Sunday, December 29, 2019

My Notes on Linux Application Support in ChromeOS (a.k.a. Crostini)

These are my own rough notes from spending a few days studying Chrome OS and its Linux app support on a HP Chromebook 14* I got for free (retails for about £150) when I recently purchased a Google Pixel 4 Android mobile phone. I thought I’d share the notes in case they are of use to others. I’m sure there needs to be some corrections, so feedback is welcome.
 * released: 2019, model: db0003na, codename: careena, board: grunt

Some references to other articles that I used to bootstrap my knowledge:

Below are some screenshots showing the ChromeOS Settings section where “Linux (beta)” (a.k.a. Crostini) can be enabled and the Linux apps that are then installed by default when (essentially just the GNOME Help application and the Terminal application, from which many other Linux apps can subsequently be installed):




Here is a diagram I put together to attempt to capture the architecture of Crostini in ChromeOS as I understand it (the rest of this document digs into the details behind some of these layers):

ChromeOS & Crostini

  • Under the covers, ChromeOS is based on Gentoo and the Portage package manager
  • crosh (ChromeOS Developer Shell) is the pluggable command line shell/terminal for ChromeOS (in the Chrome browser, enter Ctrl-Alt-T to launch crosh inside a browser tab)
  • Crostini is the term for Linux application support in ChromeOS which manages the specific Linux VM and then the specific Linux container inside it, managing the lifecycle of when to launch them, mounting the filesystem to show the container’s files in the ChromeOS Files app, etc.. Crostini provides easy to use Linux application support integrated directly into the running ChromeOS desktop, rather than, for example, needing to dual boot or having to run a separate Linux VM and needing to explicitly switch, via the desktop, between ChromeOS and the Linux VM.
  • ChromeOS also has a Developer mode (verification is disabled when the OS boots) which is a special mode built into all Chromebooks to allow users and developers to access the code behind the Chrome Operating System and load their own builds of ChromeOS. This mode also allows users to install and run another Linux system like Ubuntu instead of ChromeOS (i.e. dual boot), but still have ChromeOS available to boot into too
  • As an alternative to Crostini, in addition to the dual-boot option, developer mode can also be used for Crouton which is a set of scripts that bundle up a chroot generator/environment to run both ChromeOS and Ubuntu at the same time. Here a Linux OS runs alongside ChromeOS, so users can switch between the ChromeOS desktop and Linux desktops via a keyboard shortcut. This gives users the ability to take advantage of both environments without needing to reboot. Unlike with virtualisation, a second OS is not being booted and instead the guest OS is running using the Chromium OS system. As a result any performance penalty is reduced because everything is run natively, and RAM is not being wasted to boot two OSes at the same time. Note, Crostini is different than this Crouton capability, as it enables the Linux shell and apps to be brought into the platform in verified (non-developer) mode with seamless user interface desktop integration and multi-layered security, in a supported way.
  • To use Crostini, from the ChromeOS Settings select ‘Linux (Beta)’ and choose to enable it, which, behind the scenes, will download and configure a specific Linux VM containing a specific Linux Container (see the next sections for more details) and it adds a launcher group to the ChromeOS desktop called ‘Linux Apps’. This launcher group includes a launcher to run a Linux shell/terminal application, called Terminal, which is displayed in the ChromeOS desktop but is connected directly inside the container

