Docker on Kang's Blog

Custom Redroid Image: From Source Code Build to Feature Enhancement

Wed, 17 Sep 2025 00:00:00 +0000

Overview

Redroid (Remote Android) is a container-based Android runtime environment that can run a complete Android system on Linux servers. This article provides a detailed guide on how to build a fully functional custom Redroid image from AOSP source code, integrating advanced features such as GPS positioning, battery management, and Magisk Root.

Use Cases

Mobile application development and testing
Automated testing environment setup
Android reverse engineering and security research
Cloud-based Android service deployment

Prerequisites

Before starting, please ensure your environment meets the following requirements:

Hardware Requirements

CPU: Recommended 8+ cores, supporting x86_64 architecture
Memory: At least 16GB RAM, 32GB recommended
Storage: At least 100GB available space (SSD recommended)

Software Environment

Operating System: Ubuntu 20.04/22.04 LTS or other modern Linux distributions
Docker: Version 20.10 or higher
Git: Version 2.25 or higher
Python 3: For running build scripts

Network Requirements

Stable network connection (large amount of source code to download)
If encountering network issues, recommend using Tsinghua mirror sources

Step 1: Environment Setup and Source Code Download

1.1 Create Working Directory

1
2
3

# Create dedicated working directory
cd /data
mkdir redroid && cd redroid

Install Google Repo Tool

Repo is a tool developed by Google for managing multiple Git repositories, essential for AOSP projects.

# Download and install repo tool
curl -k https://storage.googleapis.com/git-repo-downloads/repo > /usr/local/bin/repo
chmod a+x /usr/local/bin/repo

# Configure Git user information (required)
git config --global user.email "your-email@example.com"
git config --global user.name "YourName"

Note: Please replace the email and username with your actual information.

Initialize AOSP Source Repository

# Initialize repo using Tsinghua mirror for accelerated download
repo init -u https://mirrors.tuna.tsinghua.edu.cn/git/AOSP/platform/manifest \
    --git-lfs --depth=1 -b android-15.0.0_r36

# Add Redroid-specific local manifest configuration
git clone https://git.coderkang.top/Android/local_manifests.git \
    .repo/local_manifests -b 15.0.0

Sync Source Code

1
2

# Start syncing source code (time-consuming, please be patient)
repo sync -c

Tip: Initial sync may take 2-4 hours, depending on network conditions. Recommend using screen or tmux to run in background.

Step 2: Magisk Module Integration

Magisk is a popular Android Root solution that provides system-level permission management.

Extract Magisk Components

1
2
3

# Enter Magisk directory and execute extraction script
cd /data/redroid/vendor/magisk
python3 magisk.py

This script will automatically download the latest version of Magisk APK and extract necessary binary files and modules, integrating them into the system image.

Step 3: Apply Custom Patches

Download and Apply Redroid Patches

# Return to main directory
cd /data

# Get Redroid-specific patch set
git clone https://git.coderkang.top/Android/redroid-patches.git

# Apply all patches to source code
./redroid-patches/apply-patch.sh /data/redroid

These patches include:

GPS Functionality: Enable location service support
Battery Management: Simulate battery status and power management
Network Enhancement: Improve network connection stability
Performance Optimization: Performance tuning for container environments

Step 4: Docker Build Environment Setup

Create Build Container

# Get build tools
git clone https://git.coderkang.top/Android/redroid-doc.git
cd redroid-doc/android-builder-docker

# Build Docker image (contains all build dependencies)
docker build \
    --build-arg userid=$(id -u) \
    --build-arg groupid=$(id -g) \
    --build-arg username=$(id -un) \
    -t redroid-builder .

Start Build Environment

# Start build container, mount source code directory
docker run -it --rm \
    --hostname redroid-builder \
    --name redroid-builder \
    -v /data/redroid:/src \
    redroid-builder

Step 5: Compile Android System

Configure Build Environment

# Execute the following commands inside the container
cd /src

# Initialize build environment
. build/envsetup.sh

# Select build target (ARM64 architecture, user debug version)
lunch redroid_arm64_only-ap3a-userdebug

Start Compilation

1
2

# Start compilation process (time-consuming, recommend using -j parameter to specify parallelism)
m -j$(nproc)

Compilation Time: Depending on hardware configuration, compilation usually takes 1-3 hours.

