Does breaking out of the container give you root?
On Running systemd-nspawn Containers (2022)
11–20 of 59 posts
Re: On Running systemd-nspawn Containers (2022)
#12Does breaking out of the container give you root?
I would think so, that would seem in line with systemd's architectural design decisions.
Re: On Running systemd-nspawn Containers (2022)
#13I used nspawn to get a system running in the most ridiculous way. A debian aarch64 vm on kvm starting a systemd-nspawn for an unpacked raspberry pi 3 iso. It works way too well judging by how ridiculous it was. Still saved me a few days instead of setting things up myself. I actually liked how easy it is to spin up nspawn as a systemd service [Unit] Description=Raspberry Image Machine After=multi-user.target [Service…
hmm this is very interesting. I am wondering though? Is there something like systemd-nspawn that doesn't require root?
all containers require root.
docker and the rootless nonsense is just root daemons and suid.
...would never have believed marketing lies would reach linux tools if anyone told me this before 2018.
Re: On Running systemd-nspawn Containers (2022)
#14Does breaking out of the container give you root?
that means terminating the process, so good luck with that.
Re: On Running systemd-nspawn Containers (2022)
#15Earlier quoted context omitted.
hmm this is very interesting. I am wondering though? Is there something like systemd-nspawn that doesn't require root?
It looks like systemd-nspawn is gaining rootless support, see https://github.com/systemd/systemd/issues/30239 Until then, I'm not sure if there is anything lightweight. If you don't need lightweight, there is Podman.
Podman requires one time root for installation though.
I am on a completely rootless client at one of my servers.
Re: On Running systemd-nspawn Containers (2022)
#16Earlier quoted context omitted.
hmm this is very interesting. I am wondering though? Is there something like systemd-nspawn that doesn't require root?
all containers require root. docker and the rootless nonsense is just root daemons and suid. ...would never have believed marketing lies would reach linux tools if anyone told me this before 2018.
you can theoretically run a virtual machine like libriscv5 which doesn't require root.
or qemu doesn't require root as well. But qemu is blocked for my usecase. There is flatpak theoretically as well
There is podman but it requires one time root.
Re: On Running systemd-nspawn Containers (2022)
#17> Unfortunately, though, most developers don’t even know that there are options outside of Docker, or that they’re not as “convenient”. > Hopefully, this article has disabused some of that notion. If that was the goal, it seems terribly complicated when compared with podman.
I was thinking similarly. All of those steps to circumvent the OCI image infrastructure just to use systemd…
Re: On Running systemd-nspawn Containers (2022)
#18Used nomad in my homelab to run nspawn containers with nspawn driver[1] Surprisingly simple and low footprint solution and genuinely pleasant to work with, since it is very similiar to managing a Systemd service. [1] https://github.com/JanMa/nomad-driver-nspawn
Happy to hear you like the project :-)
Re: On Running systemd-nspawn Containers (2022)
#19Redhat's Leapp, for upgrading between major releases of RHEL, uses systemd-nspawn to create a container where it can test installing the packages without interfering with the running OS.
Re: On Running systemd-nspawn Containers (2022)
#20This is very interesting! I only heard about systemd-nspawn last night.