5 ms·

Shameless plug: I wrote undocker[1] to convert docker images to a rootfs tarball, so I can run them with plain systemd. Goal: no more daemons to run 3rd party

Shameless plug: I wrote undocker[1] to convert docker images to a rootfs tarball, so I can run them with plain systemd. Goal: no more daemons to run 3rd party containers, systemd is good enough by now: resource limits, isolation, chroot, dynamic users, logging, and more. Low-level tooling is done, I am now building ecosystem around it: easy installation, convert to deb/rpm, systemd units, etc. [1]: https://sr.ht/~motiejus/undocker https://sr.ht/~motiejus/undocker

f0e4c2f7 5y ago
Wow I must be quite behind on systemd indeed. It's been a few years. Is there any isolation offered like you would get with docker or is that a tradeoff? Edit: looking at the docs is that system-nspawn that's actually doing the heavy lifting. For Linux namespaces. I feel like this has great potential!
- motiejus 5y ago
  I actually use systemd, not systemd-nspawn (it's also in the README), because using both does not always play together. As far as systemd vs dockerd goes, dockerd provides a bit more isolation by default, but `systemd-analyze security` can guide you so far beyond the Docker defaults. And it is always compatible with system daemons, giving consistent configuration between, say, postgresql from package manager and prometheus from docker container+undocker.
- technological 5y ago
  One trade off I can think about is rolling out changes or updates . With docker the orchestration tool will handle that for me
silisili 5y ago
That's really interesting, I had no idea systemd could do that. Have you written in more detail anywhere? I'd love to see a detailed comparison between approaches.
- motiejus 5y ago
  I am planning to. :) It's going slowly though. Have a look at these in systemd.exec[1]: PrivateUsers, DynamicUser, ProtectProc, RootDirectory. There are more, but these are the main ones. [1]: https://www.freedesktop.org/software/systemd/man/systemd.exec.html https://www.freedesktop.org/software/systemd/man/systemd.exe...
traceroute66 5y ago
> Goal: no more daemons to run 3rd party containers, systemd is good enough by now: resource limits, isolation, chroot, dynamic users, logging, and more. Isn't that what Firecracker[1] does ? (Well, ok, not really, but a bit closer to the base system than Docker/Podman) [1] https://firecracker-microvm.github.io/ https://firecracker-microvm.github.io/
- jrockway 5y ago
  Systemd uses cgroups like Docker. Firecracker uses virtualization.
junon 5y ago
Been using systemd for personal project deployments for quite a while now after leaving ZEIT (Vercel) and the year or so fighting endlessly with k8s and docker's shortcomings. I love it. It does everything I need it to, it's fast, decently documented, supports everything Docker does (just not 1:1 in terms of DX) and is present wherever I need it.
- gabrielizaias 5y ago
  Curious to hear why you left Vercel, if you don't mind elaborating. I'm considering them for an upcoming project.
maddyboo 5y ago
I wrote a little tool to make creating and interacting with systemd-nspawn containers easier (on Arch Linux only right now): https://github.com/b0o/arch-lwc https://github.com/b0o/arch-lwc Not intended for any sort of production. I personally use it to run Firefox inside a container and for testing.
travisgriggs 5y ago
"May boring technology run our software" +1000
nonameiguess 5y ago
I really like this. At least for the nspawn case, systemd as of 242 supports loading containers from OCI images directly, but still doesn't seem to support OCI hooks or have a runc-compatible CLI, which were the other two outstanding issues identified by Poettering before it could be considered a true drop-in replacement for running container bundles loaded from OCI images. As for just using systemd and not nspawn at all, that seems useful for a lot of cases, but not multiplexing of networked services since systemd can't assign UNIX domain hostnames and IP addresses to individual services. At least, I think it can't, can it?
- motiejus 5y ago
  ProtectHostname will generate a new hostname for the service process hierarchy. JoinsNamespaceOf can be used to set up network namespaces (albeit in a clunky way). It is possible, but multiplexing networked services requires significantly more effort with systemd than with others. I do not have a strong use case yet to invest in tooling for it, but it may come.
ecnahc515 5y ago
For what it’s worth, podman has a `podman generate systemd` command for generating systemd units for running containers using podman.
- storrgie 5y ago
  Podman also switched to notify based units in 3.3.3
kbenson 5y ago
Your goals seem to somewhat align with the podman project, except that they decided to make a drop in replacement for docker (to the point you can alias docker to podman) and leverage the docker ecosystem, and still use orchestration to build pods, etc. Notably, it's no longer a daemon, just some python scripts that do the same thing docker did. Also, as good as systemd is (and I've defended it here a few times as better than what was before), it still feels like an organically grown accumulation of edge cases that were patched. I try to keep it's use to the subset of features that are easy to grow for not just myself but those of my team, and systemd is known (in my circles at least) as being somewhat obtuse. For me, that's a good argument for a dedicated application to handle it.
deleted 5y ago
[deleted]
rank0 5y ago
I love your project! Can I still get the same networking functionality with undocker/systemd that docker provides? For example, container hostname resolution, private networks, container->localhost port forwarding?
- motiejus 5y ago
  Nope, systemd doesn't have as advanced network namespace capabilities as docker. You'd need to do this via other means.
amelius 5y ago
Can this be installed and run as a non-root user?
- motiejus 5y ago
  Undocker reads and writes tarballs. So yes. Running them is a different story. I've never tried systemd user services, so can't tell. Curious myself. :)
NexRebular 5y ago
Been looking something like this for running dockered software on lx-zones. Will definitely give it a go.

