source ~/go/src/github.com/docker/docker/hack/dockerfile/install/rootlesskit.installer
REFIX=$GOPATH/bin _install_rootlesskit

2. Install slirp4netns

git clone -b v0.3.0 https://github.com/rootless-containers/slirp4netns.git
cd slirp4netns
./autogen.sh
./configure --prefix=$PREFIX
make
make install

3. Run rootless dockerd

~/go/src/github.com/docker/docker/contrib/dockerd-rootless.sh --experimental

Issue:

Apparently non-rooted Android is not permitting using the namespaces, probably due to SELinux rules or any other means such as unprivileged_userns_clone set to 0.. please try this if you have rooted Android.

+ exec rootlesskit --net=slirp4netns --mtu=65520 --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run /data/data/com.termux/files/home/go/src/github.com/docker/docker/contrib/dockerd-rootless.sh --experimental
WARN[0000] "builtin" port driver is experimental
[rootlesskit:parent] error: failed to start the child: fork/exec /proc/self/exe: operation not permitted

$ strace rootlesskit --net=slirp4netns --mtu=65520 --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run bash |& grep CLONE_NEWUSER
clone(child_stack=NULL, flags=CLONE_NEWUSER|SIGCHLD) = -1 EPERM (Operation not permitted)

$ strace unshare -U id |& grep PERM
unshare(CLONE_NEWUSER)                  = -1 EPERM (Operation not permitted)

Refs

• https://forums.docker.com/t/is-it-possible-to-runn-docker-engine-on-android-devices/16135
• #37375 Proposal: allow running dockerd as an unprivileged user (aka rootless mode)
• https://github.com/rootless-containers/rootlesskit.git
• slirp4netns
• https://github.com/docker/cli/tree/master/cmd
• moby/moby#37375

my go env

The defaults I have on my config:

$ go env
GOARCH="arm64"
GOBIN=""
GOCACHE="/data/data/com.termux/files/home/.cache/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="arm64"
GOHOSTOS="android"
GOOS="android"
GOPATH="/data/data/com.termux/files/home/go"
GOPROXY=""
GORACE=""
GOROOT="/data/data/com.termux/files/usr/lib/go"
GOTMPDIR=""
GOTOOLDIR="/data/data/com.termux/files/usr/lib/go/pkg/tool/android_arm64"
GCCGO="gccgo"
CC="aarch64-linux-android-clang"
CXX="aarch64-linux-android-clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/data/data/com.termux/files/usr/tmp/go-build067260183=/tmp/go-build -gno-record-gcc-switches"

@mad-ady I don't think you need to start containerd yourself, just starting dockerd should be enough. The docker daemon starts its dependencies by itself. About your error it looks you don't have runc installed. You can apt install runc or compile it from source. Also, running dockerd with --debug flag gives more verbosity.

Thank you for the advice. I'll try and report back!

…

On Thu, Dec 31, 2020 at 4:07 AM Frederico F. de Oliveira < ***@***.***> wrote: ***@***.**** commented on this gist. ------------------------------ @mad-ady <https://github.com/mad-ady> I don't think you need to start containerd yourself, just starting dockerd should be enough. The docker daemon starts its dependencies by itself. About your error it looks you don't have runc <https://github.com/opencontainers/runc> installed. You can apt install runc or compile it from source. Also, running dockerd with --debug flag gives more verbosity. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <https://gist.github.com/ebf570af208e28c1a0cf78da4f63bc9c#gistcomment-3578027>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABAO6KXAK4CXNUD6AB74T2LSXPMFNANCNFSM4ILV2X5A> .

@mad-ady I'm finishing writing the step by step guide I promised a while ago and ran into the same issue as you. I realized it's not the binary runc that's missing, it's actually a binary called containerd-shim-runc-v2. It's part of containerd and strangely enough this binary is not compiled by default when running make, you have to explicitly compile it with make bin/containerd-shim-runc-v2.

@FreddieOliveira I coudnt find time to run your patch , i will do it in 2 weeks thanks

Don't worry, I intend to post the tutorial by the end of this week. You can use it as a reference.

The step by step tutorial is finally done. Whoever is interested in get docker running on its own phone can check here for instructions.

Thank you for your work. Hope to give it a try soon and provide feedback!

I am recompiling the android on a ubuntu Linux, would you help us how to apply the patch (segmentation fault patch) on android kernel before compilation a new kernel? I got the entire android files on linux and trying to build a new one
thanks

We open the Android container, which can run the docker container on the Android operating system. Not only can run Docker containers, but also other containers, such as podman. In addition, we have also enabled the container to support checkpoint and restore functions, and support the migration of containers across architectures and operating systems. See https://github.com/CGCL-codes/Android-Container for details.

For those who are interested, docker runs fine in android as long as you have an appropriated kernel (use https://github.com/moby/moby/blob/master/contrib/check-config.sh to check it). I'm running it right now, here's the prove:

This is a screenshot of docker running in my Redmi Note 7 device in termux. No chroot into a Linux rootfs and no qemu emulation of a Linux distro. This is docker in pure android.

But, there's a problem. When you pull a container, docker checks your device architecture and.operating system to download a container that matches it. To do so, it checks the container's manifest and see what architectures and OS's are supported by it and then pulls the correct one. Despite aarch64 is largely supported by most of the containers, the Android OS is not. This makes docker useless in Android, since there's no container that runs on it:

For more info and alternatives on how to run docker on Android check this thread: termux/termux-root-packages#60

Can you share your kernel in redmi note 7

Verify Github on Galaxy. gid:wzXiXzmeFjYF4QKxtCUfnP

@jelllyam, here's the kernel I'm currently using. It's based on LineageOS 17.1 (Android 10): https://ufile.io/a6guqaku

And out of curiosity, here's my kernel config file used when compiling it: https://ufile.io/5u3q10qu

The download links will be valid for 30 days.

Be aware that this kernel is for Android 10. Flashing it on a different version may cause boot loop. In case this happens, just reflash your ROM. You won't lose any of your data flashing the kernel or your ROM.

To learn how to install and use docker after you successfully flash the kernel see https://gist.github.com/FreddieOliveira/efe850df7ff3951cb62d74bd770dce27