Docker-Android

README requires --device /dev/kvm and instructs chown root:kvm /dev/kvm plus chmod 660 on WSL2; this is necessary for emulation but broadens privilege surface with no least-privilege discussion, so least_privilege is 1. For user_confirmation, the container enables behavior analytics by default with no opt-out switch or first-run consent in the README, so 0. Data-flow transparency is partial: LICENSE.md enumerates collected fields (start time, distro, city/region/country from ipinfo.io, Appium/Web-VNC usage) and points to USER_BEHAVIOR_ANALYTICS.md, but the README body never surfaces this telemetry, so 1. Sensitive data handling: declared non-PII and non-trackable, yet IP-derived geolocation and device details remain linkable, and the grant is irrevocable, perpetual and sub-licensable, so 1. Dependency security: release.yml pins actions/checkout@v7 and setup-buildx-action@v4 by floating major tags rather than commit SHAs, with no dependency scanning evidence, so 1. External effects: images are pushed to Docker Hub and the code calls ipinfo.io and codecov.io, expected but not centrally disclosed in the README, so 1. Rollback: README mentions mounting /home/androidusr for persistence but gives no version rollback or state-recovery procedure, so 1. Source attribution: README credits Genymotion, Android Studio, Samsung skins and a WSL2 blog with links, but ships no SBOM or third-party component inventory, so 1.

Self-consistency: README image tags, device list and Pro feature table broadly match the release.yml build matrix (9.0-14.0), but the ai-agent claim is split confusingly between the free README header and the Pro table, so 1. Dependency availability: depends on Docker, KVM, an Ubuntu host and external registries; README gives a kvm-ok check but no offline or registry-unavailable fallback, so 1. Failure messages: README offers a device_status check but does not describe common failures (KVM unavailable, port conflicts, image pull errors) or their diagnostics, so 1.

Audience and scenarios: README targets Android development/testing, Appium, Jenkins and cloud deployment with six linked use-case documents, so 2. Capability boundaries: it clearly separates free vs Pro features (ai-agent, proxy, headless, root), but ai-agent and mcp are marked beta with no stated limits or failure modes, so 1. Trigger precision: only a docker run example and a few env vars, with no complete parameter list or defaults, so 1. Environment fit: it explicitly restricts to Ubuntu hosts with virtualization and documents WSL2 setup, so 2.

Information architecture: README sections are clear (advantages, image table, device table, quick start, persistence, use cases, Pro, sponsors), so 2. Install notes: docker run command, KVM check and WSL2 steps are actionable, so 2. Naming stability: image tags follow stable emulator_<version> and <version>_<release> patterns, so 2. Examples and FAQ: multiple use-case docs and command examples exist, but there is no dedicated FAQ, so 2. Known limitations: only scattered mentions of Ubuntu-only and Pro-only features, no consolidated limitations section, so 1. License: LICENSE.md is Apache-2.0 plus custom amendments (forks must remove a Google Form ID or stop collection), a non-standard license, and repo metadata says NOASSERTION, so 1. Versioning and changelog: README references a GitHub release badge and <release_version> placeholders, but no in-repo CHANGELOG, so 1. Maintenance responsibility: README states Pro is sponsor-funded and creator-maintained, but gives no governance, security contact or SLA, so 1.

Output usability: a single docker run starts the container and port 6080 exposes VNC, with logs and status checks, adequate for ordinary use, so 2. Marginal value: it adds multi-device skins, VNC, log sharing and cloud integration over a hand-rolled emulator setup, so 2. Cost benefit: it needs KVM, an Ubuntu host and large images, while default telemetry and the free/Pro split raise adoption cost, so 1.

Claim traceability: most README claims map to documentation links and workflow files, but ai-agent/mcp capabilities have no corresponding source or test evidence, so 1. Cross-source corroboration: release.yml and test-on-demand.yml corroborate build and test pipelines, but cannot corroborate the advertised ai-agent feature, so 1. Fact-inference separation: README and LICENSE are fairly specific about data collection, but do not separate verified facts from marketing claims such as the user-distribution graphic, so 1.