Step 6: Image Packaging and Deployment

Create Docker Image

After compilation is complete, the generated system files need to be packaged into a Docker image.

# Exit build container, return to host machine
exit

# Enter compilation output directory
cd /data/redroid/out/target/product/redroid_arm64_only

# Mount system images (read-only)
sudo mount system.img system -o ro
sudo mount vendor.img vendor -o ro

# Package as Docker image
sudo tar --xattrs -c vendor -C system --exclude="./vendor" . | \
    docker import -c 'ENTRYPOINT ["/init", "androidboot.hardware=redroid", "ro.setupwizard.mode=DISABLED"]' \
    - redroid:custom

# Unmount image files
sudo umount system vendor

Verify Image

# View created image
docker images | grep redroid

# Test starting container
docker run -itd --rm --memory-swappiness=0 \
    --name redroid-test \
    -p 5555:5555 \
    redroid:custom

Function Verification and Usage

Verify Root Permissions

# Connect to Redroid container
adb connect localhost:5555

# Verify Root permissions
adb shell su -c "id"

Verify GPS Functionality

1
2

# Check GPS service status
adb shell dumpsys location

Verify Battery Management

1
2

# View battery status
adb shell dumpsys battery

Common Issues and Solutions

Compilation Errors

Issue: Insufficient memory causing compilation failure

1
2

# Solution: Reduce parallelism
m -j4  # Use fewer parallel tasks

Issue: Insufficient disk space

1
2

# Solution: Clean compilation cache
make clean

Runtime Issues

Issue: Container cannot start

# Check kernel modules
lsmod | grep binder
lsmod | grep ashmem

# If missing, load modules
sudo modprobe binder_linux
sudo modprobe ashmem_linux

Issue: ADB connection failure

1
2
3

# Restart ADB service
adb kill-server
adb start-server

Optimization Recommendations

Performance Optimization

Memory Configuration: Allocate sufficient memory to containers (recommended 4GB+)
CPU Configuration: Enable CPU hotplug support
Storage Optimization: Use SSD storage to improve I/O performance

Security Considerations

Network Isolation: Use custom Docker networks
Permission Control: Limit container permissions, avoid privileged mode
Data Persistence: Properly configure data volume mounts

Summary

Through the detailed guidance in this article, you have successfully built a fully functional custom Redroid image. This image integrates advanced features such as GPS, battery management, and Magisk Root, meeting various development and testing needs.

In practical use, you can further customize system configurations, add more functional modules, or optimize performance parameters according to specific requirements. Redroid’s flexibility makes it an ideal choice for Android development and testing.

Next Steps

Explore more Magisk module integrations
Configure Continuous Integration/Continuous Deployment (CI/CD)
Set up multi-instance cluster environments
Integrate automated testing frameworks

Docker Standalone IP Configuration Guide - Macvlan and Pipework Implementation

Thu, 11 Jul 2024 00:00:00 +0000

Macvlan

📝 Note

Network drivers overview | Docker Docs

Macvlan network driver | Docker Docs

Certain applications, particularly legacy software or programs that monitor network traffic, require direct connections to the physical network. In such scenarios, you can utilize the macvlan network driver to assign each container’s virtual network interface a unique MAC address, making them appear as physical network interfaces directly attached to the physical network. This configuration requires specifying a physical interface on the Docker host for macvlan usage, along with defining the network’s subnet and gateway. You may also employ different physical network interfaces to isolate your macvlan networks.

