Run Linux containers on Android, no root required

(github.com)

218 points | by politelemon 2 days ago ago

92 comments

  • vimredo 2 days ago ago

    I don't understand what this would be useful for. The Linux terminal app on Android (check Developer settings if you want it) already exists and it uses hardware accelerated virtualization, while this uses QEMU with TCG. The Linux terminal app also supports running a DE (No VNC - as in no VNC, not NoVNC - required!), has full shell, full root, all the features of Podroid, and hell, you could even swap out the terminal if you wanted to. The only advantage to this seems that it supports Android 14, 15, and 16. Am I missing something, or does this have no purpose?

    • gbil 2 days ago ago

      My understanding is that the integrated linux terminal is not supported on all processors like snapdragon ones and also is not available on all manufactures like Samsung. Therefore this approach covers a much bigger audience.

      • microtonal 2 days ago ago

        I think it was only available on Google Pixel until recently. As far as I understand, some Samsung Exynos devices support it (e.g. Z Flip 7, non-US S26 with Exynos), but not Snapdragon devices, which don't seem to support non-protected VMs yet:

        Error code: java.lang.UnsupportedOperationException: Non-protected VMs are not supported on this device

        • gbil 2 days ago ago

          I can find it on my S25fe with exynos android 16/oneui 8.0 if I search for it in the setting but is greyed out. I wait for 8.5 to see if it is enabled then and is the only time I'm happy to have an exynos device!

        • fg137 2 days ago ago

          Can confirm -- seeing the same error on a Samsung Snapdragon device when attempting to use the Linux terminal

      • getpokedagain a day ago ago

        It also behaves weirdly if you use a VPN.

    • m132 2 days ago ago

      This. Also, for phones that don't support Android virtualization, there's a user-space hack, part of Termux upstream, that allows for root-less chroots via LD_PRELOAD: https://wiki.termux.com/wiki/PRoot.

      systemd won't boot with this (needs to be PID 1), but a lot of software will work just fine and there's nearly zero emulation overhead.

      • yjftsjthsd-h a day ago ago

        I don't think it uses LD_PRELOAD, it uses ptrace to intercept system calls (hence the name). Unfortunately this does have performance overhead, although I've never bothered to measure it. Actually that would be an interesting thing to benchmark.

        • m132 a day ago ago

          My bad, I must have confused it with something else. Yes, it uses ptrace; there definitely is some overhead around system calls, but that still should be better than running atop a full-scale CPU emulator. That being said, I haven't benchmarked it myself, just remember it being pretty snappy.

          Thanks for your correction!

    • smetannik a day ago ago

      Android's terminal app is really slow and takes some time to boot comparing to Termux.

      Also, the Terminal app is essentially a webview (as I understand, the reason is architectural).

    • arend321 a day ago ago

      The Linux terminal app on Android reddits are full of reports of instability. It is far from being useful as far as I understand. I had so much hope for this being a good way to use my phone as a portal for development, but it's a dud. At least we have termux and proot.

    • nagaiaida 2 days ago ago

      you seem to have articulated precisely the advantage that makes it serve a purpose for me: supporting the version of android on my phone. presumably i am far from unique in not having android 16

    • iraizo 2 days ago ago

      The new app is truly awesome, was able to get a desktop environment running, and a minecraft server & client. Just a shame that you can't pass through USB.

    • acka a day ago ago

      Not everyone owns one of the limited range of devices that Linux Terminal is available for. For example, no Snapdragon chips currently in use support the "non-protected" virtual machines required by the Android Virtualization Framework. Also, it doesn't jive with Samsung Knox, so the few Samsung devices that this might work on (mostly international models with Exynos chips) will likely not be supported.

    • fmajid a day ago ago

      The Linux Terminal app is incredibly buggy in my experience, but that may be because I use GrapheneOS.

    • Saris a day ago ago

      Isn't this super limited? It seems to only support the latest version of android which only recently released phones have.

    • jacek 2 days ago ago

      I tried it on my Samsung phone. Keeps crashing, "recovery" just deletes everything and you start over from scratch. No session lasted more than 5 minutes.

    • shrx a day ago ago

      > The Linux terminal app on Android (check Developer settings if you want it)

      I don't see it. How do I install it?

      • Gander5739 a day ago ago

        In developer settings, under debugging "Linux development environment (Experimental) Run Linux terminal on Android"

        • shrx a day ago ago

          No such option. Apparently it needs to be allowed by the vendor (Samsung)?

    • ghywertelling 2 days ago ago

      We can use old phones for running PiHole.

