# cyanmint/lkm4ctr architecture

> Architecture diagram of the GitHub repository cyanmint/lkm4ctr, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/cyanmint/lkm4ctr
- Repository: https://github.com/cyanmint/lkm4ctr

## Overview

lkm4ctr is a rooted-device Android kernel module that supplies container prerequisites on a matching GKI/KMI kernel. The documented user workflow is to install overlay support, load the module, start Docker with host networking, and run a container. Its main runtime work is to provide namespace and IPC behavior through kernel hooks, with procfs support and diagnostics/control exposed separately. The graph uses sampled glue code and README capabilities; unsampled implementation details are represented only where the tree supports a path.

Main entry points: [`glue/vendor_kernel_syscalls.c`](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_syscalls.c) (Namespace syscall hooks), [`glue/vendor_kernel_module.c`](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_module.c) (Vendor lifecycle), [`glue/lkm4ctr_diagfs.c`](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/lkm4ctr_diagfs.c) (Diagnostics filesystem), [`lkm4ctr_checker/lkm4ctr_checker.c`](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/lkm4ctr_checker/lkm4ctr_checker.c) (Isolation checker)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_setup["Container setup"]
  node_overlay["Overlay support"]
end

subgraph group_kernel["Kernel integration"]
  node_module["Module lifecycle<br/>[lkm4ctr_main.c]"]
  node_hookengine["Shadow hook engine<br/>[shadow_hijack.c]"]
  node_vendorlife["Vendor lifecycle"]
  node_namespace["Namespace syscall hooks"]
  node_userns["User ID mapping"]
  node_procfs["Namespace procfs"]
  node_ipc["IPC syscalls"]
  node_compat["Kernel symbol compatibility"]
  node_ipccompat["IPC compatibility"]
  node_ovlcompat["Overlay VFS compatibility"]
end

subgraph group_control["Diagnostics and control"]
  node_diagfs["Diagnostics filesystem<br/>[lkm4ctr_diagfs.c]"]
  node_vendordiag["Namespace and resource reports"]
  node_hotreload["In-place hot reload"]
end

subgraph group_tools["User diagnostics"]
  node_checker["Isolation checker<br/>[lkm4ctr_checker.c]"]
end

node_admin(("Root administrator"))
node_kernelcore["Android kernel"]
node_docker["Docker daemon"]

node_admin -->|"installs"| node_overlay
node_admin -->|"loads module"| node_module
node_admin -->|"mounts and controls"| node_diagfs
node_admin -->|"runs checks"| node_checker
node_docker -->|"requests container operations"| node_kernelcore
node_kernelcore -->|"invokes hooks"| node_hookengine
node_module -->|"initializes"| node_vendorlife
node_vendorlife -->|"resolves and installs"| node_hookengine
node_vendorlife -->|"registers hooks"| node_namespace
node_vendorlife -->|"initializes IPC hooks"| node_ipc
node_namespace -->|"uses resolved symbols"| node_compat
node_namespace -->|"delegates ID mapping"| node_userns
node_namespace -->|"supports namespace procfs"| node_procfs
node_ipc -->|"uses resolved symbols"| node_ipccompat
node_kernelcore -->|"dispatches namespace calls"| node_namespace
node_kernelcore -->|"dispatches IPC calls"| node_ipc
node_kernelcore -->|"requests namespace metadata"| node_procfs
node_overlay -->|"uses VFS compatibility"| node_ovlcompat
node_diagfs -->|"renders reports"| node_vendordiag
node_diagfs -->|"triggers reload"| node_hotreload
node_checker -->|"probes isolation"| node_kernelcore
node_checker -->|"reports results"| node_admin

