{"id":2888,"date":"2026-06-14T04:08:17","date_gmt":"2026-06-14T04:08:17","guid":{"rendered":"https:\/\/tucumandevelopers.com\/index.php\/2026\/06\/14\/run-real-docker-on-android-no-root-no-tricks-just-qemu\/"},"modified":"2026-06-14T04:08:17","modified_gmt":"2026-06-14T04:08:17","slug":"run-real-docker-on-android-no-root-no-tricks-just-qemu","status":"publish","type":"post","link":"https:\/\/tucumandevelopers.com\/index.php\/2026\/06\/14\/run-real-docker-on-android-no-root-no-tricks-just-qemu\/","title":{"rendered":"Run Real Docker on Android \u2014 No Root, No Tricks, Just QEMU"},"content":{"rendered":"
\n
\n

Phone battery tip:<\/strong> If your phone has a “Protect Battery” or “Maximum 85%” setting (Samsung does), turn it on. The phone will be plugged in 24\/7, and capping the charge doubles the battery’s lifespan.<\/p>\n

\n

<\/a> The architecture (mental model) <\/h2>\n

Here’s what we’re building: <\/p>\n

\n
\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 Your Android phone (not rooted) \u2502 \u2502 \u2502 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 \u2502 \u2502 Termux (regular Android app) \u2502 \u2502 \u2502 \u2502 - QEMU binary (qemu-system-aarch64) \u2502 \u2502 \u2502 \u2502 - The .qcow2 disk image \u2502 \u2502 \u2502 \u2502 - Boot scripts \u2502 \u2502 \u2502 \u2502 - sshd (port 8022) \u2192 your computer SSHes \u2502 \u2502 \u2502 \u2502 in here for management \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u2502 \u2502 launches \u2502 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25bc\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 \u2502 \u2502 QEMU VM (looks like real ARM64 hardware) \u2502 \u2502 \u2502 \u2502 - Debian 12 (bookworm) \u2502 \u2502 \u2502 \u2502 - Real dockerd + Docker Compose v2 \u2502 \u2502 \u2502 \u2502 - sshd (port 22 \u2192 forwarded to 2222) \u2502 \u2502 \u2502 \u2502 - systemd works (unlike in proot) \u2502 \u2502 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2191 \u2502 SSH from your computer \u2502 ssh phone-vm \u2192 port 2222 \u2192 Debian VM \u2502 ssh phone-termux \u2192 port 8022 \u2192 Termux shell <\/code><\/pre>\n
\n<\/p><\/div>\n<\/p><\/div>\n
Two SSH targets. phone-vm<\/code><\/strong> drops you into Debian where Docker lives. phone-termux<\/code><\/strong> drops you into Termux itself (the Android-side layer), useful for troubleshooting the VM or restarting QEMU.<\/p>\n
Why QEMU and not just proot-distro?<\/strong> Three reasons:<\/p>\n
    \n
  1.  proot-distro has no systemd.<\/strong> No systemd means no systemctl enable docker<\/code>. You’d have to manually start the daemon on every login.<\/li>\n
  2.  proot-distro has no cgroups.<\/strong> No cgroups means no container resource control. Docker will refuse to start.<\/li>\n
  3.  proot-distro has no real namespaces.<\/strong> No namespaces means no isolation. Containers would see each other.<\/li>\n<\/ol>\n
    QEMU gives us a real Linux kernel with all three. The cost is speed \u2014 every instruction is translated by QEMU’s TCG (Tiny Code Generator) software emulator. That’s why boot takes 20\u201330 minutes.<\/p>\n
    \n
      <\/a> Step 1: Install Termux (the right way) <\/h2>\n
    Do not install Termux from the Play Store.<\/strong> The Play Store version is frozen at v0.101 from 2020 and has a known security vulnerability. Install from F-Droid<\/strong> or the GitHub releases<\/strong> \u2014 but pick one and stick with it, because they’re signature-incompatible with each other.<\/p>\n
    The cleanest option is F-Droid. Go to f-droid.org\/en\/packages\/com.termux<\/a> on your phone and install the APK.<\/p>\n
    While you’re at it, also install Termux:Boot<\/strong> from F-Droid: f-droid.org\/en\/packages\/com.termux.boot<\/a>. This is what makes QEMU auto-start when the phone reboots. We’ll configure it in Step 7.<\/p>\n
    After installing Termux:Boot, open it once.<\/strong> Just tap the icon, then close. This registers it with Android’s BOOT_COMPLETED<\/code> broadcast. If you skip this, the auto-start script in Step 7 won’t fire.<\/p>\n
    Now open Termux. You should see a $<\/code> prompt. Run: <\/p>\n
    \n
    pkg update -y<\/span> &&<\/span> pkg upgrade -y<\/span> <\/code><\/pre>\n
    \n<\/p><\/div>\n<\/p><\/div>\n
