Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AinD: Android in Docker

github.com

Post reply on HN
Print view View original

1–10 of 26 posts

Re: AinD: Android in Docker

#2

Post by ryanmjacobs »

I really want to try this, but I'm a little hesitant with the --privileged flag. Sounds like this is pretty much giving root access to the container? (https://stackoverflow.com/questions/36425230/privileged-cont...)

Could someone (or OP) enlighten me on what requires this flag? I thought the container would also get access to the anbox kernel modules that I have installed already.

Re: AinD: Android in Docker

#3

Post by AkihiroSuda »

ryanmjacobs wrote: post #2

I really want to try this, but I'm a little hesitant with the --privileged flag. Sounds like this is pretty much giving root access to the container? ( https://stackoverflow.com/questions/36425230/privileged-cont... ) Could someone (or OP) enlighten me on what requires this flag? I thought the container would also get access to the anbox kernel modules that I have installed already.

The author of aind is here.

--privileged is required for nesting an Anbox (LXC) inside Docker. But you don't need to worry too much because Anbox launches "unprivileged" LXC using user namespaces. You can confirm that all Android process are running as non-root users by executing `docker exec aind ps -ef`.

Re: AinD: Android in Docker

#4

Post by ryanmjacobs »

AkihiroSuda wrote: post #3
ryanmjacobs wrote: post #2

I really want to try this, but I'm a little hesitant with the --privileged flag. Sounds like this is pretty much giving root access to the container? ( https://stackoverflow.com/questions/36425230/privileged-cont... ) Could someone (or OP) enlighten me on what requires this flag? I thought the container would also get access to the anbox kernel modules that I have installed already.

The author of aind is here. --privileged is required for nesting an Anbox (LXC) inside Docker. But you don't need to worry too much because Anbox launches "unprivileged" LXC using user namespaces. You can confirm that all Android process are running as non-root users by executing `docker exec aind ps -ef`.

Ah gotcha, thanks for replying. I spun up a copy on a disposable machine and I was able to VNC into the container and everything. I like the window manager that's installed on it. Seems lightweight. Looking forward to exploring this tool!

Re: AinD: Android in Docker

#6

Post by inez_k »

nhoughto wrote: post #5

Could this be used to test android apps in CI? Where traditionally you run up against nested virt problems (in aws). Not mentioned as a purpose..

That was my first thought. Very curious to find out how it would compare to Testlab virtual machines.

Re: AinD: Android in Docker

#7

Post by AkihiroSuda »

inez_k wrote: post #6
nhoughto wrote: post #5

Could this be used to test android apps in CI? Where traditionally you run up against nested virt problems (in aws). Not mentioned as a purpose..

That was my first thought. Very curious to find out how it would compare to Testlab virtual machines.

I haven't tested, but if UI automator stuff works with Anbox, it should work with aind as well.

I can add it to the scope of the project if it works.

Re: AinD: Android in Docker

#8

Post by mister_hn »

ryanmjacobs wrote: post #2

I really want to try this, but I'm a little hesitant with the --privileged flag. Sounds like this is pretty much giving root access to the container? ( https://stackoverflow.com/questions/36425230/privileged-cont... ) Could someone (or OP) enlighten me on what requires this flag? I thought the container would also get access to the anbox kernel modules that I have installed already.

But docker runs still with root privileges (or your user must be in the docker group, which is equivalent to root - so is also in the official documentation explained)

Re: AinD: Android in Docker

#9

Post by AkihiroSuda »

mister_hn wrote: post #8
ryanmjacobs wrote: post #2

I really want to try this, but I'm a little hesitant with the --privileged flag. Sounds like this is pretty much giving root access to the container? ( https://stackoverflow.com/questions/36425230/privileged-cont... ) Could someone (or OP) enlighten me on what requires this flag? I thought the container would also get access to the anbox kernel modules that I have installed already.

But docker runs still with root privileges (or your user must be in the docker group, which is equivalent to root - so is also in the official documentation explained)

Not always true since Docker 19.03: https://docs.docker.com/engine/security/rootless/

Probably aind doesn't work with rootless Docker currently mostly because of squashfs stuff, but I believe we can workaround that relatively easily.

Post reply on HN