LibreELEC inside a docker container?

  • I’ve decided it’s time to consolidate my myriad SBCs down to a single platform (actually, my wife has decided this for me ;)).

    I’d like to containerise everything on this one box to keep it all isolated. Writing Dockerfiles to migrate my other services (OpenVPN, bind, etc) has been easy. I left the LibreELEC box until last because I knew it would be the most difficult.

    I’d prefer to run LE inside a container and not use it as the ‘host’ OS. Some of the other containers contain sensitive information and if a vulnerability in LE exposed them, that would be... bad. Running LE in its own container means I can drop most capabilities and re-map the root user to something less privileged.

    I realise I can just run Kodi itself in a container (there are already a few working examples, using both GBM and X11), but doing that means I lose all the optimisations that make LibreELEC so great.

    So... has anyone looked at running LE inside a container before? Are there any blockers that make this impossible?

  • Not been done, and even if it's possible (which is unlikely due to our weird packaging) we have no interest in supporting the approach.

  • Thanks. I’d anticipated the showstoppers to be related to dtoverlays or kernel models or something similar. I hadn’t even considered the packaging of LE.

    I certainly wouldn’t expect official support for a container-based install. I’d be happy to contribute back if I get something working though. You’d have to admit there are some similarities between LE’s design goals and the docker deployment model; they’re both conceptually a minimal, immutable base layer with a thin read-write area layered on top.

    Edited 2 times, last by tent_icle ().

  • The difference is that one cares about direct hardware access for optimised performance, while the other deliberately abstracts you from direct hardware access for optimised compatibility (for want of a better phrase). Feel free to poke, but it's not a technical direction we're interested in.

  • You might be better off running LE in a VM with a gpu passthrough if consolidation and sandboxing are the primary motivators

  • Thanks for the suggestion. Running it in a VM would be easier in the sense the project already produces an OVA so, yeah, maybe that’s a starting point for now.

    Having said that, a Docker container should actually be both simpler and faster, as it provides proper bare metal access to the hardware (networking is the only components that’s truly abstracted). It’s just a matter of figuring out how to get LE to fit into a container in the first place.

    I know the LE project uses VMs for testing, but I’m not sure how usable that can be as a front-end on a low-power system. Even if the GPU and storage are passed through, you’re still dealing with the overhead of a hypervisor and various layers of virtualization/paravirtualization.

    Anyways, thanks for all the feedback. I will report back on how I go.

    Edited once, last by tent_icle ().