Crostini Linux VM Layer

  • crosvm (ChromeOS Virtual Machine Monitor) is a custom virtual machine manager written in Rust that runs guest VMs via Linux's KVM hypervisor virtualisation layer and manages the low-level virtual I/O device communication (Amazon’s Firecracker is a fork of crosvm)
  • A specific VM is used to run a container rather than ChromeOS running a container directly, for security reasons because containers do not provide sufficient security isolation on their own. With the two layers, an adversary has to exploit crosvm via its limited interactions with the guest, in addition to the container, and the VM itself is heavily sandboxed.
  • The VM (and its container) are tied to a ChromeOS login session and as soon as a user logs out, all programs are shut down/killed by design (all user data lives in the user’s encrypted home to ensure nothing is leaked when a user log out). The VM, container and their data are persisted across user sessions and are kept in the same per-user encrypted storage as the rest of the browser's data.
  • KVM generally (rather than Crostini specifically) can execute multiple virtual machines running unmodified Linux or Windows images. Each virtual machine has private virtualised hardware: a network card, disk, graphics adapter, etc. The kernel component of KVM is included in mainline Linux codebase and the userspace component of KVM is included in mainline QEMU codebase
  • Termina is the VM launched by crosvm and is based on a ChromeOS (CrOS) image with a stripped-down ChromeOS Linux kernel and userland tools. The main goal is to just boot up Termina as quickly as possible, as a secure sandbox, and start running containers.
  • Currently, other custom VMs (other Linux variants, Windows, etc) cannot be run and only instances of the Termina VM image can be booted, although multiple VM instances can be run simultaneously based on the Termina image
  • vmc is the crosh command line utility to manually manage custom VM instances via Concierge (the ChromeOS daemon that manages VM/container life cycles)
  • To view the registered VM(s) from crosh (Ctrl-Alt-T), which may or may not be running, run:
vmc list
  • To launch the Termina VM as a VM instance called ‘termina’ and open a shell directly in the VM, run:
vmc start termina
  • With the above command, the default container in the VM will not be started automatically. However, instead, if from the ChromeOS desktop, a Linux Shell (Terminal) or other Linux App is launched (or the ‘Linux files’ app, Files , is launched) the Termina VM is automatically launched and the default container it owns is also automatically started
  • If the Termina VM is already running, to connect to it via a shell, run:
vsh termina
  • If the ‘vmc start’ command is run with a different VM name, a new VM of that name will be created, launched and its shell entered from the existing terminal command line. This will use the same Termina image, and when running, ‘vmc list’ with list both VMs (the new instance doesn’t have any containers defined in it by default, ready to run, unlike the main Termina VM)
  • To stop the main Termina VM, run:
vmc stop termina


Crostini Container Layer

  • The Termina VM only supports running containers using the “Linux Containers” (LXC) technology at the moment and doesn’t support Docker or other container technologies
  • The default container instance launched via Termina is called Penguin and is based on Debian 9 with some custom packages
  • Containers are run inside a VM rather than programs running directly in the VM to help keep VM startup times low, to help improve security sandboxing by providing a stateless immutable VM image and to allow the container, its applications and their dependencies to be maintained independently from the VM, which otherwise may have contradicting dependecy requirements
  • LXC, generally, works in the vanilla Linux kernel requiring no additional patches to be applied to the kernel source and uses various kernel features to contain processes including kernel namespaces (ipc, uts, mount, pid, network and user), Apparmor and SELinux profiles, Seccomp policies, chroots (using pivot_root), CGroups (control groups). LXCFS provides the userspace (FUSE) filesystem providing overlay files for cpuinfo, meminfo, stat and uptime plus a cgroupfs compatible tree allowing unprivileged writes.
  • LXD is a higher level container framework, which Crostini uses and LXD uses its own specific image formats and also provides the ability to manage containers remotely. Although LXD uses LXC under the covers, it is based on more than just LXC. The Termina VM is configured to run the LXD daemon. Confusingly, the command line tool for controlling LXD is called ‘lxc’ (the ‘LXD Client). If users are using LXD commands to manage containers, they should avoid using any commands that start with ‘lxc-’ as these are lower level LXC commands. Users should avoid mixing and matching the use of both sets of commands in the same system. Crostini uses LXD to launch the Penguin container and LXD is configured to only allow unprivileged containers to be run, for added security. Therefore with Crostini, users should not use the lower level ‘lxc-’ commands because these can’t manage the LXD derived containers that Crostini uses. By default, LXD comes with 3 remote repositories providing images: 1) ubuntu: (for stable Ubuntu images), 2) ubuntu-daily: (for daily Ubuntu images), and 3) images: (for other distros)
  • In the Termina VM, the full LXC/LXD capabilities are provided, and remote images for many types of distros can be used to spawn multiple containers, in addition to the main Penguin container (these are not tested or certified though so may or may not work correctly)
  • Sommelier (a Wayland proxy compositor provides seamless X forwarding integration for content, input events, clipboard data, etc... between Linux apps and the ChromeOS desktop) and Garcon (a daemon for passing requests between the container and ChromeOS) binaries are bind-mounted into the main Penguin container. The Penguin container’s systemd is automatically configured to start these daemons. The libraries for these daemons are already present in the Penguin container LXD image used for Penguin (‘google:debian/stretch’). Other LXD containers launched in the VM don't seem to be enabled for their X based GUI apps to be displayed in the ChromeOS desktop, even if they use the special ‘google:debian/stretch’ LXD container image as it seems Crostini won’t attempt to integrate with this at runtime. Note: Some online articles imply it may be possible to get X-forwarding working from multiple containers.
  • In the Penguin container (which users can access directly, via the Terminal app launcher in the ChomeOS desktop), users can query the IP address of the container which is accessible from ChromeOS and can then run crosh (Ctrl-Alt-T) in ChromeOS and ping the IP address of the container directly. Users can also SSH from the ChromeOS desktop to the Penguin container using Google’s official SSH client that can be installed in Chrome via Chrome Web Store
  • If other containers are launched and then Google’s official SSH client is installed in ChromeOS (install ‘Secure Shell Extension’ via the Chrome Web Store), users can then define SFTP mount-points to other non-Penguin containers and the files in these containers will automatically appear in the Files app too 
  • From the Termina VM, users can use the standard LXD lxc command line tool to list containers and then to see if the Penguin container is running, by running:
lxc list
lxc info penguin | grep "Status: "

