OS Image Baking

Custom OS Image Baking & APK Management

Baking custom Redroid images ensures that all spoofing libraries, system certificates, and system WebView packages are injected permanently, eliminating startup overhead.

---

📂 Directory Structures & APK Matrix

To support dynamic version rotation, Damru uses a unified matrix folder structure inside /home/damru/chrome-apks on the host:

/home/damru/chrome-apks/
├── 143.0.7499.52/
│   ├── base.apk
│   ├── split_config.arm64_v8a.apk
│   ├── webview.apk
│   └── google_tts.apk
├── 146.0.7601.121/
│   ├── base.apk
│   ├── split_config.x86_64.apk
│   └── TrichromeWebView.apk
└── google_tts.apk (fallback)

Invariant Rules

1. Each Chrome folder must contain a version-aligned WebView provider (e.g. webview.apk or TrichromeWebView.apk).
2. The split-APKs must match the architecture of the container (typically x86_64 for WSL2/VPS, or arm64_v8a for ARM-native hardware).

---

🛠️ The Baking Workflow

When you run python -m damru bake-image --image damru-redroid:latest, the framework executes the following steps:

1. Bootstrap Container: Spins up a vanilla Redroid instance using the base image.
2. Mount & Copy System Assets:
   • Mounts the Android system partition as writable.
   • Copies libfakemem.so and libVkLayer_damru.so to Android system library directories.
   • Installs magisk.apk to allow root access management.
3. Configure WebView Provider:
   • Replaces the default Android system WebView package (/system/app/WebView) with the configured APK asset.
   • Resets folder permissions to root:root 0644.
   • Clears Android's oat and dalvik-cache directories to avoid writable-dex security rejections during runtime execution.
4. Export Clean Layer: Shuts down the container gracefully before calling docker commit to prevent OverlayFS data races.

---

🧪 Verifying the Baked Image

Once baked, verify image sanity by running:

python -m damru check-env

This inspects the baked image hash to ensure all assets are in place and checks that Chrome can boot successfully.