cat <<EOF > docker_network_macvlan.yaml
name: docker_network_macvlan
services:
  docker_network_macvlan:
    image: busybox
    container_name: docker_network_macvlan
    networks:
      macvlan_net:
        ipv4_address: 192.168.142.234  # Configure static IP
    privileged: true
    cap_add:
      - NET_ADMIN  # Add network privileges
    command: sleep infinity
    ports:
      - "17000:17000"

networks:
  macvlan_net:
    driver: macvlan  # Use macvlan network type
    # Macvlan networks allow containers to have MAC addresses, making them appear as physical devices on the network.
    # The Docker daemon can route traffic through container's MAC address.
    # Macvlan is often the best choice when dealing with legacy applications that expect direct physical network connection.
    driver_opts:
      parent: eno1  # Specify network interface
    ipam:
      config:
        - subnet: 192.168.142.0/24    # Subnet
          ip_range: 192.168.142.0/24  # IP range
          gateway: 192.168.142.1      # Gateway
EOF

`1`	`docker-compose -f docker_network_macvlan.yaml up -d`

📌 Important

The container currently cannot communicate with the host machine (using eno1 NIC) or other containers.

Pipework

jpetazzo/pipework: Software-Defined Networking tools for LXC (LinuX Containers) (github.com)

`1`	`sudo docker run -itd --name test ubuntu /bin/bash`

`1`	`sudo docker exec test ip addr show`

The host machine’s network is 172.16.0.100. Configure the network for container “test” and connect it to bridge br0, where the address after @ represents the gateway:

1
2

sudo pipework br0 test 172.16.0.156/24@172.16.0.1
# ip addr add 172.16.0.254/24 dev br0

sudo ip addr add 172.16.0.100/24 dev br0; \
    sudo ip addr del 172.16.0.100/24 dev enp1s0; \
    sudo brctl addif br0 enp1s0; \
    sudo ip route del default; \
    sudo ip route add default via 172.16.0.1 dev br0

Resolving apt Update GPG Signature Issues in Docker

Mon, 05 Jun 2023 00:00:00 +0000

Cause

After investigation, it was identified that Ubuntu 21.10 and Fedora 35 began using glibc 2.34 and higher versions. In glibc 2.34, a new system call named clone3 was introduced. Normally, Docker intercepts all system calls in containers and determines how to handle them. If Docker lacks specific policies for a particular system call, its default policy returns a “Permission Denied” error to the container. However, when glibc receives this error, it does NOT fallback to alternative methods. It would only attempt fallback procedures if the response indicated “This system call is unavailable.”

Solutions

Solution 1

Add the following parameter when running the container to bypass Docker’s system call restrictions:

`1`	`--security-opt seccomp=unconfined`

Important caveats:

This compromises container security.
This parameter cannot be used during image builds. Refer to Solution 2 for alternatives.

Solution 2

Upgrade Docker to version 20.10.8 or higher (>20.10.8).

Production environment considerations:

Upgrading Docker versions in production may be challenging.
When building images, avoid using Ubuntu 21.10, Fedora 35, or newer as base images, and verify if derived images are affected.
Most official images are based on Debian - confirm Debian-based image compatibility to ensure they aren’t impacted by this issue.

Solution 3

Upgrade runc.

https://github.com/opencontainers/runc/releases/

Check the runc version before upgrading using docker version:

1. Select version 1.0.0-rc95 and download runc.amd64

2. Upload the file to the server, rename it, and grant permissions

`1`	`mv runc.amd64 runc && chmod +x runc`

3. Back up the existing runc

1
2

which runc
mv

4. Stop Docker

`1`	`systemctl stop docker`

5. Replace with the new runc version

`1`	`cp runc /usr/bin/runc`

6. Start Docker

`1`	`systemctl start docker`

7. Verify if runc was upgraded successfully

`1`	`docker version`

Guide to Setting Up Confluence with Docker

Wed, 22 Mar 2023 00:00:00 +0000

Required File Downloads:

