What Breadstick cannot do

The honest list. Breadstick runs unprivileged with no root, and that rules out a specific set of things.

Breadstick runs completely unprivileged. There is no root, no kernel module, no hypervisor, and nothing that touches your Android system. That is what makes it safe to install and impossible to break your phone with, and it is also the reason for almost everything on this page.

Read this before you plan a workflow around it. Most of these have no workaround inside Breadstick, and it is better to know now.

One thing worth knowing up front, because it misleads people who go looking: most of these devices are visible inside the Linux system. /dev is full of the hardware Android exposes, and a listing suggests far more is available than actually is. What stops them is permission, not absence. Seeing /dev/net/tun in a directory listing does not mean a VPN will work.

Networking

VPN clients do not work

OpenVPN, WireGuard, Tailscale and every other VPN client need a TUN network device to create the tunnel. /dev/net/tun is visible inside the Linux system, and it even appears to belong to your user, but opening it fails with a permission error: on Android the device belongs to a system group that ordinary applications are not in. VPN clients therefore fail at the point where they try to bring the tunnel up.

What to do instead: run the VPN on Android itself. Android's VPN applies to the whole device, and Breadstick's traffic goes out through the same network stack, so a VPN connected in Android covers your Linux applications too. For most people this is the better arrangement anyway, since it protects everything at once. Using a VPN covers the setup, including names on a private network.

Anything needing raw network control

Setting up bridges, changing routes, running a DHCP server, packet capture on an interface and firewall rules all require the same privileges and do not work.

Hardware and USB

USB devices do not work

Linux applications cannot see USB hardware. Android does not expose the raw USB bus to unprivileged applications, so there is no /dev/bus/usb inside the Linux system and nothing that enumerates USB devices will find anything.

That covers, among others:

• Hardware security keys. YubiKey, Nitrokey, SoloKey and other FIDO2 or PIV tokens will not be detected, over USB or NFC. Applications that require one for login or signing cannot use it here.
• Serial adapters, including USB to TTL cables and microcontroller programmers.
• Printers and scanners connected by USB. Printing still works through Android's print dialog, to any printer Android can use: see Printing.
• Audio interfaces, MIDI controllers and capture cards.
• Smartcard readers.

USB storage works, but only as folders

If Android mounts a USB drive, and you have granted Breadstick file access, the files appear inside Linux like any other folder. That part works.

What does not work is anything that needs the drive itself rather than the files on it. The block devices are visible under /dev/block, but opening any of them is denied, so nothing can read or write a disk directly:

• Encrypted drives will not open. LUKS, VeraCrypt and BitLocker volumes all need block-level access to the device.
• Partitioning, formatting and repair tools such as fdisk, mkfs and fsck have nothing to operate on.
• Disk images cannot be mounted. There are no usable loop devices, so mounting an .iso or a .img fails.

Virtualization and containers

There is no nested virtualization. /dev/kvm is not available to unprivileged applications, so anything that boots its own kernel or spins up its own container will not run:

• Docker and Podman
• QEMU and KVM
• VirtualBox and VMware
• Windows Subsystem for Linux style tooling

Language-level sandboxes are fine. Python virtual environments, Node version managers and similar tools work normally, because none of them need kernel features.

Filesystem

FUSE is not available. /dev/fuse cannot be opened, so filesystems that run in user space do not mount. That includes sshfs, rclone mount, gocryptfs and mounting an AppImage.

AppImages themselves still work: Breadstick unpacks them instead of mounting them, and adds them to your applications with their own name and icon. See Installing apps.

Windows

Your device caps how many floating windows can be open at once. On Samsung DeX that is around five, counting every window on screen and not only Linux ones. This is enforced by Android, not by Breadstick, so no version and no purchase raises it.

Desktop mode is not affected. Inside a desktop session the windows belong to Linux, so you can open as many as the device has memory for.

Graphics

Without GPU acceleration, everything is drawn in software. Ordinary desktop applications, editors, browsers and office software are fine that way, because they barely use the GPU.

With GPU acceleration (Pro), Linux apps can draw with the device's graphics chip, where Breadstick's test finds it stable and faster than the processor. It has edges of its own. On ARM devices it goes through Breadstick's graphics server, which offers OpenGL 2.1 and OpenGL ES, so programs that need OpenGL 3 or newer stay on the processor, and light drawing can be slower on the graphics chip than on the processor, so the gain is in 3D work. On Intel graphics, the Linux system's own Mesa drives the chip directly. Web browsers stay on the processor for now, on every device. Breadstick offers no GPU compute. See GPU acceleration.

Video playback is software decoded, so large or high frame rate video will struggle on slower devices.

The system itself

There is no systemd. Breadstick is not a booting machine, it is a set of applications sharing a Debian filesystem, so there is no init system and systemctl does nothing useful. Software that insists on running as a systemd service needs to be started by hand instead. Most daemons can be run directly.

You cannot load kernel modules or change kernel settings. The kernel belongs to Android.

There is a ceiling on how many processes can run at once. Android allows one app a limited number of processes, typically 32, and everything in the Linux system counts toward it because it all belongs to Breadstick. That is enough for a desktop and a normal set of applications, and Breadstick is configured to stay inside it, but it is a real ceiling rather than a soft one: go over and Android closes the session rather than refusing to start one more process. A browser with many tabs or extensions is the usual way to meet it. Breadstick warns you as the count gets close, and the resource monitor shows it live. If you hit this, the troubleshooting page explains what to do, including how to remove the limit on a device you control.

Architecture, and the exception to it

Breadstick runs software directly on your device's processor, with no translation: it installs a Debian 13 built for that processor. Nearly every phone and tablet has an ARM64 processor, and the overwhelming majority of Debian's archive is built for ARM64, so this is rarely noticeable. An Intel Googlebook or another x86-64 device gets Debian for amd64, so 64-bit x86 Linux programs are native there.

On an ARM device, for the software that is not built for it, the optional x86 apps pack installs Box64, which runs 64-bit x86 Linux programs on ARM. Box64 is genuinely useful and genuinely experimental: some programs work, some do not, everything runs without GPU acceleration, and translated software is slower than native. With Pro it installs in one tap from Recommended apps. Treat it as a bonus rather than a guarantee. x86 apps has the details.

Windows programs do not run, on ARM or Intel devices. Android's security rules stop Wine from starting in Breadstick: an app may not run code it has changed after loading it from a file, and Wine does this to itself as it starts. The same rule keeps Steam's Windows games, which run through Proton, from running. x86 apps has more.

Performance

Linux applications use your device's own processor and memory. A recent tablet runs a full desktop comfortably. An older or cheaper phone will feel like an older or cheaper computer. Nothing is offloaded to a server, so what you have is what you get.

The short version

If something here is a blocker for you, say so at hello@breadstick.io. Some of these are permanent consequences of running without root. Others are being worked on.