Android-in-sandbox: guest kernel binder + binfmt_misc + config drift guard - #3
Draft
sosso wants to merge 1 commit into
Draft
Android-in-sandbox: guest kernel binder + binfmt_misc + config drift guard#3sosso wants to merge 1 commit into
sosso wants to merge 1 commit into
Conversation
…redroid) Adds the kernel features containerised Android needs (binder/binderfs, SELinux permissive chain, cgroup v1 memcg/cpuset) plus BINFMT_MISC so qemu-user can run Google's x86_64-only SDK tooling in the arm64 guest. olddefconfig drops unknown/unmet options silently — two phantom symbols (CONFIG_CGROUP_V1, CONFIG_SELINUX) were sitting in the configs doing nothing. verify-config.sh now fails the Docker kernel build on new drift; known-drift.txt carries the untriaged pre-existing drops. docs/ carries the full Android-in-sandbox runbook and the in-VM build scripts so the recipe survives outside gitignored scratch dirs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017JAyNw3W5vo3dwZJA8ZBgE
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
The kernel side of getting Android (redroid) — and the full RSHomebuyerApp build/run loop — working inside a matchlock sandbox VM, plus a drift guard for the kernel config build and the complete runbook so the recipe doesn't live only in gitignored scratch dirs.
Proven end-to-end 2026-08-04 on instance 1: Android 15 boots in ~2 min, the debug APK builds in-VM (x86_64 NDK under qemu via binfmt_misc), and the app signs into the instance's own Rails with photos served by the in-VM web container. Zero bytes of app code executed on the host.
📊 Full exploration report (what was tried, what was found, next direction):
https://claude.ai/code/artifact/0faaea79-4e27-4024-8d8e-e8a5d4748eef
Changes
guest/kernel/{arm64,x86_64}.config— binder/binderfs + binder devices,BINFMT_MISC, SELinux-permissive chain (SECURITY/SECURITY_NETWORK/AUDIT/SECURITY_SELINUX/SELINUX_DEVELOP), cgroup v1MEMCG_V1/CPUSETS_V1. Removes two phantom symbols that were silently doing nothing (CONFIG_CGROUP_V1doesn't exist in 6.19;CONFIG_SELINUXwas never the real symbol).guest/kernel/verify-config.sh+known-drift.txt, wired into the kernel Dockerfile —olddefconfigdrops unknown/unmet options silently; the build now fails on any new drift. The known-drift list is the untriaged pre-existing debt (11 legacy-iptables symbols etc.); shrinking it is the real fix.docs/android-redroid-runbook.md— the full recipe: kernel build, per-instance kernel override (RSV2_SANDBOX_KERNEL, no fleet pin change), redroid boot + its empty-route-table fix, the per-VM MITM-CA keystore trap, per-userns binfmt registration, in-VM APK build, shield networking rules, and the rsv2 seed-data touch-ups.docs/android/— the in-VM build/binfmt scripts referenced by the runbook.repro-kernel-config-drift.sh— standalone drift repro used to derive the known-drift list.Deliberately NOT in this PR
sandboxKernelVersionpin bump — instance 1 runs binder2 via env override; rolling the fleet is a separate decision (SELinux+AUDIT carry cost; soak on instance 1 first).Next direction
Rosetta directory share (
VZLinuxRosettaDirectoryShare) to replace qemu TCG for x86_64 binaries — near-native NDK builds, security-neutral (read-only share, translation runs in-guest), benefits every sandbox. Details in the artifact.🤖 Generated with Claude Code
https://claude.ai/code/session_017JAyNw3W5vo3dwZJA8ZBgE