qgrain/kernel-fuzz repository overview

⁠qgrain/kernel-fuzz

qgrain/kernel-fuzz provides Docker images for Linux kernel fuzzing research with QEMU/KVM, syzkaller-oriented dependencies, managed compiler toolchains, and ready-to-clone QEMU guest image templates.

The Ubuntu version in each tag is the container userspace version. It is not the kernel-under-test version; the target kernel is built and booted inside a QEMU guest.

⁠Tags

All current images are linux/amd64 images for x86_64 QEMU/KVM workflows.

⁠Quick start

docker pull qgrain/kernel-fuzz:2404_v1

docker run --init -d --name kernel-fuzz \
  --privileged \
  --ipc=host \
  -p XXXXX:22 \
  -v /HOST/PATH/KERNELS:/root/kernels \
  qgrain/kernel-fuzz:2404_v1 sleep infinity

docker exec -it kernel-fuzz bash

Use latest if you want the recommended default:

docker run -it --rm --privileged qgrain/kernel-fuzz:latest bash

--privileged is recommended for syzqemuctl guest image handling and for exposing host KVM acceleration to QEMU.

⁠What is included

• Kernel build dependencies and common headers/libs for mainstream Linux 5.x, 6.x, 7.x, and current-mainline experiments.
• GCC and LLVM/Clang toolchains installed and selected by cvm⁠.
• QEMU/KVM tooling and a default QEMU guest image template managed under /root/images by syzqemuctl⁠.
• Miniforge/Conda with an automatically activated kernel-fuzz environment.
• Go under /root/software/goX.Y.Z and GOPATH=/root/software/gopath.
• A convenience syzkaller source checkout under /root/fuzzers/syzkaller-7bitHASH-YYYYMMDD.
• Development tools such as gdb, pwndbg, tmux, screen, vim, fzf, and SSH.

The bundled syzkaller checkout is only a convenience source tree. It is not pre-built and is not mandatory. Build syzkaller, the kernel under test, and any experiment-specific components inside your own working container.

⁠Environment behavior

Common development environment variables are centralized in /root/.bash_env. Both interactive shells and automation commands such as:

docker exec kernel-fuzz bash -lc 'go version && clang --version'

load the same Go, cvm, Conda, compiler, and fzf paths.

No proxy is baked into the image. If your environment needs a proxy, pass it at container runtime or configure it inside your own container only:

docker run -e http_proxy=http://HOST:PORT -e https_proxy=http://HOST:PORT ...

⁠SSH notes

sshd starts by default, but the root password is locked. To enable password SSH for a container you control:

docker exec -it kernel-fuzz passwd
ssh -p XXXXX root@IP

Alternatively, add your own /root/.ssh/authorized_keys. To disable sshd for local docker exec-only containers:

docker run -e KERNEL_FUZZ_START_SSHD=0 ...

⁠Guest image notes

The default image template is stored in /root/images/image-template. If you mount an empty volume over /root/images, the embedded template is hidden and the entrypoint will try to initialize a replacement template. That fallback requires suitable privileges and network access to the Debian mirrors.

Guest SSH key material inside the template is disposable fuzzing infrastructure, not a secret for protecting valuable or networked guests.

⁠Source and reproducibility

Dockerfiles, build scripts, and verification notes are maintained at:

https://github.com/QGrain/kernel-fuzz-docker-images⁠

Detailed image contents and configuration inventory:

https://github.com/QGrain/kernel-fuzz-docker-images/blob/main/docs/image-contents.md⁠

Release images include OCI labels for source, version, base image, and Git revision. Ubuntu base images are digest-pinned, but apt packages and Debian guest packages are still resolved at build time, so the images are not bit-for-bit package-level reproducible.

⁠TODO

• Add ARM64/Android guest support after syzqemuctl and the Docker images have a clean cross-architecture workflow.
• Expand the manual verification matrix for Rust-for-Linux and newer optional kernel subsystems.
• Consider CI/registry build cache support for maintainers; do not publish local kernel-fuzz-build:* helper images as public release images.
• Keep reducing image size without removing the compiler/tooling combinations needed for kernel fuzzing research.