1
2

wget https://minio-console.coderkang.top/files/atlassian-agent.jar
wget https://minio-console.coderkang.top/files/mysql-connector-j-8.3.0.jar

docker-compose.yaml

version: '3.8'
name: atlassian
services:
  confluence:
    image: atlassian/confluence-server:8.5.2
    container_name: atlassian-confluence
    restart: always
    environment:
      - TZ=Asia/Shanghai
      - JVM_MINIMUM_MEMORY=4096m
      - JVM_MAXIMUM_MEMORY=8192m
      - ATL_DB_TYPE=mysql
      - ATL_JDBC_URL=jdbc:mysql://db:3306/confluence?sessionVariables=transaction_isolation='READ-COMMITTED'
      - ATL_JDBC_USER=root
      - ATL_JDBC_PASSWORD=******
      - JAVA_OPTS='-javaagent:/opt/atlassian-agent.jar'
    ports:
      - 38090:8090
      - 38091:8091
    volumes:
      - ./application-data/:/var/atlassian/application-data/confluence/
      # - ./setenv.sh:/opt/atlassian/confluence/bin/setenv.sh
      - ./atlassian-agent.jar:/opt/atlassian-agent.jar
      - ./mysql-connector-j-8.3.0.jar:/opt/atlassian/confluence/confluence/WEB-INF/lib/mysql-connector-j-8.3.0.jar
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8090"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    depends_on:
      db:
        condition: service_healthy

  db:
    image: mysql:latest
    container_name: atlassian-db
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: ******
      MYSQL_DATABASE: confluence
    command: --character-set-server=utf8mb4 --collation-server=utf8mb4_bin
    volumes:
      - ./application-db/data/:/var/lib/mysql/
      - ./application-db/conf.d/:/etc/mysql/conf.d/
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p******"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

1
2

docker compose up -d
# The startup process may take some time as it needs to wait for the MySQL service to fully initialize

Access the webpage to obtain the Server ID.

docker compose exec -it confluence java -jar /opt/atlassian-agent.jar -m <Email> -n <Username> -o <Organization> -p conf -s '<Server ID>'

# Example:
# docker compose exec -it confluence java -jar /opt/atlassian-agent.jar -m CoderKang@hotmail.com -n CoderKang -o NiKo -p conf -s 'BHE8-N86V-SW29-TDDO'

Click “Next” after entering the information and wait…

📌 Important

If encountering issues during installation, after stopping the container:

Delete the application-db and application-data directories

Rebuild the container

Dockerized OpenVPN Client with Proxy Integration

Tue, 14 Jun 2022 00:00:00 +0000

To resolve conflicts between OpenVPN and proxy software

wfg/docker-openvpn-client: OpenVPN client with killswitch and proxy servers; built on Alpine (github.com)

Build Files

Dockerfile

FROM alpine:3.17

RUN apk add --no-cache \
    bash \
    bind-tools \
    iptables \
    ip6tables \
    openvpn

COPY . /usr/local/bin

ENV KILL_SWITCH=on

ENTRYPOINT [ "entry.sh" ]

killswitch

#!/usr/bin/env bash

set -o errexit
set -o nounset
set -o pipefail

# Block all traffic not going through tun0 interface
iptables --insert OUTPUT \
    ! --out-interface tun0 \
    --match addrtype ! --dst-type LOCAL \
    ! --destination "$(ip -4 -oneline addr show dev eth0 | awk 'NR == 1 { print $4 }')" \
    --jump REJECT

# Create static routes for allowed subnets
default_gateway=$(ip -4 route | awk '$1 == "default" { print $3 }')
for subnet in ${1//,/ }; do
    ip route add "$subnet" via "$default_gateway"
    iptables --insert OUTPUT --destination "$subnet" --jump ACCEPT
done

# Whitelist OpenVPN server addresses
global_port=$(awk '$1 == "port" { print $2 }' "${config:?"config file not found by kill switch"}")
global_protocol=$(awk '$1 == "proto" { print $2 }' "${config:?"config file not found by kill switch"}")
remotes=$(awk '$1 == "remote" { print $2, $3, $4 }' "${config:?"config file not found by kill switch"}")
ip_regex='^(([1-9]?[0-9]|1[0-9][0-9]|2([0-4][0-9]|5[0-5]))\.){3}([1-9]?[0-9]|1[0-9][0-9]|2([0-4][0-9]|5[0-5]))$'
while IFS= read -r line; do
    # Process each remote entry
    IFS=" " read -ra remote <<< "${line%%\#*}"
    address=${remote[0]}
    port=${remote[1]:-${global_port:-1194}}
    protocol=${remote[2]:-${global_protocol:-udp}}

