4 ms·
Wow I must be quite behind on systemd indeed. It's been a few years. Is there any isolation offered like you would get with docker or is that a tradeoff? Edit:
by f0e4c2f7 5y ago
Wow I must be quite behind on systemd indeed. It's been a few years. Is there any isolation offered like you would get with docker or is that a tradeoff?
Edit: looking at the docs is that system-nspawn that's actually doing the heavy lifting. For Linux namespaces. I feel like this has great potential!
- motiejus 5y agoI actually use systemd, not systemd-nspawn (it's also in the README), because using both does not always play together. As far as systemd vs dockerd goes, dockerd provides a bit more isolation by default, but `systemd-analyze security` can guide you so far beyond the Docker defaults. And it is always compatible with system daemons, giving consistent configuration between, say, postgresql from package manager and prometheus from docker container+undocker.
- technological 5y agoOne trade off I can think about is rolling out changes or updates . With docker the orchestration tool will handle that for me