    This updates the package lists and upgrades everything. First run takes 1\u20132 minutes.<\/p>\n
    If it hangs on a mirror, run termux-change-repo<\/code>, pick “Main repository”, and select a mirror close to you. Indonesian users: linux.domainesia.com<\/code> and mirror.nevacloud.com<\/code> are in the Asia group.<\/p>\n
    \n
      <\/a> Step 2: Set up SSH so you can work from your computer <\/h2>\n
    Typing long commands on a phone keyboard is miserable. Let’s fix that by setting up SSH from your computer.<\/p>\n
      <\/a> 2.1 Grant storage access (one-time) <\/h3>\n
    In Termux: <\/p>\n
    \n
    termux-setup-storage <\/code><\/pre>\n
    \n<\/p><\/div>\n<\/p><\/div>\n
    A dialog pops up on your phone asking for storage permission. Tap “Allow”. This creates ~\/storage\/<\/code> symlinks to shared storage \u2014 not strictly needed for QEMU, but useful later if you want to back up your disk image.<\/p>\n
      <\/a> 2.2 Set a Termux password <\/h3>\n
    \n
    passwd <\/code><\/pre>\n
    \n<\/p><\/div>\n<\/p><\/div>\n
    Type a password twice. You’ll need this for SSH (though we’ll set up key-based auth in a moment).<\/p>\n
      <\/a> 2.3 Add your computer’s SSH public key <\/h3>\n
    On your computer<\/strong>, get your public key: <\/p>\n
    \n
    # macOS \/ Linux \/ WSL<\/span> cat<\/span> ~\/.ssh\/id_ed25519.pub <\/code><\/pre>\n
    \n<\/p><\/div>\n<\/p><\/div>\n
    If you don’t have one, generate it: <\/p>\n
    \n
    ssh-keygen -t<\/span> ed25519 -C<\/span> \"your-email@example.com\"<\/span> # Press Enter through all the prompts<\/span> <\/code><\/pre>\n
    \n<\/p><\/div>\n<\/p><\/div>\n
    Copy the output (a string starting with ssh-ed25519 AAAA...<\/code>).<\/p>\n
    Back in Termux<\/strong> on the phone: <\/p>\n
    \n
    mkdir<\/span> -p<\/span> ~\/.ssh &&<\/span> chmod <\/span>700 ~\/.ssh echo<\/span> 'PASTE_YOUR_PUBLIC_KEY_HERE'<\/span> >><\/span> ~\/.ssh\/authorized_keys chmod <\/span>600 ~\/.ssh\/authorized_keys <\/code><\/pre>\n
    \n<\/p><\/div>\n<\/p><\/div>\n
    Replace PASTE_YOUR_PUBLIC_KEY_HERE<\/code> with the key you copied. Keep the single quotes around it.<\/p>\n
      <\/a> 2.4 Start the SSH server <\/h3>\n
    \n
    sshd <\/code><\/pre>\n
    \n<\/p><\/div>\n<\/p><\/div>\n
    No output means it started. Termux’s sshd listens on port 8022<\/strong> (not the usual 22 \u2014 Android reserves 22 for the system).<\/p>\n
      <\/a> 2.5 Find your phone’s IP <\/h3>\n
    \n
    ip addr show wlan0 | grep <\/span>inet <\/code><\/pre>\n
    \n<\/p><\/div>\n<\/p><\/div>\n
    You’ll see something like inet 192.168.0.9\/24<\/code>. Note the IP (without the \/24<\/code>).<\/p>\n
      <\/a> 2.6 Set up SSH config on your computer <\/h3>\n
    On your computer<\/strong>, edit ~\/.ssh\/config<\/code> and add: <\/p>\n
    \n
    Host<\/span> phone-termux HostName<\/span> 192<\/span>.168.0.9 Port<\/span> 8022<\/span> User<\/span> u0_a892 IdentityFile<\/span> ~\/.ssh\/id_ed25519 ControlMaster<\/span> auto<\/span> ControlPath<\/span> ~\/.ssh\/controlmasters\/%r@%h:%p ControlPersist<\/span> 10<\/span>m <\/code><\/pre>\n
    \n<\/p><\/div>\n<\/p><\/div>\n
    Replace 192.168.0.9<\/code> with your phone’s IP. The User<\/code> looks weird (u0_a892<\/code>) \u2014 that’s Termux’s Android UID, which is also its Linux username. The number after u0_a<\/code> varies per install; to find yours, run whoami<\/code> in Termux.<\/p>\n
    Create the controlmasters directory (needed for connection multiplexing, which makes repeated SSH commands nearly instant): <\/p>\n
    \n
    mkdir<\/span> -p<\/span> ~\/.ssh\/controlmasters <\/code><\/pre>\n
    \n<\/p><\/div>\n<\/p><\/div>\n
    Now test: <\/p>\n
    \n
    ssh phone-termux whoami<\/span> # \u2192 u0_a892<\/span> <\/code><\/pre>\n
    \n<\/p><\/div>\n<\/p><\/div>\n
    If that works, you’re set. From now on, you can run commands in Termux from the comfort of your computer’s keyboard.<\/p>\n
    \n
      <\/a> Step 3: Download Debian and build the cloud-init seed <\/h2>\n
    Back in Termux (either on the phone directly, or via ssh phone-termux<\/code> from your computer):<\/p>\n
      <\/a> 3.1 Install QEMU and friends <\/h3>\n
    \n
    pkg install<\/span> -y<\/span> qemu-system-aarch64 openssh curl wget genisoimage <\/code><\/pre>\n
    \n<\/p><\/div>\n<\/p><\/div>\n
    This installs:<\/p>\n