Running Lxc natively on Android

Introduction:
LXC is an operating system-level virtualization technology that provides a user-space interface for Linux kernel container functionality. It packages the application software system into a software container, which includes the code of the application software itself, as well as the required operating system kernel and libraries.

1. Compile the Kernel#

1.1. Adjust Kernel Configuration#

Use this repository to quickly add configurations

git fetch https://github.com/lateautumn233/android_kernel_docker main
git merge -s ours --no-commit --allow-unrelated-histories --squash FETCH_HEAD
git read-tree --prefix=docker -u FETCH_HEAD
echo "source \"docker/Kconfig\"" >> arch/arm64/Kconfig
git commit -a -m "Imported docker/ from https://github.com/lateautumn233/android_kernel_docker"

Then compile it yourself
🥵🥵🥵

1.2. Kernel Patch#

Fix possible panic situations

net/netfilter/xt_qtaguid.c

--- orig/net/netfilter/xt_qtaguid.c     2020-05-12 12:13:14.000000000 +0300
+++ my/net/netfilter/xt_qtaguid.c       2019-09-15 23:56:45.000000000 +0300
@@ -737,7 +737,7 @@
{
        struct proc_iface_stat_fmt_info *p = m->private;
        struct iface_stat *iface_entry;
-       struct rtnl_link_stats64 dev_stats, *stats;
+       struct rtnl_link_stats64 *stats;
        struct rtnl_link_stats64 no_dev_stats = {0};  
@@ -745,13 +745,8 @@
        current->pid, current->tgid, from_kuid(&init_user_ns, current_fsuid()));
        iface_entry = list_entry(v, struct iface_stat, list);
+       stats = &no_dev_stats; 
-       if (iface_entry->active) {
-               stats = dev_get_stats(iface_entry->net_dev,
-                                     &dev_stats);
-       } else {
-               stats = &no_dev_stats;
-       }
        /*
         * If the meaning of the data changes, then update the fmtX
         * string.

Fix missing cpuset prefix in cgroup

kernel/cgroup/cgroup.c

--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -3786,6 +3786,10 @@ static int cgroup_add_file(struct cgroup_subsys_state *css, struct cgroup *cgrp,
 		cfile->kn = kn;
 		spin_unlock_irq(&cgroup_file_kn_lock);
 	}
+	if (cft->ss && (cgrp->root->flags & CGRP_ROOT_NOPREFIX) && !(cft->flags & CFTYPE_NO_PREFIX)) {
+				snprintf(name, CGROUP_FILE_NAME_MAX, "%s.%s", cft->ss->name, cft->name);
+				kernfs_create_link(cgrp->kn, name, kn);
+	}
 
 	return 0;
 }

Disable ANDROID_PARANOID_NETWORK

scripts/config --file arch/arm64/configs/<defconfig> -
d ANDROID_PARANOID_NETWORK

1.3. Check Kernel Configuration#

Check after generating the complete kernel configuration

wget https://raw.githubusercontent.com/lxc/lxc/main/src/lxc/cmd/lxc-checkconfig.in -O lxc-checkconfig
chmod a+x lxc-checkconfig
CONFIG=out/.config lxc-checkconfig

Specific kernel compilation
The following is omitted

2. Install Lxc Module#

Download and install this Magisk module and restart

2.1. Start Lxc Container#

Execute in any terminal software

. /data/lxc/env.sh

Create a container

lxc-create -t download -n my-container -- --server mirrors.tuna.tsinghua.edu.cn/lxc-images
# Fill in the distribution, version number, and architecture in order
# Then start
lxc-start -n my-container -d -F

Adjust the password for the lxc container

chroot path /bin/su -
lxc-attach -n my-container passwd

2.1. Configure Network#

(Optional, default is veth and can be left unchanged)

2.1.1 Use Host Mode#

sed -i 's/lxc\.net\.0\.type = veth/lxc.net.0.type = none/g' /data/lxc/etc/lxc/default.conf

Meow meow meow meow meow