    • thrance 2 days ago ago

      Wow, didn't know this existed, thanks. But 761 Mo download?? That's insanely big for a terminal, what could possibly make this bundle so big?

      • petu 2 days ago ago

        It's not giving you access to Android shell, but one inside VM. So OS image for VM.

      • prmoustache a day ago ago

        It is a complete OS in a virtual machine.

    • realusername 2 days ago ago

      Personally this toggle doesn't do anything (Android 16, Samsung) so I'm not sure when it's supposed to be ready

    • j45 2 days ago ago

      Sometimes the capability unlocks the possibilities.

      • m132 2 days ago ago

        But does it synergize paradigms?

        • j45 a day ago ago

          Creating a new capability is like making a new flashlight.

          Maybe the new light can see wider, or further and you see something you didn’t before that was possible.

          You can synergizr the looksmaxing while cooking if you like :)

  • hu3 2 days ago ago

    Added to my list of things that will never be possible on iOS.

    • StilesCrisis a day ago ago

      Not to defend it, but emulating Linux in WASM is possible and ought to work on iOS in a reasonably performance way. See https://webvm.io/

      • hu3 a day ago ago

        It will never be native though, which is the main point.

  • figmert 2 days ago ago

    This can probably be upstreamed into podman. Podman already has supports using a VM using podman machine (uses different tech under the hood depending on the OS). This seems like it can be yet another backend for it.

  • anthk 2 days ago ago

    Termux and a BT keyboard it's enough.

    Also, native Emacs under FDroid has recently been improved a lot.

    With just Emacs you get:

    - An IRC, Usenet and Mail client. The ONLY libre Usenet client. comp.arch and comp.misc have really engaging discussions. You can score up nice commenters and blacklist every spammer

    - Gemini and Gopher via ELPA (run Esc-x package-install RET elpher)

    - A math mini CAS with Esc-x calc RET

    - Esc-x package-install RET malyon, get some nice ZMachine text adventures at IFDB

    - Elisp environment+cl-lib can do a lot

    - Esc-x package-install jabber, Esc-x jabber. Chat with cool people at XMPP servers.

    - Org-Mode, enough said

    - eshell will allow you to automate stuff

    - Elisp + Android related functions + org-mode: heaven.

    - Sudoku, Sokoban, Tetris...

    - LSP integration it's possible

    Get some $10 pocket bluetooth keyboard and try it.

    • dietr1ch 2 days ago ago

      I tried Emacs, but realised I need NixOS to get the packages I depend on like git to download my config. I can't use stock emacs. There's a trick to get Emacs and termux to share packages, but not for nix-on-droid :/

  • spidermonkey23 2 days ago ago

    I think this is great, I've wanted some sort of docker on android system and this does the job quite nicely all wrapped up in an apk. So there is definitely space for this in the current ecosystem. The new terminal built into android crashes whenever I try booting it up.

  • nullbyte808 2 days ago ago

    Is it possible to get the reverse of this working? (Waydroid with play services on Linux phones, such as postmarketOS)

    • seba_dos1 2 days ago ago

      I've been using Waydroid with microG on a Librem 5 with PureOS for years. Not extensively as I don't have a lot of reasons to boot Android, but when I do have one it's there.

      I've seen some guides for installing Play Services in Waydroid, but personally I'm not interested.

      • unicornporn 2 days ago ago

        The latest Waydroid beta is over three years old. Waydroid is dead and I haven't found an alternative.

    • vimredo 2 days ago ago

      Why wouldn't it? All you need is a binder device for Android IPC and root access to launch Waydroid. It should work perfectly fine when installed and used with Wayland.

    • 2 days ago ago
      [deleted]
  • k38f 2 days ago ago

    The QEMU TCG approach makes sense for isolation, but I'm curious about the traffic routing story. Does each container get its own network namespace, or does all traffic still go through Android's network stack? The latter would mean carrier-level DPI still sees everything the container sends — which matters a lot depending on what you're running.

  • ike____________ a day ago ago

    Just tried it, the last 2 versions, I cannot continue after specifying the ram and cpu number.

  • Antitoxic6185 2 days ago ago

    tmux with proot distros exist though

    • 2 days ago ago
      [deleted]
  • tuananh 2 days ago ago

    what about the other way around?

    i'm aware about waydroid but it has too many problems with nvidia. also require wayland.

    • yjftsjthsd-h a day ago ago

      I can't help you with nvidia, but the Wayland thing can be worked around quite easily by running it under a nested compositor like cage. (This is how I run waydroid under Xorg)

    • Tajnymag 2 days ago ago

      There's for example redroid (https://github.com/remote-android/redroid-doc) which seems to be exactly that. Android inside a container.