  • To check the logs for the Penguin container, run:
lxc info --show-log penguin
  • To open a command line shell as root in the running container (note, the Terminal app has a different identity for connecting to the Penguin container, which is a non-root user), run
lxc exec penguin -- /bin/bash
  • Within the Penguin container you can run GUI apps which automatically display in the main ChromeOS user interface. For example to install the GEdit text editor Linux application run the following (which also adds a launcher for GEdit in the ChromeOS desktop ‘Linux Apps’ launcher group):
sudo apt install gedit

  • It is even possible to install and run a new Google Chrome browser installation from the Linux container, by running the following (which also adds a launcher for this Linux version of Chrome in the ChromeOS desktop ‘Linux Apps’ launcher group):
wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
sudo apt install ./google-chrome-stable_current_amd64.deb

  • From crosh (Ctrl-Alt-T), it is also possible to start the main container in the main VM (if not already started) and then connect a shell directly to the main container in the main VM, by running
vmc container termina penguin
vsh termina penguin


Playing with Custom Containers

  • First of all launch crosh (Ctrl-Alt-T), and connect a shell to the Termina VM:
vsh termina
  • Import Google’s own image repository into LXD to include the special Debian image used by Penguin:
lxc remote list
lxc remote add google https://storage.googleapis.com/cros-containers --protocol=simplestreams
lxc remote list
lxc image list google:
lxc image info google:debian/stretch

  • Launch and test a container using Google’s special Debian 9 image:
lxc launch google:debian/stretch mycrosdebiancontainer
lxc list
lxc exec mycrosdebiancontainer -- /bin/bash
cat /etc/*elease*
apt update && apt upgrade -y
exit

  • Launch and test a container using a standard Ubuntu 18.04 image:
lxc launch ubuntu:18.04 myubuntucontainer
lxc list
lxc exec myubuntucontainer -- /bin/bash
cat /etc/*elease*
apt update && apt upgrade -y
exit

  • Launch and test a container using a standard Centos 7 image:
lxc launch images:centos/7 mycentoscontainer
lxc list
lxc exec mycentoscontainer -- /bin/bash
cat /etc/*elease*
yum -y update
exit

