Notes on setting up Crostini Linux containers on ChromeOS.
See:
https://discuss.linuxcontainers.org/t/using-lxd-on-your-chromebook/3823
Developer mode disables some chromebook security features.
Unlike crouton, Crostini does not require the chromebook to be in developer mode.
Crostini requires more resources.
The Crostini linux containers can be killed during periods of low resource usage or inactivity.
On a chromebook with less than 4Gb, use crouton.
On a chromebook with 4Gb, Crostini is usable but may be terminated. If this system is your primary development environment, consider using crouton.
Crostini restricts hardware access.
The design of crostini protects the host OS (ChromeOS acting as a hypervisor) from the guest containers. Guest containers run arbitrary code. If this code can escape the container, it may be able to interfere with the web browser.
The downside of the crostini security controls is that hardware must be explicitly whitelisted for use.
Serial ports can't be accessed directly from the container. A work around for using serial consoles is beagleterm.
Some microcontrollers such as some of the arduinos are whitelisted. If not, firmware can't be uploaded.
The microcontroller code can still be written and compiled in the container.
A work around is connecting the microcontroller to a Raspberry Pi. A relatively portable setup is using a microcontroller attached to a Raspberry Pi Zero.
ext2 attached storage is mounted with root squash (root owned files on the file system are converted to the nobody/nogroup user). These files are not modifiable, even by the root user.
The permissions cause problems when burning Raspberry Pi OS images.
The boot partition is FAT and is writable:
/boot/ssh can be touched to enable the ssh service
/boot/config.txt can be modified
Modifying the rootfs of a mounted partition on ChromeOS will fail due to permissions preventing customization of the image: hostname, headless installations, ...
Workaround: use another system such as another Raspberry Pi
Crostini installs a default Debian container named penguin. This container is assumed to exist by crostini and may cause problems if removed.
For example, after upgrading to a new Crostini release:
starting termina from the command line may fail
starting the default container (Terminal icon) repairs the installation and starts penguin
entering termina from the command line now works
Both crouton and crostini support running multiple containers from different Linux images.
in Settings > Advanced > Developers: enable the "Linux Development Environment"
open crosh by using the key combo: ctrl-alt-T
terminavmc start termina
lxc list
# lxc launch ubuntu:20.04 <hostname>
lxc launch ubuntu:20.04 test
lxc exec test bash
apt update
apt dist-upgrade
groupmod -n <youruser> ubuntu
usermod -d /home/<youruser> -m -l <youruser> -g <youruser> ubuntu
passwd <youruser>
cd /home/<youruser>
ssh yourotherhost "tar zcf - .gnupg .ssh" | tar zxf -
lxc exec test -- login
(markdown)