    # Allow IP addresses and handle domain resolution
    if [[ $address =~ $ip_regex ]]; then
        iptables --insert OUTPUT --destination "$address" --protocol "$protocol" --destination-port "$port" --jump ACCEPT
    else
        for ip in $(dig -4 +short "$address"); do
            iptables --insert OUTPUT --destination "$ip" --protocol "$protocol" --destination-port "$port" --jump ACCEPT
            echo "$ip $address" >> /etc/hosts
        done
    fi
done <<< "$remotes"

entry.sh

#!/usr/bin/env bash

set -o errexit
set -o nounset
set -o pipefail

cleanup() {
    kill TERM "$openvpn_pid"
    exit 0
}

is_enabled() {
    [[ ${1,,} =~ ^(true|t|yes|y|1|on|enable|enabled)$ ]]
}

# Either a specific file name or a pattern.
if [[ $CONFIG_FILE ]]; then
    config_file=$(find /config -name "$CONFIG_FILE" 2> /dev/null | sort | shuf -n 1)
else
    config_file=$(find /config -name '*.conf' -o -name '*.ovpn' 2> /dev/null | sort | shuf -n 1)
fi

if [[ -z $config_file ]]; then
    echo "no openvpn configuration file found" >&2
    exit 1
fi

echo "using openvpn configuration file: $config_file"

openvpn_args=(
    "--config" "$config_file"
    "--cd" "/config"
)

if is_enabled "$KILL_SWITCH"; then
    openvpn_args+=("--route-up" "/usr/local/bin/killswitch.sh $ALLOWED_SUBNETS")
fi

# Docker secret that contains the credentials for accessing the VPN.
if [[ $AUTH_SECRET ]]; then
    openvpn_args+=("--auth-user-pass" "/run/secrets/$AUTH_SECRET")
fi

openvpn "${openvpn_args[@]}" &
openvpn_pid=$!

trap cleanup TERM

wait $openvpn_pid

Build and Start

docker-compose.yaml

Public image: ghcr.io/wfg/openvpn-client
Build image:

`1`	`docker compose build`

Start:

`1`	`docker compose up -d`

services:
  openvpn-client:
    image: openvpn-client:latest  # ghcr.io/wfg/openvpn-client
    build:
      context: ./
      dockerfile: Dockerfile
    container_name: openvpn-client
    cap_add:
      - NET_ADMIN
    environment:
      # - HTTP_PROXY=on
      - SOCKS_PROXY=on
    devices:
      - /dev/net/tun:/dev/net/tun
    volumes:
      - ./local:/config
      - ./local:/data/vpn
    ports:
      # - 8080:8080  # HTTP_PROXY port
      - 1080:1080  # SOCKS_PROXY port
    restart: unless-stopped

Using with Proxy Software

Utilizing the Rule Configuration routing policy in Clash software

proxies:
	- { name: OpenVPN, server: 127.0.0.1, port: 1080, type: socks5 }

rules:
	- IP-CIDR,192.168.142.0/24,OpenVPN
	- IP-CIDR,10.10.10.0/24,OpenVPN
	- IP-CIDR,172.16.0.0/24,OpenVPN

One More Thing

In addition to OpenVPN, other campus VPN clients like EasyConnect (used for free CNKI access) can be deployed in Docker containers. Expose HTTP/SOCKS proxies and configure routing rules to achieve elegant cross-network environment access.

1
2

    - { name: 'CNKI', type: socks5, server: 10.10.10.45, port: 57080}
    - 'DOMAIN-SUFFIX,cnki.net,CNKI'

Docker Deployment Guide for ELK

Sun, 22 May 2022 00:00:00 +0000

📝 Note

deviantony/docker-elk: The Elastic stack (ELK) powered by Docker and Compose. (github.com)

1
2

git clone https://github.com/deviantony/docker-elk
cd docker-elk

`1`	`vim .env`

1
2

docker compose up setup
docker compose up

1
2

docker compose down -v setup
docker compose down -v