Userspace Docker implementation

[fishiatee]

You might already know udocker, which is a project that utilizes proot under the hood to emulate a subset of Docker features completely in userspace.

HOWEVER, proot is slow (abysmally so, especially when it comes to I/O), and udocker as project appears to have been abandoned by its original maintainers. Rooting a phone is easy, especially since you most likely don't need to care about root detection or any of that bullshit for a self-hosted server, BUT udocker still has its uses since to use native docker you have to rebuild the kernel to enable all the required features that docker needs, which for some phones there simply isn't any easy way for an user to do that.

This projects appears to be like proot, but isn't painfully slow, and is actually built with Android/Termux environments in mind.

My proposal is: a project like udocker, but utilizes nspawn.sh under the hood. Having docker unlocks a lot of possibilities.

[LongQT-sea]

Do you mean a rooted phone without rebuilding the kernel (for full namespace and networking support) that can run Docker?

If that’s the case, then the minimum requirements are almost met (mount namespace, bind mount, pivot_root). The remaining part is network namespace, bridge networking and veth support, which require rebuilding the kernel to enable. Let me test whether slirp4netns or pasta can be used as a replacement.

If you have a rooted phone with an unmodified kernel, please run sudo unshare -n then /system/bin/ip a to check whether network namespaces are already enabled.

[fishiatee]

Do you mean a rooted phone without rebuilding the kernel (for full namespace and networking support) that can run Docker?

Yep. Rebuilding the kernel for phones that does not have an established custom ROM community and/or proper custom kernel forks is generally a PITA.

I can confirm network namespace is not enabled by default on my phone running stock firmware.

[invalidsudo]

@fishiatee does your device allow booting GKIs? After much deliberation, I was able to follow this guide and build a custom GKI using GitHub Actions from this repo to turn my MediaTek Helio G99 device into a home server. I'm glad to report that nspawn, docker, and lxc containers all work just fine.

[fishiatee]

@invalidsudo It's an old phone (Galaxy M11) which doesn't even have proper custom ROMs (only ported GSIs) so GKI kernels are out of the question.

[LongQT-sea]

@invalidsudo Instead of using Termux packages, could you try using nspawn to run a Ubuntu 24 rootfs, and then install the official Docker CE or Podman to see if it works?

To boot systemd, after you got the root shell, type exec init then enter

To login, run this in another terminal:

sudo nsenter -t $(sudo pgrep -nfx init) -ea chroot / su -

[invalidsudo]

@LongQT-sea I've only had it up for a few hours, but yes, I did exactly that and now I have Navidrome serving my local music stored on my SD card perfectly using Docker CE 😊 Just had to add an extra bind mount to the nspawn script for it.

It was thanks to your comment here that I discovered this possibility. Thank you for making this!

Line from ~/.termux/boot/start-ubuntu to auto-start container on boot:
tmux new-session -d -s ubuntu-container "sudo nspawn --net ubuntu /bin/sh -c 'exec init'"

[LongQT-sea]

It’s pretty cool to see a phone turn into a Linux server while still retaining all the phone features.

P.S.: Here’s something I’m working on: turn my POCO F3 into an OpenWrt router.
If you can, install iw in Termux, then run iw list and paste the output here.

[LongQT-sea]

Demo time:

[LongQT-sea]

I got the Wi-Fi working, check this out:

https://www.reddit.com/r/termux/comments/1r5341q/openwrt_24_running_on_snapdragon_870/

[fishiatee]

Also is it feasible to reduce kernel requirement down to k4.9? A lot of slightly older phones would benefit from that.

[LongQT-sea]

@fishiatee You can modify it on this line: https://github.com/nspawn-sh/nspawn.sh/blob/main/nspawn#L589

[fishiatee]

That seems to allow containers to start, but network doesn't seem to work (tested image debian)

It crashes when trying with --net flag, presumably due to lack of network namespace.

[LongQT-sea]

If you have access to the kernel source, you can rebuild the kernel with all the relevant options enabled and then run the test again.

[LongQT-sea]

That seems to allow containers to start, but network doesn't seem to work (tested image debian)

Older kernels may have the following config enabled, which makes networking setup inside a container particularly problematic:

CONFIG_ANDROID_PARANOID_NETWORK=y

If you cannot rebuild the kernel to disable this option, you must configure the container properly to allow networking. Specifically, the process must belong to the appropriate Android network groups. For details:

https://unix.stackexchange.com/questions/321491/android-chroot-networking-issues

[fishiatee]

If that’s the case, then the minimum requirements are almost met (mount namespace, bind mount, pivot_root). The remaining part is network namespace, bridge networking and veth support, which require rebuilding the kernel to enable. Let me test whether slirp4netns or pasta can be used as a replacement.

How's the progress on this?