How cyanmint/lkm4ctr works
lkm4ctr is a rooted-device Android kernel module that supplies container prerequisites on a matching GKI/KMI kernel. The documented user workflow is to install overlay support, load the module, start Docker with host networking, and run a container. Its main runtime work is to provide namespace and IPC behavior through kernel hooks, with procfs support and diagnostics/control exposed separately. The graph uses sampled glue code and README capabilities; unsampled implementation details are represented only where the tree supports a path.
Main entry points: vendor_kernel_syscalls.c Namespace syscall hooks · vendor_kernel_module.c Vendor lifecycle · lkm4ctr_diagfs.c Diagnostics filesystem · lkm4ctr_checker.c Isolation checker
Components 18
Container setup
- Overlay support
glue/vendor_kernel_overlay.c
Kernel integration
- Module lifecycle
glue/lkm4ctr_main.c - Shadow hook engine
glue/shadow_hijack.c - Vendor lifecycle
glue/vendor_kernel_module.c - Namespace syscall hooks
glue/vendor_kernel_syscalls.c - User ID mapping
glue/vendor_kernel_syscalls_userns.c - Namespace procfs
glue/vendor_kernel_procfs.c - IPC syscalls
glue/vendor_kernel_ipc_syscalls.c - Kernel symbol compatibility
glue/vendor_kernel_compat.c - IPC compatibility
glue/vendor_kernel_ipc_compat.c - Overlay VFS compatibility
glue/vendor_kernel_ovl_vfs_compat.h
Diagnostics and control
- Diagnostics filesystem
glue/lkm4ctr_diagfs.c - Namespace and resource reports
glue/vendor_kernel_diag.c - In-place hot reload
glue/lkm4ctr_hotreload.c
User diagnostics
- Isolation checker
lkm4ctr_checker/lkm4ctr_checker.c
Other components
- Root administrator
- Android kernel
- Docker daemon
Connections 22
- Root administrator → Overlay support: installs
- Root administrator → Module lifecycle: loads module
- Root administrator → Diagnostics filesystem: mounts and controls
- Root administrator → Isolation checker: runs checks
- Docker daemon → Android kernel: requests container operations
- Android kernel → Shadow hook engine: invokes hooks
- Module lifecycle → Vendor lifecycle: initializes
- Vendor lifecycle → Shadow hook engine: resolves and installs
- Vendor lifecycle → Namespace syscall hooks: registers hooks
- Vendor lifecycle → IPC syscalls: initializes IPC hooks
- Namespace syscall hooks → Kernel symbol compatibility: uses resolved symbols
- Namespace syscall hooks → User ID mapping: delegates ID mapping
- Namespace syscall hooks → Namespace procfs: supports namespace procfs
- IPC syscalls → IPC compatibility: uses resolved symbols
- Android kernel → Namespace syscall hooks: dispatches namespace calls
- Android kernel → IPC syscalls: dispatches IPC calls
- Android kernel → Namespace procfs: requests namespace metadata
- Overlay support → Overlay VFS compatibility: uses VFS compatibility
- Diagnostics filesystem → Namespace and resource reports: renders reports
- Diagnostics filesystem → In-place hot reload: triggers reload
- Isolation checker → Android kernel: probes isolation
- Isolation checker → Root administrator: reports results