    • unicornporn 2 days ago ago

      X86 builds of Android are stuck at many generations back of the OS. Running Android in a VM on X86 is basically dead AFAIK. :(

      • yjftsjthsd-h a day ago ago

        I'm actually optimistic that this will improve. Google has apparently been working on replacing Chrome OS with android, which I have pretty strong opinions on but the upside is that if they want to go that route they're going to have to make Android officially work well on x86, at which point there's no reason that eg. LineageOS wouldn't be expected to follow suit.

    • RobotToaster 2 days ago ago

      You could run a windows VM and run windows subsystem for android.

      • jansommer a day ago ago

        Windows subsystem for Android is deprecated. There's a community maintained alternative but it seems to have a few problems wrt. Windows updates.

        • RobotToaster 13 hours ago ago

          The community maintained version seems to work okay most of the time, but you're correct a better solution is needed.

  • Beijinger 2 days ago ago

    How is it the other way around? What is the status of Waydroid?

  • pjmlp 2 days ago ago

    I don't see the purpose to run containers on Android, the managed userspace provides everything I need, including code on the go apps, already sandboxed.

    Also not a termux fan.

    • dredmorbius a day ago ago

      What are your concerns / objections to Termux?

      • pjmlp 20 hours ago ago

        People are holding it wrong.

        Instead of embracing the Java/Kotlin userspace alongside C and C++ on the NDK, with the official APIs, they try to subvert into GNU/Linux.

        First of all bionic isn't glibc, secondly the Linux kernel is only a matter of convenience for Google, which they could in theory replace by something else, while keeping the Java/Kotlin and the NDK C/C++ APIs.

        Which is exactly termux isn't without issues on modern Android versions, not much different than using cygwin/mingw on Windows.

        • derekzhouzhen 6 hours ago ago

          This is exactly Termux's point, to subvert Android into linux cheaply. Same for MinGW or MSYS2. I want to invest as few as possible on Andriod or Windows, while still able to use them in the way that I prefer.

    • yenko a day ago ago

      What code on the go apps do you have in mind ?

      • pjmlp a day ago ago

        Pascal N IDE, C# Shell NET IDE, Pydroid 3, Shader Editor, the paid versions.

  • ilsubyeega 2 days ago ago

    curious is this just software qemu(not sure what word exactly was) instead of virtualization acceleration, probably more overheads?

    • em500 2 days ago ago

      Yes, under How It Works:

      > libqemu-system-aarch64.so (QEMU TCG, no KVM)

      TCG means software emulation

      • kristianp 2 days ago ago

        I thought why is qemu used here? Why not use linux native namespaces and cgroups.

        • NewJazz 2 days ago ago

          Permissions. Isolation.

          • Retr0id 2 days ago ago

            so, like namespaces and cgroups?

            • figmert 2 days ago ago

              Android kernel has the relevant kernel parameters disabled. It is entirely possible to run containers directly on android, but it requires enabled the relevant parameter (iirc no recompilation need, just a cmdline change). But this of course requires root.

    • meltyness 2 days ago ago
    • NewJazz 2 days ago ago

      Itbsays it doesnt use kvm, so i thinj that meens no accel.

  • ggm 2 days ago ago

    And local FS access is mediated how?

  • nixosbestos 2 days ago ago

    I just want a folding portable monitor now. We're getting so close...

  • TheRoque 2 days ago ago

    With this I could in theory do all my work from my Android phone.

  • ekropotin 2 days ago ago

    I find the title very misleading. Linux containers typically means LXC, but when in readme you say it’s intended for running OCI-based containers.

  • cringleyrobert 2 days ago ago

    Just because you can doesn’t mean you should.

  • nsonha 2 days ago ago

    What would be the usecases?

  • unnouinceput 2 days ago ago

    I want the opposite. And I want to behave like a true Android. Reason: My fucking useless bank that has a banking app that only runs on non-rooted Android only (cause fuck iOS/web according to them). My attempts to run their shitty app on emulators, virtual machines and the like failed. So currently I have a dumb phone that only has their crappy app on it and that's all. On a separate Google account, because I do not dare to link my main Google account to their name.

    Any advice?

  • randomtoast 2 days ago ago

    I find it somewhat amusing that it uses QEMU to emulate Linux in order to create a container with restricted permissions, even though it is already running on Linux with restricted permissions. I get the point while it is designed that way, but still funny.

  • Aegis_Labs a day ago ago

    [dead]

  • venyxx__tnt 2 days ago ago

    [flagged]

  • VonGuard 2 days ago ago

    Podman.....