5 ms·

Talking about containers: is there an easy way to run “system” containers? This is, containers that run systemd and everything else you would expect to be runni

Talking about containers: is there an easy way to run “system” containers? This is, containers that run systemd and everything else you would expect to be running on a normal Linux OS. I rely heavily on VMs to simulate cloud environments, but I would love to use lightweight containers instead. Also, these “system” containers should be able to run containers inside them as well (docker in docker?). I saw something on github the other day that may work (can’t remember the name, something about “box”), but it wasn’t available for Macos.

rb12345 4y ago
LXC/LXD are probably the closest to that on Linux, although I'm not sure about nesting containers.
- CoolCold 4y ago
  It works. Used it just 1 hour ago last time. lxc launch ubuntu:22.04 docktest -c security.nest More on https://bobcares.com/blog/lxd-and-docker-containers-nesting/ https://bobcares.com/blog/lxd-and-docker-containers-nesting/
MikeKusold 4y ago
Proxmox allows you to launch LXC containers via a UI. I use it at home and I'm able to run Docker in both a privileged LXC and an unprivileged LXC.
dinosaurdynasty 4y ago
systemd-nspawn, LXC, and podman should all be able to do that (though doing recursive containers can be kind of weird). In theory https://github.com/firecracker-microvm/firecracker https://github.com/firecracker-microvm/firecracker should as well, it runs very lightweight VMs.
rmolina 4y ago
You are probably referring to Sysbox (https://github.com/nestybox/sysbox https://github.com/nestybox/sysbox), which I believe will meet your requirements (systemd, inner containers, security, etc). Btw, Sysbox is already supported in Docker-Desktop (business tier only), so you can easily do what you want with this instruction: $ docker run -it --rm -e SYSBOX_SYSCONT_MODE=TRUE ghcr.io/nestybox/ubuntu-focal-systemd-docker:latest bash Disclaimer: I'm Sysbox's co-creator and currently working for Docker.
- lmarcos 4y ago
  Sysbox works great! Amazing job. But OP is looking for something that works for macos I believe.
  - rmolina 4y ago
    Appreciate your comment lmarcos! Yes, the above instruction runs on macos too as long as you have docker-desktop installed.
moondev 4y ago
kind (kubernetes inside docker) does this by building a specialized container that includes and uses systemd as the entrypoint: https://github.com/kubernetes-sigs/kind/blob/main/images/base/Dockerfile https://github.com/kubernetes-sigs/kind/blob/main/images/bas... You could run this as a standalone container docker run --rm -d --name my-node --volume=/lib/modules:/lib/modules:ro --volume=/var --volume=/kind --privileged docker.io/kindest/node:v1.25.3 then exec in and use it like a vm. it comes with containerd installed and running but you could also install docker docker exec -it my-node bash
gbraad 4y ago
Not entirely sure about the usecase, but podman itself integrates well with systemd, like creating services. But it feels like you want a full systemd OS in a container instead of a VM. Not the best practice. VM might better for this, though Podman can run systemd based services. And Podman in docker or podman in podman is not an issue. https://blog.while-true-do.io/podman-systemd-in-containers/ https://blog.while-true-do.io/podman-systemd-in-containers/ Podman machine starts a VM that is just a Fedora distro, with systemd and you can create multiple instances. This way you can run these system containers easily.
Woeps 4y ago
"these “system” containers should be able to run containers inside them as well (docker in docker?)." I think you can run podman in podman. But your comment actually makes me wonder how easy it would be to run docker/podman in chroot
CoolCold 4y ago
One more vote for LXD/LXC. Very neat and quick

rb12345 4y ago

LXC/LXD are probably the closest to that on Linux, although I'm not sure about nesting containers.

CoolCold 4y ago
It works. Used it just 1 hour ago last time. lxc launch ubuntu:22.04 docktest -c security.nest More on https://bobcares.com/blog/lxd-and-docker-containers-nesting/ https://bobcares.com/blog/lxd-and-docker-containers-nesting/

MikeKusold 4y ago

Proxmox allows you to launch LXC containers via a UI. I use it at home and I'm able to run Docker in both a privileged LXC and an unprivileged LXC.

dinosaurdynasty 4y ago

systemd-nspawn, LXC, and podman should all be able to do that (though doing recursive containers can be kind of weird). In theory https://github.com/firecracker-microvm/firecracker https://github.com/firecracker-microvm/firecracker should as well, it runs very lightweight VMs.

rmolina 4y ago

You are probably referring to Sysbox (https://github.com/nestybox/sysbox https://github.com/nestybox/sysbox), which I believe will meet your requirements (systemd, inner containers, security, etc). Btw, Sysbox is already supported in Docker-Desktop (business tier only), so you can easily do what you want with this instruction: $ docker run -it --rm -e SYSBOX_SYSCONT_MODE=TRUE ghcr.io/nestybox/ubuntu-focal-systemd-docker:latest bash Disclaimer: I'm Sysbox's co-creator and currently working for Docker.

lmarcos 4y ago
Sysbox works great! Amazing job. But OP is looking for something that works for macos I believe.
- rmolina 4y ago
  Appreciate your comment lmarcos! Yes, the above instruction runs on macos too as long as you have docker-desktop installed.

moondev 4y ago

kind (kubernetes inside docker) does this by building a specialized container that includes and uses systemd as the entrypoint: https://github.com/kubernetes-sigs/kind/blob/main/images/base/Dockerfile https://github.com/kubernetes-sigs/kind/blob/main/images/bas... You could run this as a standalone container docker run --rm -d --name my-node --volume=/lib/modules:/lib/modules:ro --volume=/var --volume=/kind --privileged docker.io/kindest/node:v1.25.3 then exec in and use it like a vm. it comes with containerd installed and running but you could also install docker docker exec -it my-node bash

gbraad 4y ago

Not entirely sure about the usecase, but podman itself integrates well with systemd, like creating services. But it feels like you want a full systemd OS in a container instead of a VM. Not the best practice. VM might better for this, though Podman can run systemd based services. And Podman in docker or podman in podman is not an issue. https://blog.while-true-do.io/podman-systemd-in-containers/ https://blog.while-true-do.io/podman-systemd-in-containers/ Podman machine starts a VM that is just a Fedora distro, with systemd and you can create multiple instances. This way you can run these system containers easily.

Woeps 4y ago

"these “system” containers should be able to run containers inside them as well (docker in docker?)." I think you can run podman in podman. But your comment actually makes me wonder how easy it would be to run docker/podman in chroot

CoolCold 4y ago

One more vote for LXD/LXC. Very neat and quick