  • If the Chromebook is rebooted and the Termina VM restarted, these 3 containers still exist as they are persisted, but they will be in a stopped state. When the containers are then manually restarted they will still have the same settings, files and modifications that were made before they were stopped. To start a stopped container run (example shown for one of the containers):
lxc start myubuntucontainer
  • None of the containers launched above seem to enable GUI apps (e.g. GEdit) to be forwarded automatically to the ChromeOS desktop. Even though the ‘google:debian/stretch’ based container has the relevant X forwarding libraries bundled, it doesn't seem to be automatically integrated with at runtime by the Crostini framework to enable X forwarding
  • Another way to launch a new container is to use one of the following commands, although, again, neither seem to automatically configure X-forwarding, even though they use the ‘google:debian/stretch’ image. It seems that only the Penguin container specifically is beiung managed by Crostini and has X forwarding configured (the first command below should be launched from ChromeOS crosh, the second command which is deprecated performs the same action but should be run from inside the Termina VM:
vmc container termina mycontainer
run_container.sh --container_name=mycontainer --user=jdoe --shell

  • Note, this may throw a timeout error similar to below, but the containers do seem to be created ok:
Error: routine at frontends/vmc.rs:397 `container_create(vm_name,user_id_hash,container_name,image_server,image_alias)` failed: timeout while waiting for signal


Song for today: The Desert Song, No.2 - live by Sophia

16 comments:

madin said...

Since 1848, Omega watches built a reputation of being the ultimate in luxurious elegance and sporty sophistication. In 1931, replica watches salethe brand entered the Geneva Observatory trials, replica omega watches salecompeting in several categories designed to test the rigor and mechanical reliability of the Omega timepiece. The brand won all six categories and thereby adopted the slogan, "Omega, exact time for life." In 1965, NASA selected Omega to be the official watch used in training and space exploration. A true giant in name and reliability, Omega produces elegant watches that are impervious to changes in fashion. At , we offer a variety of Omega watches for sale — at the lowest prices online. When you are ready to buy an Omega watch, browse our selection that includes the: Seamaster, Speedmaster, 1957 Trilogy, DeVille, Planet Ocean, and Constellation.

madin said...

Louis Vuitton himself was born the son of a miller in 1821 in Anchay, a hamlet in the Jura Mountains, not far from the Swiss border. Replica bagsThe region was a poor one - serfdom had only been abolished less than 40 years previously, so Louis left to seek his fortune when he was a teenager, arriving in the French capital aged 16. This was the Paris of Victor Hugo's Les Misérables, with nearly one million inhabitants. As the composer Chopin said in a letter to a friend at the time, "Here you find the greatest luxury and the greatest filth, the greatest virtue and the greatest vice."replica Louis Vuiton bags

madin said...

Today it may be one of the biggest and most profitable luxury brands on the planet, Replica handbags a byword for indulgence from Beijing to Bond Street, replica Louis Vuiton bags but Louis Vuitton's origins are more humble, dating back to a young man who left home to make his living packing luggage for the great and the good in 19th-century Paris.

madin said...

Paris Fashion Week would Replica handbags uk have been incomplete without replica Yves Saint Laurent bags Anthony Vaccarello’s homage to maison founder Yves Saint Laurent in the Saint Laurent spring/summer 2019 collection.

madin said...

replica mont blanc uk is a brand with a long history. Founded in 1906, the replica mont blanc donation penscompany is named after one of the highest mountains in Europe, marking the brand's commitment to producing fine writing instruments. Using the brand that produces the best writing instruments, it helps to know how to find the Montblanc fountain pen that works best for you. From the best Montblanc fountain pens to ballpoint and ballpoint pens, you have a choice. Whether you are a collector or a keen writer, this article will take you to the top 10 Montblanc fountain pens on the market.

madin said...

Montblanc MeisterstückClassique black ballpoint pen with gold accessories replica mont blanc uk is one of the most famous Montblanc fountain pens replica mont blanc donation pens and is considered one of the writing instruments. The design icon has a white snow cap insignia and has its own personal serial number, which means that the pen you own will be unique. Montblanc ballpoint pens are a must-have Montblanc ballpoint pens, popular with gift buyers, corporate customers and serious pen collectors. The smoothness of the ballpoint pen mechanism makes writing luxurious and enjoyable.

madin said...

Rolex watches are made from the finest raw materials and carefully selected.replica rolex watches uk Each component is designed, fake submariner watches developed and produced in-house to the strictest standards.

madin said...