f0e4c2f7 5y ago

Wow I must be quite behind on systemd indeed. It's been a few years. Is there any isolation offered like you would get with docker or is that a tradeoff? Edit: looking at the docs is that system-nspawn that's actually doing the heavy lifting. For Linux namespaces. I feel like this has great potential!

motiejus 5y ago
I actually use systemd, not systemd-nspawn (it's also in the README), because using both does not always play together. As far as systemd vs dockerd goes, dockerd provides a bit more isolation by default, but `systemd-analyze security` can guide you so far beyond the Docker defaults. And it is always compatible with system daemons, giving consistent configuration between, say, postgresql from package manager and prometheus from docker container+undocker.
technological 5y ago
One trade off I can think about is rolling out changes or updates . With docker the orchestration tool will handle that for me

silisili 5y ago

That's really interesting, I had no idea systemd could do that. Have you written in more detail anywhere? I'd love to see a detailed comparison between approaches.

motiejus 5y ago
I am planning to. :) It's going slowly though. Have a look at these in systemd.exec[1]: PrivateUsers, DynamicUser, ProtectProc, RootDirectory. There are more, but these are the main ones. [1]: https://www.freedesktop.org/software/systemd/man/systemd.exec.html https://www.freedesktop.org/software/systemd/man/systemd.exe...

traceroute66 5y ago

> Goal: no more daemons to run 3rd party containers, systemd is good enough by now: resource limits, isolation, chroot, dynamic users, logging, and more. Isn't that what Firecracker[1] does ? (Well, ok, not really, but a bit closer to the base system than Docker/Podman) [1] https://firecracker-microvm.github.io/ https://firecracker-microvm.github.io/

jrockway 5y ago
Systemd uses cgroups like Docker. Firecracker uses virtualization.

junon 5y ago

Been using systemd for personal project deployments for quite a while now after leaving ZEIT (Vercel) and the year or so fighting endlessly with k8s and docker's shortcomings. I love it. It does everything I need it to, it's fast, decently documented, supports everything Docker does (just not 1:1 in terms of DX) and is present wherever I need it.

gabrielizaias 5y ago
Curious to hear why you left Vercel, if you don't mind elaborating. I'm considering them for an upcoming project.

maddyboo 5y ago

I wrote a little tool to make creating and interacting with systemd-nspawn containers easier (on Arch Linux only right now): https://github.com/b0o/arch-lwc https://github.com/b0o/arch-lwc Not intended for any sort of production. I personally use it to run Firefox inside a container and for testing.

travisgriggs 5y ago

"May boring technology run our software" +1000

nonameiguess 5y ago

I really like this. At least for the nspawn case, systemd as of 242 supports loading containers from OCI images directly, but still doesn't seem to support OCI hooks or have a runc-compatible CLI, which were the other two outstanding issues identified by Poettering before it could be considered a true drop-in replacement for running container bundles loaded from OCI images. As for just using systemd and not nspawn at all, that seems useful for a lot of cases, but not multiplexing of networked services since systemd can't assign UNIX domain hostnames and IP addresses to individual services. At least, I think it can't, can it?

motiejus 5y ago
ProtectHostname will generate a new hostname for the service process hierarchy. JoinsNamespaceOf can be used to set up network namespaces (albeit in a clunky way). It is possible, but multiplexing networked services requires significantly more effort with systemd than with others. I do not have a strong use case yet to invest in tooling for it, but it may come.

ecnahc515 5y ago

For what it’s worth, podman has a `podman generate systemd` command for generating systemd units for running containers using podman.

storrgie 5y ago
Podman also switched to notify based units in 3.3.3

kbenson 5y ago

Your goals seem to somewhat align with the podman project, except that they decided to make a drop in replacement for docker (to the point you can alias docker to podman) and leverage the docker ecosystem, and still use orchestration to build pods, etc. Notably, it's no longer a daemon, just some python scripts that do the same thing docker did. Also, as good as systemd is (and I've defended it here a few times as better than what was before), it still feels like an organically grown accumulation of edge cases that were patched. I try to keep it's use to the subset of features that are easy to grow for not just myself but those of my team, and systemd is known (in my circles at least) as being somewhat obtuse. For me, that's a good argument for a dedicated application to handle it.

deleted 5y ago

[deleted]

rank0 5y ago

I love your project! Can I still get the same networking functionality with undocker/systemd that docker provides? For example, container hostname resolution, private networks, container->localhost port forwarding?

motiejus 5y ago
Nope, systemd doesn't have as advanced network namespace capabilities as docker. You'd need to do this via other means.

amelius 5y ago

Can this be installed and run as a non-root user?

motiejus 5y ago
Undocker reads and writes tarballs. So yes. Running them is a different story. I've never tried systemd user services, so can't tell. Curious myself. :)

NexRebular 5y ago

Been looking something like this for running dockered software on lx-zones. Will definitely give it a go.