3 ms·
This seems to be almost exactly like systemd-nspawn other than the ability to write seccomp policies in kafel. Are there any other notable differences?
by TheDong 9y ago
This seems to be almost exactly like systemd-nspawn other than the ability to write seccomp policies in kafel.
Are there any other notable differences?
- jagger11 9y agoI haven't been looking at systemd-nspawn for some time, but judging from its man page: - ability to use config files (in nsjail in protobuf format) - 3 operational modes: one of them allows to listen on a TCP port and run processes on-demand (inetd-style) - support for cgroups (pid and mem limiting), here rlimits are not enough - more expressive seccomp-bpf rules
- TheDong 9y ago> ability to use config files systemd-nspawn supports ".nspawn" files (see --settings=true mode) > socket activation systemd can start up an nspawn thing in reaction to a systemd socket-activation request I think? > cgroups I guess for that you'd use 'systemd-run --scope -p MemoryLimit=10M -p CPUShares=100 -- systemd-nspawn ...' > more expressive seccomp-bpf rules Absolutely!