Founded in 1905, Rolex watches have been in the uk replica rolex field of innovation for more than a century. The fake cosmograph daytona watches first certified precision chronograph, the first self-winding watch and the first effective waterproof case are milestones in Rolex design. Today, the Rolex brand is immediately recognized as a symbol of global reputation, luxury and innovation. Buying a Rolex watch means you are buying a watch history. Here we have a large catalog of used Rolex special watches for sale.

madin said...

No outfit is complete without the perfect pair of shoes,cheap giuseppe zanotti shoes and it's not always cheap man giuseppe zanotti shoes easy to find them. But with this exceptional range by Giuseppe Zanotti, that's a thing of the past. An elaborate and sometimes wild journey into eccentric design choices,cheap man giuseppe zanotti shoes this collection of shoes is for all those who want to really try something new. The base shoes themselves hark back to classic designs 'sneakers, ankle boots, and so on 'but the detailing is something that's all its own. You'll find buckles, straps, fringes and much more on many of the pieces in the Giuseppe Zanotti range 'but there are also several pieces with an understated charm, too. Are you a wild one or a little more reserved? With this collection, both schools are catered for.

madin said...

Ha sido un hito en la industria desde que Longines estableció su marca en Saint-Imier en 1832.relojes réplica Hoy, la marca ofrece una variedad de relojes para hombres y mujeres. longines relojes réplicaLos relojes Longines se han utilizado a lo largo de la historia, desde la aventura hasta la expresión elegante. Además de ser conocido por su conexión con el mundo de las carreras y la equitación, Longines también es conocido mundialmente por su refinamiento elegante y atemporal. Tenemos una variedad de relojes Longines a la venta, todos nuevos, hermosos y garantizados para ser auténticos. Aún mejor, cuando compra Longines en línea, sabe que está obteniendo el mayor valor. Explore nuestra lista de selección para encontrar los mejores precios de relojes en Longines en Internet.

madin said...

Short for Monestier-de-Clermont, cheap moncler jackets uk an Alpine town near Grenoble,replica man moncler jackets France, Moncler was founded in 1952 by René Ramillon as an outdoor-gear company, producing sleeping bags, tents, and other mountain-climbing necessities. Today, the French-Italian label is best known for its lightweight, super-warm quilted down jackets, as well as ready-to-wear and accessories hardy enough to take on harsh winter weather.

madin said...

Breitling watches have been at the pinnacle of the replica watches uk watch industry since entering the marketplace in 1884. replica breitling watches Today, the Breitling name is a true giant among timepiece manufacturers, renowned for inventing the chronograph and for exceptional quality control standards. When you buy a Breitling watch, you choose a product made with excellence in precision. Breitling is a standard in the aviation and driving industries, as well as a favorite of the adventurer. Some of the most iconic collections include the: Navitimer, Bentley, Superocean, Avenger, Galactic, Chronomat, and Transocean. we offer a variety of authentic Breitling watches for sale in men's and women's styles. Shop our site to find the best in discount Breitling watches online.

madin said...

Based in Saint-Imier, replica longines watches Switzerland since 1832,replica mens longines watches Longines' watchmaking expertise reflects a strong devotion to tradition, elegance, and performance.

madin said...

Use Alexander McQueen shoes to create a look from the feet.Cheap ALEXANDER MCQUEEN Shoes Wacky women's sneakers use jewellery replica mens ALEXANDER MCQUEEN embellishments and iconic skull motifs to instantly elevate any casual outfit to luxury, while glossy leather boots

madin said...

Based in Saint-Imier, replica longines watches Switzerland since 1832,replica mens longines watches Longines' watchmaking expertise reflects a strong devotion to tradition, elegance, and performance.

madin said...

Det komplette udvalg af alle Ray-Ban solbriller replika Ray-Ban solbriller stilarter tilgængelige online. replika Ray-Ban solbriller New Arrival Gennemse mellem nye eller klassiske rammer, linser og farver for at finde de nuancer, der matcher din stil. Oplev det komplette udvalg af kvinders solbriller og mænds designer nuancer gennem de ikoniske Ray-Ban modeller. Handle nu i den officielle onlinebutik og modtag gratis forsendelse på alle ordrer.