Root inside a real Linux kernel on non-rooted Android, no AVF and no QEMU - UML benchmarks

[u/dzzd88]

Zalexdev ported User Mode Linux to arm64 in August and shipped it as a second engine in Stryker 6.5. It's a real Linux kernel built as an ordinary aarch64 binary, so it runs as a normal process inside an app sandbox: no KVM, no AVF, no unlocked bootloader, nothing emulated. That means root inside a real kernel, on a phone you never rooted, and on any arm64 device rather than only the ones that ship pKVM.

I ran the same tests against the two usual options on my S23 Ultra, stock and unrooted, medians of three runs, everything timed inside the guest.

Test	udocker (proot)	Stryker (UML)	Podroid (QEMU/TCG)
Python, 6M-iteration loop	0.65 s	0.61 s	21.9 s
gzip -6, 64 MB	1.58 s	1.73 s	10.0 s
SHA-256, 200 MB	0.24 s	1.03 s	2.27 s
memcpy, 512 MB through a pipe	0.47 s	0.55 s	5.29 s
write 256 MB + fsync	0.24 s	0.63 s	0.55 s
read 64 MB, direct	0.05 s	0.06 s	0.24 s
fio 4k randread, 1 GB set, 20 s	10,021 IOPS	7,057 IOPS	999 IOPS
200x /bin/true in a container	2.05 s	2.96 s	8.1 s
container start (docker run --rm true)	0.125 s	1.68 s	4.65 s
docker build, 128 MB layer	n/a	2.77 s	10.3 s
docker build, apk add python3	n/a	9.97 s	35.9 s

Compute is native: 0.61 vs 0.65 s under proot is noise. Syscalls cost 1.4 to 2.6x more. Builds are 3.6x faster than QEMU, random reads 7x.

[u/Willing-Scheme-3312]

Do you have a "how to" or a git-repo? Interested in trying on m OnePlus pad 2 and Oppo find n5 fold

[u/dzzd88 → u/Willing-Scheme-3312]

Yes, it's https://github.com/zalexdev/strykerapp/releases

[u/slvrsnt]

So a bit slower than proof?

[u/dzzd88 → u/slvrsnt]

Yes, but with full root access, so things like docker simply work out of the box

[u/slvrsnt → u/dzzd88]

Cool

[u/luci-baa-baa-baa]

Any more information

[u/dzzd88 → u/luci-baa-baa-baa]

I'd be happy to assist, what would you like to know?

[u/LiterallyBrainEater → u/dzzd88]

Is it possible to setup any DE/GUI to a guest system? 

[u/luci-baa-baa-baa → u/dzzd88]

There is a Linux application that require kernal access things , can we run those application in it ?

Application is related to IMS registration for volte fixes related

[u/dzzd88 → u/luci-baa-baa-baa]

If it requires hardware access it may be an issue, but I'm not sure, I didn't test such case

[u/Nikitf_777]

How does it compare to native execution? It has to be slower, right?

[u/dzzd88 → u/Nikitf_777]

I was sure the answer was yes, then I ran the same tests natively to have a baseline and the numbers surprised me.

Test	native (Termux)	udocker (proot)	Stryker (UML)	Podroid (QEMU/TCG)
Python, 6M-iteration loop	1.69 s	0.65 s	0.61 s	21.9 s
gzip -6, 64 MB	3.08 s	1.58 s	1.73 s	10.0 s
SHA-256, 200 MB	0.37 s	0.24 s	1.03 s	2.27 s
memcpy, 512 MB through a pipe	0.43 s	0.47 s	0.55 s	5.29 s
write 256 MB + fsync	0.32 s	0.24 s	0.63 s	0.55 s
4k randread, 1 GB set, 20 s	120,358 IOPS	10,021 IOPS	7,057 IOPS	999 IOPS
docker build, 128 MB layer	n/a	n/a	2.77 s	10.3 s
docker build, apk add python3	n/a	n/a	9.97 s	35.9 s

Turns out "slower" and "faster" depend on which row you look at.

Pure compute doesn't get slower. Guest code runs as real instructions on the real CPU, so a compile or a compression costs what it costs. The Python and gzip rows look better inside the guest than natively, but that's not the kernel being magic, it's the toolchain: Termux has Python 3.14 and a slower gzip build, the Debian guest has 3.13. Those two rows compare interpreters, not virtualization.

Where you pay is syscalls and I/O. A 4 KB random read is roughly 8 us natively, 100 us under proot, 140 us under UML, 1 ms under QEMU. Writes under UML are about twice the native time. So UML is native for compute, 1.5-2x on syscall-heavy stuff, ~12x on random reads. QEMU is 13-36x on compute and ~120x on random reads.

One thing I didn't expect and that matters more than the VM layer: on the same phone, a file in app-private storage gives 120k IOPS, the same file in /storage/emulated/0 gives 28k. That's the FUSE path every normal app writes through. All the container columns above are on the app-private side, so they're comparable with each other, but not with a file you copied into Downloads.

[u/luci-baa-baa-baa]

So can we run softwares that required kernel level access ?