Description

CiC is Intel’s open source Android solution for running Celadon on a Linux based container environment, in order to achieve high-scalability, low performance overhead for some emerging use cases such as Cloud Gaming, IOT and FCF.

To support CiC running multiple Android instances on a single kernel without interfering each other, the following isolation approach is implemented:

Running CiC requires modern PCs with 6th generation or newer Intel® Architecture Processors with integrated GPU. The Intel NUC model NUC7i7BNH and model NUC7i5BNH are recommended devices to try out the CiC features.

Prerequisites

Build the CiC Package

1. Refer to the Build Celadon From Source section in the Getting Started Guide to set up the Celadon source tree and the build environment. There are two build targets associated with the CiC builds:

   cic

   The lunch target which is Android CDD compliant.

   cic_dev

   The lunch target for development purposes (available on the CiC branch of the Celadon Android-P release). This lunch target is deprecated.

2. Run the following commands to select cic-userdebug as the lunch target and start the build. The CiC package is generated at $OUT/$TARGET_PRODUCT-*.tar.gz.

   $ source build/envsetup.sh
   $ lunch cic-userdebug
   $ make cic -j $(nproc)
   

Deploy on Target

1. Download and extract the CiC package tar file on the target device.

2. The CiC image supports secure mode and non-secure mode. In secure mode, Trusty is enabled and SELinux policy is set to enforcing mode, thus you can’t modify the /system partition, update the docker container is not possible. In addition, since Trusty should implement a secure storage service based on the RPMB partition in eMMC, the following step includes instructions on how to set up a teedata partition to simulate the RPMB secure storage.

   In contrast, Trusty is disabled and SELinux policy is set to permissive mode in non-secure mode. The container can be updated, and you can modify the /system partition as well.

3. Skip this step if you are setting up the CiC image in non-secure mode.

   1. A ‘teedata’ disk partition is required to run CiC in secure mode. Create a new disk partition of 32M bytes in size with the name ‘teedata’ if there are unallocated disk space on the target device. You may reference this article to shrink the root partition of an existing Ubuntu setup, if no disk space can be reserved as the teedata partition.

      The following example boots the device from a Ubuntu live-CD, runs the gparted utility, right-clicks the root partition and selects Resize/Move item to reserve 32MB disk space at the bottom of the root disk:

      

   2. To create a ‘teedata’ partition, right-click the unallocated partition, select New item, create a new partition named “’teedata”, set its label to “’teedata” as well, and leave the File system “unformatted”:

      

   3. The first disk partition used to be the EFI System Partition, please rename it to “EFI” by right-clicking the partition, and select Name Partition item:

      

   4. Finally, click Edit then Apply All Operations items for changes to take effect.

      

   5. Before rebooting the Ubuntu system, make sure the Secure Boot feature is disabled in the UEFI firmware:

      

4. Run the setup-aic script to install the container images. You can pass ‘-s’ argument to the script to set up the containers in secure mode, or ‘-ns’ argument for non-secure mode.

   Note

   To run CiC in secure mode, make sure you have ever set up a teedata partition for the RPMB simulation. Check out the previous step for detailed information.

   # The following command sets up CiC in non-secure mode
   $ sudo -E ./setup-aic -ns
   

   # The following command sets up CiC in secure mode
   $ sudo -E ./setup-aic -s
   

   Note

   1. If you are setting up the CiC in secure mode, some of the Ubuntu startup files in the ESP are overwritten by the setup-aic script. Specifically, the bootloader shim file shimx64.efi is replaced by kf4cic.efi in the CiC package. The original shim file is renamed as loaderx64.efi. In addition, the tos.img image, which contains the Trusty OS, is copied to the ESP partition as well.

   2. Since the Ubuntu booting sequence has been extended to run the Trusty OS, you would see the following warning during the system startup as the secure boot is disabled:

      

5. Reboot the device after the installation.

6. The setup-aic script not only set up CiC docker images on the target device, but also installed a systemd service ‘cic’ to launch the CiC container images automatically on system startup. You can verify whether the CiC containers are running successfully with the following command:

   $ sudo docker ps
   CONTAINER ID        IMAGE                                 COMMAND                  CREATED             STATUS              PORTS                    NAMES
   b5186e3c2116        android:CC0000105-cic-userdebug       "/android-entry -e 0"    5 minutes ago       Up 2 minutes        0.0.0.0:5555->5555/tcp   android0
   f077a4eb722c        aic-manager:CC0000105-cic-userdebug   "/aic-manager-entry ..." 5 minutes ago       Up 2 minutes                                 aic-manager
   

7. In addition, an Android Container Client for Linux script ‘cfc’ and its desktop file cfc.desktop are also installed on the Gnome desktop. Run the cfc script in a shell terminal or launch the cfc.desktop from the GUI, a full screen window pops up and shows the Android home screen:

   

   Note

   CiC runs as a Docker container, as a result, you can use Docker CLI commands directly for debugging. For example, if you encounter issues, you can capture necessary information by running the following commands:

   $ docker logs aic-manager 2>&1 | tee aic-manager.log
   $ docker exec -it android0 sh | tee android.log
   # run commands to get information, such as
        getprop
        logcat -b all