To anyone using a Pixel: install and donate (if you can)!
The web installer[1] is basically a few clicks on a web page. So damned impressed.
Basically, where other privacy AOSP forks typically offer up to three choices...
- no Google at all
- root and install an extremely fragile FOSS alternative GPS implementation (MicroG)
- root and install the full Google Play Services binary blobs
... GrapheneOS offers option #4: you can install Google Play Services in a sandbox so that they still run, but they don't get root-level access to your system, instead they are treated the same as any other app (so e.g. you get to manage their access to location/storage/contacts etc.).
Note that you don't have to, it's just an option in the built-in Apps menu. I personally run GrapheneOS with no GPS at all in my main profile, and occasionally access my old Gmail/Gdrive accounts via web browser.
I never realized how many permissions the play store had, until I ran it under graphene.