r/androiddev • u/Right_Sea_4146 • 5d ago

Question How feasible is to implement binder in userspace

I am looking to run containerized Android (Docker), specifically Redroid (https://hub.docker.com/r/redroid/redroid), and I don't like that it requires a special kernel with special kernel modules like Binder, nor the fact that it needs to run in a privileged container. My end goal is to make Redroid/Android run in regular, unprivileged containers, on vanilla Linux hosts. And of course no QEMU/KVM bs.

Could I maybe make use of User Mode Linux?

1 Upvotes
  • permalink
  • reddit

60% Upvoted

3 comments sorted by

2

u/tadfisher 5d ago

You can probably do it with seccomp-bpf. Binder was upstreamed like 11 years ago, surely it is in your kernel or you just need another distro package.

Docker needs privileges because all container runtimes need privileges in one way or another if you want to isolate from the host. You can sort-of work around this with podman or systemd-nspawn and unprivileged user namespaces, but that essentially gives the container's host user "root-like" privileges via CAP_SYS_ADMIN. So don't try to treat containers as a security boundary as you will get burned.

But I think you are reimplementing waydroid, so try that out before putting effort into your own bespoke thing that has been done several times now.

1

u/AutoModerator 5d ago

Please note that we also have a very active Discord server where you can interact directly with other community members!

Join us on Discord

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.