click node_overlay "https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_overlay.c"
click node_module "https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/lkm4ctr_main.c"
click node_hookengine "https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/shadow_hijack.c"
click node_vendorlife "https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_module.c"
click node_namespace "https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_syscalls.c"
click node_userns "https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_syscalls_userns.c"
click node_procfs "https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_procfs.c"
click node_ipc "https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_ipc_syscalls.c"
click node_compat "https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_compat.c"
click node_ipccompat "https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_ipc_compat.c"
click node_ovlcompat "https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_ovl_vfs_compat.h"
click node_diagfs "https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/lkm4ctr_diagfs.c"
click node_vendordiag "https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_diag.c"
click node_hotreload "https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/lkm4ctr_hotreload.c"
click node_checker "https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/lkm4ctr_checker/lkm4ctr_checker.c"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_overlay toneBlue
class node_module,node_hookengine,node_vendorlife,node_namespace,node_userns,node_procfs,node_ipc,node_compat,node_ipccompat,node_ovlcompat toneAmber
class node_diagfs,node_vendordiag,node_hotreload toneMint
class node_checker toneRose
class node_admin,node_kernelcore,node_docker toneIndigo
```

## Components

### Container setup

- [Overlay support](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_overlay.c): `glue/vendor_kernel_overlay.c`

### Kernel integration

- [Module lifecycle](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/lkm4ctr_main.c): `glue/lkm4ctr_main.c`
- [Shadow hook engine](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/shadow_hijack.c): `glue/shadow_hijack.c`
- [Vendor lifecycle](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_module.c): `glue/vendor_kernel_module.c`
- [Namespace syscall hooks](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_syscalls.c): `glue/vendor_kernel_syscalls.c`
- [User ID mapping](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_syscalls_userns.c): `glue/vendor_kernel_syscalls_userns.c`
- [Namespace procfs](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_procfs.c): `glue/vendor_kernel_procfs.c`
- [IPC syscalls](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_ipc_syscalls.c): `glue/vendor_kernel_ipc_syscalls.c`
- [Kernel symbol compatibility](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_compat.c): `glue/vendor_kernel_compat.c`
- [IPC compatibility](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_ipc_compat.c): `glue/vendor_kernel_ipc_compat.c`
- [Overlay VFS compatibility](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_ovl_vfs_compat.h): `glue/vendor_kernel_ovl_vfs_compat.h`

### Diagnostics and control

- [Diagnostics filesystem](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/lkm4ctr_diagfs.c): `glue/lkm4ctr_diagfs.c`
- [Namespace and resource reports](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/vendor_kernel_diag.c): `glue/vendor_kernel_diag.c`
- [In-place hot reload](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/glue/lkm4ctr_hotreload.c): `glue/lkm4ctr_hotreload.c`

### User diagnostics

- [Isolation checker](https://github.com/cyanmint/lkm4ctr/blob/lkm4ctr/lkm4ctr_checker/lkm4ctr_checker.c): `lkm4ctr_checker/lkm4ctr_checker.c`

### Other components

- **Root administrator**
- **Android kernel**
- **Docker daemon**

## Connections

- Root administrator → Overlay support: installs
- Root administrator → Module lifecycle: loads module
- Root administrator → Diagnostics filesystem: mounts and controls
- Root administrator → Isolation checker: runs checks
- Docker daemon → Android kernel: requests container operations
- Android kernel → Shadow hook engine: invokes hooks
- Module lifecycle → Vendor lifecycle: initializes
- Vendor lifecycle → Shadow hook engine: resolves and installs
- Vendor lifecycle → Namespace syscall hooks: registers hooks
- Vendor lifecycle → IPC syscalls: initializes IPC hooks
- Namespace syscall hooks → Kernel symbol compatibility: uses resolved symbols
- Namespace syscall hooks → User ID mapping: delegates ID mapping
- Namespace syscall hooks → Namespace procfs: supports namespace procfs
- IPC syscalls → IPC compatibility: uses resolved symbols
- Android kernel → Namespace syscall hooks: dispatches namespace calls
- Android kernel → IPC syscalls: dispatches IPC calls
- Android kernel → Namespace procfs: requests namespace metadata
- Overlay support → Overlay VFS compatibility: uses VFS compatibility
- Diagnostics filesystem → Namespace and resource reports: renders reports
- Diagnostics filesystem → In-place hot reload: triggers reload
- Isolation checker → Android kernel: probes isolation
- Isolation checker → Root administrator: reports results